mirror of https://github.com/MISP/PyMISP
commit
cf3d7e5e0f
|
@ -1,6 +1,7 @@
|
||||||
*.swp
|
*.swp
|
||||||
*.pem
|
*.pem
|
||||||
*.pyc
|
*.pyc
|
||||||
|
docs/build/
|
||||||
examples/keys.py
|
examples/keys.py
|
||||||
examples/cudeso.py
|
examples/cudeso.py
|
||||||
examples/feed-generator/output/*\.json
|
examples/feed-generator/output/*\.json
|
||||||
|
|
21
README.md
21
README.md
|
@ -1,7 +1,6 @@
|
||||||
**IMPORTANT NOTE**: This library will require **at least** python 3.6 starting the 1st of January 2020. If you have to legacy versions of python, please use PyMISP v2.4.119.1, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 18.04.
|
**IMPORTANT NOTE**: This library will require **at least** python 3.6 starting the 1st of January 2020. If you have legacy versions of python, please use PyMISP v2.4.119.1, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 18.04.
|
||||||
|
|
||||||
README
|
# PyMISP - Python Library to access MISP
|
||||||
======
|
|
||||||
|
|
||||||
[![Documentation Status](https://readthedocs.org/projects/pymisp/badge/?version=latest)](http://pymisp.readthedocs.io/?badge=latest)
|
[![Documentation Status](https://readthedocs.org/projects/pymisp/badge/?version=latest)](http://pymisp.readthedocs.io/?badge=latest)
|
||||||
[![Build Status](https://travis-ci.org/MISP/PyMISP.svg?branch=main)](https://travis-ci.org/MISP/PyMISP)
|
[![Build Status](https://travis-ci.org/MISP/PyMISP.svg?branch=main)](https://travis-ci.org/MISP/PyMISP)
|
||||||
|
@ -10,8 +9,6 @@ README
|
||||||
[![PyPi version](https://img.shields.io/pypi/v/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
|
[![PyPi version](https://img.shields.io/pypi/v/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
|
||||||
[![Number of PyPI downloads](https://img.shields.io/pypi/dm/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
|
[![Number of PyPI downloads](https://img.shields.io/pypi/dm/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
|
||||||
|
|
||||||
# PyMISP - Python Library to access MISP
|
|
||||||
|
|
||||||
PyMISP is a Python library to access [MISP](https://github.com/MISP/MISP) platforms via their REST API.
|
PyMISP is a Python library to access [MISP](https://github.com/MISP/MISP) platforms via their REST API.
|
||||||
|
|
||||||
PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.
|
PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.
|
||||||
|
@ -34,7 +31,7 @@ pip3 install pymisp[fileobjects,openioc,virustotal]
|
||||||
|
|
||||||
## Install the latest version from repo from development purposes
|
## Install the latest version from repo from development purposes
|
||||||
|
|
||||||
**Note**: poetry is required
|
**Note**: poetry is required; e.g., "pip3 install poetry"
|
||||||
|
|
||||||
```
|
```
|
||||||
git clone https://github.com/MISP/PyMISP.git && cd PyMISP
|
git clone https://github.com/MISP/PyMISP.git && cd PyMISP
|
||||||
|
@ -83,7 +80,7 @@ python3 last.py -l 45m # 45 minutes
|
||||||
|
|
||||||
## Debugging
|
## Debugging
|
||||||
|
|
||||||
You have two options there:
|
You have two options here:
|
||||||
|
|
||||||
1. Pass `debug=True` to `PyMISP` and it will enable logging.DEBUG to stderr on the whole module
|
1. Pass `debug=True` to `PyMISP` and it will enable logging.DEBUG to stderr on the whole module
|
||||||
|
|
||||||
|
@ -94,7 +91,7 @@ You have two options there:
|
||||||
import logging
|
import logging
|
||||||
logger = logging.getLogger('pymisp')
|
logger = logging.getLogger('pymisp')
|
||||||
|
|
||||||
# Configure it as you whish, for example, enable DEBUG mode:
|
# Configure it as you wish, for example, enable DEBUG mode:
|
||||||
logger.setLevel(logging.DEBUG)
|
logger.setLevel(logging.DEBUG)
|
||||||
```
|
```
|
||||||
|
|
||||||
|
@ -111,7 +108,7 @@ logging.basicConfig(level=logging.DEBUG, filename="debug.log", filemode='w', for
|
||||||
## Test cases
|
## Test cases
|
||||||
|
|
||||||
1. The content of `mispevent.py` is tested on every commit
|
1. The content of `mispevent.py` is tested on every commit
|
||||||
2. The tests cases that require a running MISP instance can be run the following way:
|
2. The test cases that require a running MISP instance can be run the following way:
|
||||||
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
|
@ -133,13 +130,13 @@ A series of [Jupyter notebooks for PyMISP tutorial](https://github.com/MISP/PyMI
|
||||||
|
|
||||||
... or at least everything that can be imported/exported from/to a json blob
|
... or at least everything that can be imported/exported from/to a json blob
|
||||||
|
|
||||||
`AbstractMISP` is the master class, and inherit `collections.MutableMapping` which means
|
`AbstractMISP` is the master class, and inherits from `collections.MutableMapping` which means
|
||||||
the class can be represented as a python dictionary.
|
the class can be represented as a python dictionary.
|
||||||
|
|
||||||
The abstraction assumes every property that should not be seen in the dictionary is prepended with a `_`,
|
The abstraction assumes every property that should not be seen in the dictionary is prepended with a `_`,
|
||||||
or its name is added to the private list `__not_jsonable` (accessible through `update_not_jsonable` and `set_not_jsonable`.
|
or its name is added to the private list `__not_jsonable` (accessible through `update_not_jsonable` and `set_not_jsonable`.
|
||||||
|
|
||||||
This master class has helpers that will make it easy to load, and export, to, and from, a json string.
|
This master class has helpers that make it easy to load, and export to, and from, a json string.
|
||||||
|
|
||||||
`MISPEvent`, `MISPAttribute`, `MISPObjectReference`, `MISPObjectAttribute`, and `MISPObject`
|
`MISPEvent`, `MISPAttribute`, `MISPObjectReference`, `MISPObjectAttribute`, and `MISPObject`
|
||||||
are subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.
|
are subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.
|
||||||
|
@ -148,6 +145,6 @@ are subclasses of AbstractMISP, which mean that they can be handled as python di
|
||||||
|
|
||||||
Creating a new MISP object generator should be done using a pre-defined template and inherit `AbstractMISPObjectGenerator`.
|
Creating a new MISP object generator should be done using a pre-defined template and inherit `AbstractMISPObjectGenerator`.
|
||||||
|
|
||||||
Your new MISPObject generator need to generate attributes, and add them as class properties using `add_attribute`.
|
Your new MISPObject generator must generate attributes and add them as class properties using `add_attribute`.
|
||||||
|
|
||||||
When the object is sent to MISP, all the class properties will be exported to the JSON export.
|
When the object is sent to MISP, all the class properties will be exported to the JSON export.
|
||||||
|
|
|
@ -40,6 +40,7 @@ extensions = [
|
||||||
'sphinx.ext.viewcode',
|
'sphinx.ext.viewcode',
|
||||||
'sphinx.ext.napoleon',
|
'sphinx.ext.napoleon',
|
||||||
'sphinx.ext.imgconverter',
|
'sphinx.ext.imgconverter',
|
||||||
|
'recommonmark',
|
||||||
]
|
]
|
||||||
|
|
||||||
napoleon_google_docstring = False
|
napoleon_google_docstring = False
|
||||||
|
@ -132,6 +133,9 @@ pygments_style = 'sphinx'
|
||||||
# If true, `todo` and `todoList` produce output, else they produce nothing.
|
# If true, `todo` and `todoList` produce output, else they produce nothing.
|
||||||
todo_include_todos = True
|
todo_include_todos = True
|
||||||
|
|
||||||
|
# lief is a bit difficult to install
|
||||||
|
autodoc_mock_imports = ["lief"]
|
||||||
|
|
||||||
|
|
||||||
# -- Options for HTML output ----------------------------------------------
|
# -- Options for HTML output ----------------------------------------------
|
||||||
|
|
||||||
|
|
|
@ -9,7 +9,7 @@ Welcome to PyMISP's documentation!
|
||||||
Contents:
|
Contents:
|
||||||
|
|
||||||
.. toctree::
|
.. toctree::
|
||||||
:maxdepth: 4
|
:maxdepth: 2
|
||||||
|
|
||||||
README
|
README
|
||||||
modules
|
modules
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
pymisp
|
pymisp - Modules
|
||||||
======
|
================
|
||||||
|
|
||||||
.. toctree::
|
.. toctree::
|
||||||
:maxdepth: 4
|
:maxdepth: 4
|
||||||
|
|
798
pymisp/api.py
798
pymisp/api.py
File diff suppressed because it is too large
Load Diff
|
@ -1030,8 +1030,7 @@ class MISPEvent(AbstractMISP):
|
||||||
|
|
||||||
def to_feed(self, valid_distributions: List[int] = [0, 1, 2, 3, 4, 5], with_meta: bool = False) -> Dict:
|
def to_feed(self, valid_distributions: List[int] = [0, 1, 2, 3, 4, 5], with_meta: bool = False) -> Dict:
|
||||||
""" Generate a json output for MISP Feed.
|
""" Generate a json output for MISP Feed.
|
||||||
Notes:
|
Note: valid_distributions only makes sense if the distribution key is set; i.e., the event is exported from a MISP instance.
|
||||||
* valid_distributions only makes sense if the distribution key is set (i.e. the event is exported from a MISP instance)
|
|
||||||
"""
|
"""
|
||||||
required = ['info', 'Orgc']
|
required = ['info', 'Orgc']
|
||||||
for r in required:
|
for r in required:
|
||||||
|
|
Loading…
Reference in New Issue