MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity
PyMISP/examples/situational-awareness
History
Déborah Servili a4f90a7ac1 add legend 2017-02-03 16:34:50 +01:00
..
README.md add tags_to_graphs.py in ecamples/situational-awareness 2016-09-05 14:14:29 +02:00
attribute_treemap.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
bokeh_tools.py add legend 2017-02-03 16:34:50 +01:00
date_tools.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
pygal_tools.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
style.css add tags_to_graphs.py in ecamples/situational-awareness 2016-09-05 14:14:29 +02:00
style2.css add tags_to_graphs.py in ecamples/situational-awareness 2016-09-05 14:14:29 +02:00
tag_scatter.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
tag_search.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
tags_count.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
tags_to_graphs.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00
test_attribute_treemap.html restore file deleted by mistake 2017-02-03 16:16:18 +01:00
tools.py add ta_scatter.py script & reorganise tools 2017-02-03 16:12:02 +01:00

README.md

Explanation

  • treemap.py is a script that will generate an interactive svg (attribute_treemap.svg) containing a treepmap representing the distribution of attributes in a sample (data) fetched from the instance using "last" or "searchall" examples.

  • It will also generate a html document with a table (attribute_table.html) containing count for each type of attribute.

  • test_attribute_treemap.html is a quick page made to visualize both treemap and table at the same time.

  • tags_count.py is a script that count the number of occurences of every tags in a fetched sample of Events in a given period of time.

  • tag_search.py is a script that count the number of occurences of a given tag in a fetched sample of Events in a given period of time.

    • Events will be fetched from days days ago to today.
    • begindate is the beginning of the studied period. If it is later than today, an error will be raised.
    • enddate is the end of the studied period. If it is earlier than begindate, an error will be raised.
    • tag_search.py allows research for multiple tags is possible by separating each tag by the | symbol.
    • Partial research is also possible with tag_search.py. For instance, search for "ransom" will also return tags containin "ransomware".

  • tags_to_graphs.py is a script that will generate several plots to visualise tags distribution.

    • The studied period can be either the 7, 28 or 360 last days
    • accuracy allows to get smallers splits of data instead of the default values
    • order define the accuracy of the curve fitting. Default value is 3
    • It will generate two plots comparing all the tags:
      • tags_repartition_plot that present the raw data
      • tags_repartition_trend_plot that present the general evolution for each tag
    • Then each taxonomies will be represented in three plots:
      • Raw datas: in "plot" folder, named with the name of the corresponding taxonomy
      • Trend: in "plot" folder, named taxonomy_trend. general evolution of the data (linear fitting, curve fitting at order 1)
      • Curve fitting: in "plotlib" folder, name as the taxonomy it presents.
    • In order to visualize the last plots, a html file is also generated automaticaly (might be improved in the future)

⚠️ These scripts are not time optimised

Requierements