Python library using the MISP Rest API
Go to file
Raphaël Vinot 39ffa91cd4 fix: properly bundle object templates 2017-10-24 09:07:33 -04:00
docs Improve document generation 2017-07-20 16:46:19 +02:00
examples Merge branch 'objects' 2017-09-18 11:43:48 +01:00
pymisp chg: Bump version 2017-10-24 08:54:38 -04:00
tests fix: live tests 2017-09-20 16:02:18 +01:00
.gitchangelog.rc Fix: Changelog config + update 2017-10-04 10:25:10 +02:00
.gitignore new: Added ability to add attachments to events 2017-01-13 13:15:53 +00:00
.gitmodules Initial commit supporting MISP Objects 2017-07-21 20:34:56 +02:00
.travis.yml fix: Fix travis build 2017-10-20 11:28:57 +02:00
CHANGELOG.txt chg: update changelog 2017-10-24 08:56:08 -04:00
LICENSE add license 2014-12-09 14:54:45 +01:00
MANIFEST.in fix: properly bundle object templates 2017-10-24 09:07:33 -04:00
README.md Update README 2017-10-16 00:20:54 +02:00
setup.cfg Fix PyPi package. 2015-08-05 17:48:15 +02:00
setup.py fix: properly bundle object templates 2017-10-24 09:07:33 -04:00

README.md

README

Documentation Status Build Status Coverage Status

PyMISP - Python Library to access MISP

PyMISP is a Python library to access MISP platforms via their REST API.

PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.

Requirements

Install from pip

pip3 install pymisp

Install the latest version from repo

git clone https://github.com/CIRCL/PyMISP.git && cd PyMISP
pip3 install -I .

Samples and how to use PyMISP

Various examples and samples scripts are in the examples/ directory.

In the examples directory, you will need to change the keys.py.sample to enter your MISP url and API key.

cd examples
cp keys.py.sample keys.py
vim keys.py

The API key of MISP is available in the Automation section of the MISP web interface.

To test if your URL and API keys are correct, you can test with examples/last.py to fetch the last 10 events published.

cd examples
python3 last.py -l 10

Documentation

PyMISP API documentation is available.

Documentation can be generated with epydoc:

epydoc --url https://github.com/CIRCL/PyMISP --graph all --name PyMISP --pdf pymisp -o doc

Everything is a Mutable Mapping

... or at least everything that can be imported/exported from/to a json blob

AbstractMISP is the master class, and inherit collections.MutableMapping which means the class can be represented as a python dictionary.

The abstraction assumes every property that should not be seen in the dictionary is prepended with a _, or its name is added to the private list __not_jsonable (accessible through update_not_jsonable and set_not_jsonable.

This master class has helpers that will make it easy to load, and export, to, and from, a json string.

MISPEvent, MISPAttribute, MISPObjectReference, MISPObjectAttribute, and MISPObject are subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.

MISP Objects

Creating a new MISP object generator should be done using a pre-defined template and inherit AbstractMISPObjectGenerator.

Your new MISPObject generator need to generate attributes, and add them as class properties using add_attribute.

When the object is sent to MISP, all the class properties will be exported to the JSON export.