MISP
/
misp-book
mirror of https://github.com/MISP/misp-book
2
0
Fork 0
Code Issues Releases Wiki Activity

- Removed trailing spaces and fixed obvious typose

pull/88/head
Steve Clement 2018-02-02 12:11:56 +01:00
parent b7e6894a34
commit 98dc537178
1 changed files with 21 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pymisp/README.md
View File

@ -30,7 +30,7 @@ You can install PyMISP by either using pip or by getting the last version from t
pip install pymisp pip install pymisp
~~~~ ~~~~
#### Install the lastest version from repo #### Install the latest version from the repository
~~~~ ~~~~
git clone https://github.com/MISP/PyMISP.git && cd PyMISP git clone https://github.com/MISP/PyMISP.git && cd PyMISP
python setup.py install python setup.py install
@ -88,13 +88,13 @@ try:
except NameError: except NameError:
pass pass
~~~~ ~~~~
Just a few lines to be sure that pyhon 2 and 3 are supported Just a few lines to be sure that python 2 and 3 are supported
~~~~python ~~~~python
def init(url, key): def init(url, key):
return PyMISP(url, key, True, 'json', debug=True) return PyMISP(url, key, True, 'json', debug=True)
~~~~ ~~~~
This function will create a PyMISP object that will be used later to interact with the MISP instance. This function will create a PyMISP object that will be used later to interact with the MISP instance.
As seen in the [api.py](https://github.com/CIRCL/PyMISP/blob/master/pymisp/api.py#L85), a PyMISP object need to know both the url of the MISP instance and the API key to use. It can also take additionnal and not mandatory data, such as the use or not of SSL or the name of the export format. As seen in the [api.py](https://github.com/CIRCL/PyMISP/blob/master/pymisp/api.py#L85), a PyMISP object need to know both the URL of the MISP instance and the API key to use. It can also take additional and not mandatory data, such as the use or not of SSL or the name of the export format.
~~~~python ~~~~python
if __name__ == '__main__': if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Create an event on MISP.') parser = argparse.ArgumentParser(description='Create an event on MISP.')
@ -172,7 +172,7 @@ Arguments:
#### delete_user.py #### delete_user.py
Delete the user with the given id. Keep in mind that disabling users (by setting the disabled flag via an edit) is always prefered to keep user associations to events intact. Delete the user with the given id. Keep in mind that disabling users (by setting the disabled flag via an edit) is always preferred to keep user associations to events intact.
Arguments: Arguments:
* **user_id**: The id of the user you want to delete. * **user_id**: The id of the user you want to delete.
@ -273,10 +273,10 @@ Arguments:
* **event**: Not supplying an event ID will cause MISP to create a single new event for all of the POSTed malware samples. * **event**: Not supplying an event ID will cause MISP to create a single new event for all of the POSTed malware samples.
* **distrib**: The distribution setting used for the attributes and for the newly created event, if relevant. [0-3]. * **distrib**: The distribution setting used for the attributes and for the newly created event, if relevant. [0-3].
* **ids**: You can flag all attributes created during the transaction to be marked as \"to_ids\" or not. * **ids**: You can flag all attributes created during the transaction to be marked as \"to_ids\" or not.
* **categ**: The category that will be assigned to the uploaded samples. Valid options are: Payload delivery, Artifacts dropped, Payload Installation, External Analysis. * **categ**: The category that will be assigned to the uploaded samples. Valid options are: Payload delivery, Artefacts dropped, Payload Installation, External Analysis.
* **info**: Used to populate the event info field if no event ID supplied. * **info**: Used to populate the event info field if no event ID supplied.
* **analysis**: The analysis level of the newly created event, if applicatble. [0-2] * **analysis**: The analysis level of the newly created event, if applicable. [0-2]
* **threat**: The threat level ID of the newly created event, if applicatble. [1-4] * **threat**: The threat level ID of the newly created event, if applicable. [1-4]
* **comment**: Comment for the uploaded file(s). * **comment**: Comment for the uploaded file(s).
#### users_list.py #### users_list.py
@ -332,6 +332,6 @@ Allow to import OpenIOC files into MISP easily. It is also possible to set speci
#### Situational Awareness #### Situational Awareness
* attribute_treemap.py generate a treemap showing the distribution of the attributes on the misp instance. * attribute_treemap.py generate a tree-map showing the distribution of the attributes on the MISP instance.
* tags_* : these functions help having statistics and graphs about the tag repartition. * tags_* : these functions help having statistics and graphs about the tag repartition.