From ba9d72ad3ca550528cd6d7b5c63b599f7241f672 Mon Sep 17 00:00:00 2001 From: Sami Mokaddem Date: Wed, 31 Jan 2024 08:20:55 +0100 Subject: [PATCH] chg: [a.7-rest] Updated Jupyter notebook with output --- .../Training - Using the API in MISP.ipynb | 1557 +++++++++++++++-- 1 file changed, 1389 insertions(+), 168 deletions(-) diff --git a/a.7-rest-API/Training - Using the API in MISP.ipynb b/a.7-rest-API/Training - Using the API in MISP.ipynb index b0a5a0e..a17da53 100644 --- a/a.7-rest-API/Training - Using the API in MISP.ipynb +++ b/a.7-rest-API/Training - Using the API in MISP.ipynb @@ -52,14 +52,24 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 38, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stderr", + "output_type": "stream", + "text": [ + "The version of PyMISP recommended by the MISP instance (2.4.183) is newer than the one you're using now (2.4.168). Please upgrade PyMISP.\n" + ] + } + ], "source": [ "from pymisp import ExpandedPyMISP\n", "from pprint import pprint\n", - "AUTHKEY = \"AY6Qur7V1kyQ1BTefWiiTx7B6KM7ABln1UVpfDKB\"\n", + "AUTHKEY = \"AaRwZVxZqE8peVet1LGfTYMOkOfFfa7rlS5i5xfL\"\n", "URL = \"https://localhost:8443\"\n", + "import urllib3\n", + "urllib3.disable_warnings()\n", "misp = ExpandedPyMISP(URL, AUTHKEY, False)\n", "\n", "def print_result(result):\n", @@ -98,9 +108,51 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 39, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Event': {'Attribute': [],\n", + " 'CryptographicKey': [],\n", + " 'EventReport': [],\n", + " 'Galaxy': [],\n", + " 'Object': [],\n", + " 'Org': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'RelatedEvent': [],\n", + " 'ShadowAttribute': [],\n", + " 'analysis': '0',\n", + " 'attribute_count': '0',\n", + " 'date': '2024-01-18',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '0',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581715',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'}}\n" + ] + } + ], "source": [ "# Creation\n", "endpoint = '/events/add'\n", @@ -118,16 +170,58 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 44, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Event': {'Attribute': [],\n", + " 'CryptographicKey': [],\n", + " 'EventReport': [],\n", + " 'Galaxy': [],\n", + " 'Object': [],\n", + " 'Org': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'RelatedEvent': [],\n", + " 'ShadowAttribute': [],\n", + " 'analysis': '0',\n", + " 'attribute_count': '0',\n", + " 'date': '2024-01-18',\n", + " 'disable_correlation': False,\n", + " 'distribution': '3',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '0',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581830',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'}}\n" + ] + } + ], "source": [ "# Edition 1\n", "endpoint = '/events/edit/'\n", - "relative_path = '21'\n", + "relative_path = '126'\n", "\n", "body = {\n", - " \"distribution\": 3\n", + " \"distribution\": 3,\n", "# \"sharing_group_id\": 1\n", "}\n", "\n", @@ -137,13 +231,108 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 45, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Event': {'Attribute': [{'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56142',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705581872',\n", + " 'to_ids': True,\n", + " 'type': 'ip-src',\n", + " 'uuid': '6938d503-7d96-48b6-9a18-f8e6f95f04dd',\n", + " 'value': '9.9.9.9'}],\n", + " 'CryptographicKey': [],\n", + " 'EventReport': [],\n", + " 'Galaxy': [],\n", + " 'Object': [],\n", + " 'Org': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'RelatedEvent': [{'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2024-01-16',\n", + " 'distribution': '3',\n", + " 'id': '122',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': False,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581786',\n", + " 'uuid': 'de96c637-2282-4fc0-9c4e-ca7db60bace1'}},\n", + " {'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2023-09-28',\n", + " 'distribution': '0',\n", + " 'id': '87',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': True,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1695907402',\n", + " 'uuid': 'a1348888-5a3e-4e18-acd5-b5015c9621ed'}}],\n", + " 'ShadowAttribute': [],\n", + " 'analysis': '0',\n", + " 'attribute_count': '1',\n", + " 'date': '2024-01-18',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '0',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581872',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'}}\n" + ] + } + ], "source": [ "# Edition 2 - Adding Attribute\n", "endpoint = '/events/edit/'\n", - "relative_path = '18'\n", + "relative_path = '126'\n", "\n", "body = {\n", " \"distribution\": 0,\n", @@ -161,87 +350,35 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 47, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'message': 'Global tag tlp:red123(400) successfully attached to Event(126).',\n", + " 'name': 'Global tag tlp:red123(400) successfully attached to Event(126).',\n", + " 'saved': True,\n", + " 'success': True,\n", + " 'url': '/tags/attachTagToObject'}\n" + ] + } + ], "source": [ - "# Edition 2 - tagging - The bad way (Fetch the whole event and re-process everything)\n", - "endpoint = '/events/edit/'\n", - "relative_path = '29'\n", - "\n", - "body = {\n", - " \"distribution\": 0,\n", - " \"EventTag\": {\n", - " \"Tag\": [\n", - " {\"name\":\"tlp:red\"}\n", - " ]\n", - " }\n", - "}\n", - "\n", - "res = misp.direct_call(endpoint + relative_path, body)\n", - "print_result(res)" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [ - "# Edition 2 - tagging - The better way\n", + "# Edition 2 - tagging 1\n", "endpoint = '/tags/attachTagToObject'\n", "relative_path = ''\n", "\n", "body = {\n", - " \"uuid\": \"5d6f857e-698c-4ea0-834a-6db1cfc4a0a0\", # can be anything: event or attribute\n", - " \"tag\": \"tlp:green\"\n", + " \"uuid\": \"b3cc1ea2-892f-48e1-a6dc-20279818a724\", # can be anything: event or attribute\n", + " \"tag\": \"tlp:red\"\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", "print_result(res)" ] }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [ - "# Searching the Event index (Move it to the search topic)\n", - "endpoint = '/events/index'\n", - "relative_path = ''\n", - "\n", - "body = {\n", - "# \"eventinfo\": \"api\",\n", - " \"publish_timestamp\": \"2019-05-21\",\n", - "# \"org\": \"ORGNAME\"\n", - "}\n", - "\n", - "res = misp.direct_call(endpoint + relative_path, body)\n", - "print_result(res)" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [ - "# Searching the Event index\n", - "misp_url = '/events/index'\n", - "relative_path = ''\n", - "\n", - "body = {\n", - " \"hasproposal\": 1,\n", - " \"tag\": [\"tlp:amber\"]\n", - "}\n", - "\n", - "res = misp.direct_call(endpoint + relative_path, body)\n", - "\n", - "print('Event number: %s' % len(res))\n", - "print_result(res)" - ] - }, { "cell_type": "markdown", "metadata": {}, @@ -258,18 +395,47 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 48, "metadata": {}, "outputs": [], "source": [ - "event_id = XXXXX" + "event_id = 126" ] }, { "cell_type": "code", - "execution_count": null, + "execution_count": 49, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 19\n", + "----------\n", + "{'Attribute': {'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705582067',\n", + " 'to_ids': True,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '8.8.8.9',\n", + " 'value1': '8.8.8.9',\n", + " 'value2': ''},\n", + " 'AttributeTag': []}\n" + ] + } + ], "source": [ "# Adding\n", "endpoint = '/attributes/add/'\n", @@ -286,9 +452,32 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 50, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stderr", + "output_type": "stream", + "text": [ + "Something went wrong (403): {'saved': False, 'name': 'Could not add Attribute', 'message': 'Could not add Attribute', 'url': '/attributes/add', 'errors': {'value': ['Checksum has an invalid length or format (expected: 32 hexadecimal characters). Please double check the value or select type \"other\".']}}\n" + ] + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'errors': (403,\n", + " {'errors': {'value': ['Checksum has an invalid length or format '\n", + " '(expected: 32 hexadecimal characters). '\n", + " 'Please double check the value or select '\n", + " 'type \"other\".']},\n", + " 'message': 'Could not add Attribute',\n", + " 'name': 'Could not add Attribute',\n", + " 'saved': False,\n", + " 'url': '/attributes/add'})}\n" + ] + } + ], "source": [ "# Adding invalid attribute type\n", "endpoint = '/attributes/add/'\n", @@ -305,13 +494,39 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 51, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 17\n", + "----------\n", + "{'Attribute': {'category': 'Network activity',\n", + " 'comment': 'Comment added via the API',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705582158',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.0.0.1'}}\n" + ] + } + ], "source": [ "# Editing\n", - "endpoint = '/attributes/edit/'\n", - "relative_path = '36586'\n", + "endpoint = '/attributes/edit/' # /attributes/edit/[attribute_id]\n", + "relative_path = '56143'\n", "\n", "body = {\n", " \"value\": \"127.0.0.1\",\n", @@ -325,43 +540,60 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 54, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 17\n", + "----------\n", + "{'Attribute': {'category': 'Network activity',\n", + " 'comment': 'Comment added via the API',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705582332',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.1.1.1'}}\n" + ] + } + ], "source": [ "# Editing with data taken from JSON views. \n", "# (timestamp) contrast the difference with *PyMISP*\n", "endpoint = '/attributes/edit/'\n", - "relative_path = 'XXXXXXXX'\n", + "relative_path = '56143'\n", "\n", "body = {\n", - " \"id\": \"XXXXXXXX\",\n", + " \"id\": \"56143\",\n", " \"type\": \"ip-dst\",\n", " \"category\": \"Network activity\",\n", " \"to_ids\": False,\n", - " \"uuid\": \"5cf65823-d22c-45ae-af4f-47d80a00020f\",\n", - " \"event_id\": \"33\",\n", + " \"uuid\": \"8153fcad-cd37-45d9-a1d1-a509942116f8\",\n", + " \"event_id\": \"126\",\n", " \"distribution\": \"5\",\n", " \"comment\": \"Comment added via the API\",\n", " \"sharing_group_id\": \"0\",\n", " \"deleted\": False,\n", " \"disable_correlation\": False,\n", " \"object_id\": \"0\",\n", - " \"object_relation\": '',\n", - " \"value\": \"1.2.3.5\",\n", + " \"object_relation\": None,\n", + " \"first_seen\": None,\n", + " \"last_seen\": None,\n", + " \"value\": \"127.1.1.1\",\n", " \"Galaxy\": [],\n", - " \"ShadowAttribute\": [],\n", - " \"Tag\": [\n", - " {\n", - " \"id\": \"4\",\n", - " \"name\": \"tlp:green\",\n", - " \"colour\": \"#14ff00\",\n", - " \"exportable\": True,\n", - " \"user_id\": \"0\",\n", - " \"hide_tag\": False,\n", - " \"numerical_value\": ''\n", - " }\n", - " ]\n", + " \"ShadowAttribute\": []\n", " }\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -377,11 +609,52 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 55, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Object': {'Attribute': [{'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post',\n", + " 'value1': 'post',\n", + " 'value2': ''}],\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'description': 'Microblog post like a Twitter tweet or a post on a '\n", + " 'Facebook wall.',\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '645',\n", + " 'last_seen': None,\n", + " 'meta-category': 'misc',\n", + " 'name': 'microblog',\n", + " 'sharing_group_id': '0',\n", + " 'template_uuid': '8ec8c911-ddbe-4f5b-895b-fbff70c42a60',\n", + " 'template_version': '5',\n", + " 'timestamp': '1558702173',\n", + " 'uuid': '838aefb1-0f6e-4967-9a99-e7414887ae9a'}}\n" + ] + } + ], "source": [ - "# Example of an un-documented endpoint\n", "endpoint = '/objects/add/'\n", "relative_path = str(event_id)\n", "\n", @@ -424,12 +697,334 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 58, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Event': {'Attribute': [{'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56142',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705581872',\n", + " 'to_ids': True,\n", + " 'type': 'ip-src',\n", + " 'uuid': '6938d503-7d96-48b6-9a18-f8e6f95f04dd',\n", + " 'value': '9.9.9.9'},\n", + " {'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Network activity',\n", + " 'comment': 'Comment added via the API',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705582453',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.2.2.2'}],\n", + " 'CryptographicKey': [],\n", + " 'EventReport': [],\n", + " 'Galaxy': [],\n", + " 'Object': [{'Attribute': [{'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post'}],\n", + " 'ObjectReference': [],\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'description': 'Microblog post like a Twitter tweet or '\n", + " 'a post on a Facebook wall.',\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '645',\n", + " 'last_seen': None,\n", + " 'meta-category': 'misc',\n", + " 'name': 'microblog',\n", + " 'sharing_group_id': '0',\n", + " 'template_uuid': '8ec8c911-ddbe-4f5b-895b-fbff70c42a60',\n", + " 'template_version': '5',\n", + " 'timestamp': '1558702173',\n", + " 'uuid': '838aefb1-0f6e-4967-9a99-e7414887ae9a'}],\n", + " 'Org': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'RelatedEvent': [{'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2024-01-16',\n", + " 'distribution': '3',\n", + " 'id': '122',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': False,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581786',\n", + " 'uuid': 'de96c637-2282-4fc0-9c4e-ca7db60bace1'}},\n", + " {'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2023-09-28',\n", + " 'distribution': '0',\n", + " 'id': '87',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': True,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1695907402',\n", + " 'uuid': 'a1348888-5a3e-4e18-acd5-b5015c9621ed'}}],\n", + " 'ShadowAttribute': [],\n", + " 'Tag': [{'colour': '#FF2B2B',\n", + " 'exportable': True,\n", + " 'hide_tag': False,\n", + " 'id': '16',\n", + " 'is_custom_galaxy': False,\n", + " 'is_galaxy': False,\n", + " 'local': 0,\n", + " 'local_only': False,\n", + " 'name': 'tlp:red',\n", + " 'numerical_value': None,\n", + " 'relationship_type': None,\n", + " 'user_id': '0'},\n", + " {'colour': '#33FF00',\n", + " 'exportable': True,\n", + " 'hide_tag': False,\n", + " 'id': '79',\n", + " 'is_custom_galaxy': False,\n", + " 'is_galaxy': False,\n", + " 'local': 0,\n", + " 'local_only': False,\n", + " 'name': 'tlp:green',\n", + " 'numerical_value': None,\n", + " 'relationship_type': None,\n", + " 'user_id': '0'}],\n", + " 'analysis': '0',\n", + " 'attribute_count': '3',\n", + " 'date': '2024-01-18',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '0',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705582663',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'}}\n" + ] + } + ], "source": [ - "# Go to event Edit 2\n", - "# Go to add tag the bad way" + "# Edition 2 - tagging 2\n", + "endpoint = '/events/edit/'\n", + "relative_path = '126'\n", + "\n", + "body = {\n", + " \"distribution\": 0,\n", + " \"Tag\": [\n", + " {\"name\":\"tlp:green\"}\n", + " ]\n", + "}\n", + "\n", + "res = misp.direct_call(endpoint + relative_path, body)\n", + "print_result(res)" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Searches" + ] + }, + { + "cell_type": "code", + "execution_count": 61, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 2\n", + "----------\n", + "[{'EventTag': [{'Tag': {'colour': '#33FF00',\n", + " 'id': '79',\n", + " 'is_galaxy': False,\n", + " 'name': 'tlp:green'},\n", + " 'event_id': '87',\n", + " 'id': '483',\n", + " 'local': False,\n", + " 'relationship_type': '',\n", + " 'tag_id': '79'}],\n", + " 'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'attribute_count': '5',\n", + " 'date': '2023-09-28',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'extends_uuid': '',\n", + " 'id': '87',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '1695907664',\n", + " 'published': True,\n", + " 'sharing_group_id': '0',\n", + " 'sighting_timestamp': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1695907402',\n", + " 'uuid': 'a1348888-5a3e-4e18-acd5-b5015c9621ed'},\n", + " {'EventTag': [{'Tag': {'colour': '#FFC000',\n", + " 'id': '81',\n", + " 'is_galaxy': False,\n", + " 'name': 'tlp:amber'},\n", + " 'event_id': '122',\n", + " 'id': '592',\n", + " 'local': False,\n", + " 'relationship_type': '',\n", + " 'tag_id': '81'}],\n", + " 'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'attribute_count': '4',\n", + " 'date': '2024-01-16',\n", + " 'disable_correlation': False,\n", + " 'distribution': '3',\n", + " 'extends_uuid': '',\n", + " 'id': '122',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '1705411595',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'sighting_timestamp': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581786',\n", + " 'uuid': 'de96c637-2282-4fc0-9c4e-ca7db60bace1'}]\n" + ] + } + ], + "source": [ + "# Searching the Event index (Move it to the search topic)\n", + "endpoint = '/events/index'\n", + "relative_path = ''\n", + "\n", + "body = {\n", + " \"eventinfo\": \"api\",\n", + " \"publish_timestamp\": \"2023-09-06\",\n", + " \"org\": \"ORGNAME\"\n", + "}\n", + "\n", + "res = misp.direct_call(endpoint + relative_path, body)\n", + "print_result(res)" + ] + }, + { + "cell_type": "code", + "execution_count": 63, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Event number: 0\n", + "Count: 0\n", + "----------\n", + "[]\n" + ] + } + ], + "source": [ + "# Searching the Event index\n", + "misp_url = '/events/index'\n", + "relative_path = ''\n", + "\n", + "body = {\n", + "# \"hasproposal\": 1,\n", + " \"tag\": [\"tlp:amber\"]\n", + "}\n", + "\n", + "res = misp.direct_call(endpoint + relative_path, body)\n", + "\n", + "print('Event number: %s' % len(res))\n", + "print_result(res)" ] }, { @@ -449,9 +1044,90 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 64, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 3\n", + "----------\n", + "{'Attribute': [{'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56142',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705581872',\n", + " 'to_ids': True,\n", + " 'type': 'ip-src',\n", + " 'uuid': '6938d503-7d96-48b6-9a18-f8e6f95f04dd',\n", + " 'value': '9.9.9.9'},\n", + " {'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'category': 'Network activity',\n", + " 'comment': 'Comment added via the API',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705582453',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.2.2.2'},\n", + " {'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Object': {'distribution': '5',\n", + " 'id': '645',\n", + " 'sharing_group_id': '0'},\n", + " 'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post'}]}\n" + ] + } + ], "source": [ "endpoint = '/attributes/restSearch/'\n", "relative_path = ''\n", @@ -467,9 +1143,44 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 69, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 1\n", + "----------\n", + "{'Attribute': [{'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Object': {'distribution': '5',\n", + " 'id': '645',\n", + " 'sharing_group_id': '0'},\n", + " 'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post'}]}\n" + ] + } + ], "source": [ "# Searches on Attribute's data\n", "misp_url = '/attributes/restSearch/'\n", @@ -479,7 +1190,7 @@ " \"returnFormat\": \"json\",\n", " \"eventid\": event_id,\n", " \"type\": \"ip-dst\",\n", - " \"value\": \"1.2.3.%\"\n", + "# \"value\": \"127.0.%\"\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -488,9 +1199,19 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 71, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 0\n", + "----------\n", + "{'Attribute': []}\n" + ] + } + ], "source": [ "# Searches on Attribute's data\n", "endpoint = '/attributes/restSearch/'\n", @@ -510,9 +1231,111 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 77, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 3\n", + "----------\n", + "{'Attribute': [{'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Tag': [{'colour': '#FF2B2B',\n", + " 'id': '16',\n", + " 'inherited': 1,\n", + " 'name': 'tlp:red',\n", + " 'numerical_value': None}],\n", + " 'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56142',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705581872',\n", + " 'to_ids': True,\n", + " 'type': 'ip-src',\n", + " 'uuid': '6938d503-7d96-48b6-9a18-f8e6f95f04dd',\n", + " 'value': '9.9.9.9'},\n", + " {'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Tag': [{'colour': '#ffffff',\n", + " 'id': '6',\n", + " 'is_galaxy': False,\n", + " 'local': False,\n", + " 'name': 'tlp:white',\n", + " 'numerical_value': None},\n", + " {'colour': '#FF2B2B',\n", + " 'id': '16',\n", + " 'inherited': 1,\n", + " 'name': 'tlp:red',\n", + " 'numerical_value': None}],\n", + " 'category': 'Network activity',\n", + " 'comment': 'Comment added via the API',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705583213',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.2.2.2'},\n", + " {'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Object': {'distribution': '5',\n", + " 'id': '645',\n", + " 'sharing_group_id': '0'},\n", + " 'Tag': [{'colour': '#FF2B2B',\n", + " 'id': '16',\n", + " 'inherited': 1,\n", + " 'name': 'tlp:red',\n", + " 'numerical_value': None}],\n", + " 'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post'}]}\n" + ] + } + ], "source": [ "# Searches on Attribute's data\n", "endpoint = '/attributes/restSearch/'\n", @@ -521,13 +1344,13 @@ "body = {\n", " \"returnFormat\": \"json\",\n", " \"eventid\": event_id,\n", - "# \"tags\": \"tlp:white\",\n", + " \"tags\": \"tlp:white\",\n", "# \"tags\": [\"tlp:white\", \"tlp:green\"]\n", "# \"tags\": [\"!tlp:green\"]\n", "# \"tags\": \"tlp:%\",\n", "# \"includeEventTags\": 1\n", "# BRAND NEW (only tag)! Prefered way (Most accurate): Distinction between OR and AND!\n", - " \"tags\": {\"AND\": [\"tlp:green\", \"Malware\"], \"NOT\": [\"%ransomware%\"]}\n", + "# \"tags\": {\"AND\": [\"tlp:green\", \"Malware\"], \"NOT\": [\"%ransomware%\"]}\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -536,9 +1359,19 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 83, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 0\n", + "----------\n", + "{'Attribute': []}\n" + ] + } + ], "source": [ "# Paginating\n", "endpoint = '/attributes/restSearch/'\n", @@ -547,8 +1380,8 @@ "body = {\n", " \"returnFormat\": \"json\",\n", " \"eventid\": event_id,\n", - " \"page\": 2,\n", - " \"limit\": 1\n", + "# \"page\": 0,\n", + "# \"limit\": 10000\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -579,9 +1412,19 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 86, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 0\n", + "----------\n", + "{'Attribute': []}\n" + ] + } + ], "source": [ "# Searches based on time: Relative\n", "endpoint = '/attributes/restSearch/'\n", @@ -593,7 +1436,7 @@ " \"returnFormat\": \"json\",\n", " \"eventid\": event_id,\n", "# \"to_ids\": 1,\n", - " \"last\": \"2019-08-28\"\n", + " \"publish_timestamp\": \"2019-08-28\"\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -617,9 +1460,42 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 89, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 1\n", + "----------\n", + "{'Attribute': [{'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'category': 'Payload delivery',\n", + " 'comment': '',\n", + " 'data': 'dGVzdAo=',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56145',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705584018',\n", + " 'to_ids': False,\n", + " 'type': 'attachment',\n", + " 'uuid': '1b436ea7-5fc3-485f-b059-9bfff544925f',\n", + " 'value': 'test.txt'}]}\n" + ] + } + ], "source": [ "# Searches with attachments\n", "endpoint = '/attributes/restSearch/'\n", @@ -629,7 +1505,7 @@ " \"returnFormat\": \"json\",\n", " \"eventid\": event_id,\n", " \"type\": \"attachment\",\n", - "# \"withAttachments\": 1\n", + " \"withAttachments\": 1\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -638,9 +1514,47 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 93, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 1\n", + "----------\n", + "{'Attribute': [{'Event': {'distribution': '0',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'},\n", + " 'Tag': [{'colour': '#ffffff',\n", + " 'id': '6',\n", + " 'is_galaxy': False,\n", + " 'local': False,\n", + " 'name': 'tlp:white',\n", + " 'numerical_value': None}],\n", + " 'category': 'Network activity',\n", + " 'comment': 'Comment added via the API!',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705583914',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.2.2.2'}]}\n" + ] + } + ], "source": [ "# Searches - Others\n", "endpoint = '/attributes/restSearch/'\n", @@ -648,9 +1562,9 @@ "\n", "body = {\n", " \"returnFormat\": \"json\",\n", - " \"eventid\": 31,\n", - " \"type\": \"ip-src\",\n", - "# \"enforceWarninglist\": 1\n", + " \"eventid\": event_id,\n", + " \"type\": [\"ip-src\", \"ip-dst\"],\n", + " \"enforceWarninglist\": 1\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -666,9 +1580,216 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 94, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 1\n", + " - Attribute count: 3\n", + "----------\n", + "[{'Event': {'Attribute': [{'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Network activity',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56142',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705581872',\n", + " 'to_ids': True,\n", + " 'type': 'ip-src',\n", + " 'uuid': '6938d503-7d96-48b6-9a18-f8e6f95f04dd',\n", + " 'value': '9.9.9.9'},\n", + " {'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'Tag': [{'colour': '#ffffff',\n", + " 'exportable': True,\n", + " 'hide_tag': False,\n", + " 'id': '6',\n", + " 'is_custom_galaxy': False,\n", + " 'is_galaxy': False,\n", + " 'local': 0,\n", + " 'local_only': False,\n", + " 'name': 'tlp:white',\n", + " 'numerical_value': None,\n", + " 'relationship_type': None,\n", + " 'user_id': '0'}],\n", + " 'category': 'Network activity',\n", + " 'comment': 'Comment added via the API!',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56143',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705583914',\n", + " 'to_ids': False,\n", + " 'type': 'ip-dst',\n", + " 'uuid': '8153fcad-cd37-45d9-a1d1-a509942116f8',\n", + " 'value': '127.2.2.2'},\n", + " {'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Payload delivery',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56145',\n", + " 'last_seen': None,\n", + " 'object_id': '0',\n", + " 'object_relation': None,\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1705584018',\n", + " 'to_ids': False,\n", + " 'type': 'attachment',\n", + " 'uuid': '1b436ea7-5fc3-485f-b059-9bfff544925f',\n", + " 'value': 'test.txt'}],\n", + " 'CryptographicKey': [],\n", + " 'EventReport': [],\n", + " 'Galaxy': [],\n", + " 'Object': [{'Attribute': [{'Galaxy': [],\n", + " 'ShadowAttribute': [],\n", + " 'category': 'Other',\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'disable_correlation': False,\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '56144',\n", + " 'last_seen': None,\n", + " 'object_id': '645',\n", + " 'object_relation': 'post',\n", + " 'sharing_group_id': '0',\n", + " 'timestamp': '1558702173',\n", + " 'to_ids': False,\n", + " 'type': 'text',\n", + " 'uuid': '7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5',\n", + " 'value': 'post'}],\n", + " 'ObjectReference': [],\n", + " 'comment': '',\n", + " 'deleted': False,\n", + " 'description': 'Microblog post like a Twitter tweet or '\n", + " 'a post on a Facebook wall.',\n", + " 'distribution': '5',\n", + " 'event_id': '126',\n", + " 'first_seen': None,\n", + " 'id': '645',\n", + " 'last_seen': None,\n", + " 'meta-category': 'misc',\n", + " 'name': 'microblog',\n", + " 'sharing_group_id': '0',\n", + " 'template_uuid': '8ec8c911-ddbe-4f5b-895b-fbff70c42a60',\n", + " 'template_version': '5',\n", + " 'timestamp': '1558702173',\n", + " 'uuid': '838aefb1-0f6e-4967-9a99-e7414887ae9a'}],\n", + " 'Org': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'local': True,\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'RelatedEvent': [{'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2024-01-16',\n", + " 'distribution': '3',\n", + " 'id': '122',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': False,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705581786',\n", + " 'uuid': 'de96c637-2282-4fc0-9c4e-ca7db60bace1'}},\n", + " {'Event': {'Org': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'Orgc': {'id': '1',\n", + " 'name': 'ORGNAME',\n", + " 'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n", + " 'analysis': '0',\n", + " 'date': '2023-09-28',\n", + " 'distribution': '0',\n", + " 'id': '87',\n", + " 'info': 'Event created via the API as '\n", + " 'an example',\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'published': True,\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1695907402',\n", + " 'uuid': 'a1348888-5a3e-4e18-acd5-b5015c9621ed'}}],\n", + " 'ShadowAttribute': [],\n", + " 'Tag': [{'colour': '#FF2B2B',\n", + " 'exportable': True,\n", + " 'hide_tag': False,\n", + " 'id': '16',\n", + " 'is_custom_galaxy': False,\n", + " 'is_galaxy': False,\n", + " 'local': 0,\n", + " 'local_only': False,\n", + " 'name': 'tlp:red',\n", + " 'numerical_value': None,\n", + " 'relationship_type': None,\n", + " 'user_id': '0'},\n", + " {'colour': '#326300',\n", + " 'exportable': True,\n", + " 'hide_tag': False,\n", + " 'id': '29',\n", + " 'is_custom_galaxy': False,\n", + " 'is_galaxy': False,\n", + " 'local': 0,\n", + " 'local_only': False,\n", + " 'name': 'circl:incident-classification=\"phishing\"',\n", + " 'numerical_value': None,\n", + " 'relationship_type': None,\n", + " 'user_id': '0'}],\n", + " 'analysis': '0',\n", + " 'attribute_count': '4',\n", + " 'date': '2024-01-18',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '126',\n", + " 'info': 'Event created via the API as an example',\n", + " 'locked': False,\n", + " 'org_id': '1',\n", + " 'orgc_id': '1',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '1705583856',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1705584018',\n", + " 'uuid': 'b3cc1ea2-892f-48e1-a6dc-20279818a724'}}]\n" + ] + } + ], "source": [ "# Searching using the RestSearch\n", "endpoint = '/events/restSearch'\n", @@ -676,7 +1797,7 @@ "\n", "body = {\n", " \"returnFormat\": \"json\",\n", - " \"eventid\": 31,\n", + " \"eventid\": 126,\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -685,32 +1806,58 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 95, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "$TTL 1w;\r\n", + "@ SOA localhost. root.localhost (2024011800 2h 30m 30d 1h)\r\n", + " NS localhost.\r\n", + "\r\n" + ] + } + ], "source": [ "# Searching using the RestSearch - Other return format\n", "!curl \\\n", - " -d '{\"returnFormat\":\"rpz\",\"eventid\":31}' \\\n", - " -H \"Authorization: ptU1OggdiLLWlwHPO9B3lzpwEND3hL7gH0uEsyYL\" \\\n", + " -d '{\"returnFormat\":\"rpz\",\"eventid\":126}' \\\n", + " -H \"Authorization: AaRwZVxZqE8peVet1LGfTYMOkOfFfa7rlS5i5xfL\" \\\n", " -H \"Accept: application/json\" \\\n", " -H \"Content-type: application/json\" \\\n", - " -X POST 127.0.0.1:8080/events/restSearch 2> /dev/null" + " -k \\\n", + " -X POST https://localhost:8443/events/restSearch 2> /dev/null" ] }, { "cell_type": "code", - "execution_count": null, + "execution_count": 96, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "uuid,event_id,category,type,value,comment,to_ids,date,object_relation,attribute_tag,object_uuid,object_name,object_meta_category\r\n", + "\"6938d503-7d96-48b6-9a18-f8e6f95f04dd\",126,\"Network activity\",\"ip-src\",\"9.9.9.9\",\"\",1,1705581872,\"\",\"\",\"\",\"\",\"\"\r\n", + "\"8153fcad-cd37-45d9-a1d1-a509942116f8\",126,\"Network activity\",\"ip-dst\",\"127.2.2.2\",\"Comment added via the API!\",0,1705583914,\"\",\"tlp:white\",\"\",\"\",\"\"\r\n", + "\"1b436ea7-5fc3-485f-b059-9bfff544925f\",126,\"Payload delivery\",\"attachment\",\"test.txt\",\"\",0,1705584018,\"\",\"\",\"\",\"\",\"\"\r\n", + "\"7ed55fe3-cae9-4353-9cd6-cdcb9a50bba5\",126,\"Other\",\"text\",\"post\",\"\",0,1558702173,\"post\",\"\",\"838aefb1-0f6e-4967-9a99-e7414887ae9a\",\"microblog\",\"misc\"\r\n", + "\r\n" + ] + } + ], "source": [ "# Searching using the RestSearch - Other return format\n", "!curl \\\n", - " -d '{\"returnFormat\":\"csv\",\"eventid\":31}' \\\n", - " -H \"Authorization: ptU1OggdiLLWlwHPO9B3lzpwEND3hL7gH0uEsyYL\" \\\n", + " -d '{\"returnFormat\":\"csv\",\"eventid\":126}' \\\n", + " -H \"Authorization: AaRwZVxZqE8peVet1LGfTYMOkOfFfa7rlS5i5xfL\" \\\n", " -H \"Accept: application/json\" \\\n", " -H \"Content-type: application/json\" \\\n", - " -X POST 127.0.0.1:8080/events/restSearch 2> /dev/null" + " -k \\\n", + " -X POST https://localhost:8443/events/restSearch 2> /dev/null" ] }, { @@ -734,9 +1881,49 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 97, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Count: 1\n", + "----------\n", + "[{'Event': {'CryptographicKey': [],\n", + " 'Galaxy': [],\n", + " 'Org': {'id': '2',\n", + " 'local': True,\n", + " 'name': 'CIRCL',\n", + " 'uuid': '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0'},\n", + " 'Orgc': {'id': '2',\n", + " 'local': True,\n", + " 'name': 'CIRCL',\n", + " 'uuid': '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0'},\n", + " 'RelatedEvent': [],\n", + " 'analysis': '0',\n", + " 'attribute_count': '2',\n", + " 'date': '2023-02-08',\n", + " 'disable_correlation': False,\n", + " 'distribution': '0',\n", + " 'event_creator_email': 'admin@admin.test',\n", + " 'extends_uuid': '',\n", + " 'id': '51',\n", + " 'info': 'Incident 1',\n", + " 'locked': False,\n", + " 'org_id': '2',\n", + " 'orgc_id': '2',\n", + " 'proposal_email_lock': False,\n", + " 'protected': None,\n", + " 'publish_timestamp': '0',\n", + " 'published': False,\n", + " 'sharing_group_id': '0',\n", + " 'threat_level_id': '1',\n", + " 'timestamp': '1675875565',\n", + " 'uuid': '65c1aa0e-4d03-4d4b-a6c0-42730a4dbdc6'}}]\n" + ] + } + ], "source": [ "# Searching using the RestSearch\n", "endpoint = '/events/restSearch'\n", @@ -745,7 +1932,7 @@ "body = {\n", " \"returnFormat\": \"json\",\n", " \"org\": \"CIRCL\",\n", - " \"id\": 33,\n", + "# \"id\": 33,\n", " \"metadata\": 1\n", "}\n", "\n", @@ -791,8 +1978,8 @@ "relative_path = ''\n", "\n", "body = {\n", - "# \"id\": \"36578\"\n", - " \"value\": \"parsed-ail.json\"\n", + " \"id\": \"56143\"\n", + "# \"value\": \"127.2.2.2\"\n", "}\n", "\n", "res = misp.direct_call(endpoint + relative_path, body)\n", @@ -829,9 +2016,19 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 98, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'8.8.8.8': [{'id': '49',\n", + " 'matched': '8.8.8.8/32',\n", + " 'name': 'List of known IPv4 public DNS resolvers'}]}\n" + ] + } + ], "source": [ "# Checking values against the warining list\n", "endpoint = '/warninglists/checkValue'\n", @@ -962,9 +2159,33 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 99, "metadata": {}, - "outputs": [], + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'stats': {'attribute_count': 51848,\n", + " 'attribute_count_month': 11,\n", + " 'attributes_per_event': 701,\n", + " 'average_user_per_org': 2.6,\n", + " 'contributing_org_count': 6,\n", + " 'correlation_count': 63,\n", + " 'event_count': 74,\n", + " 'event_count_month': 7,\n", + " 'local_org_count': 7,\n", + " 'org_count': 16,\n", + " 'post_count': 14,\n", + " 'post_count_month': 0,\n", + " 'proposal_count': 1,\n", + " 'thread_count': 2,\n", + " 'thread_count_month': 0,\n", + " 'user_count': 18,\n", + " 'user_count_pgp': 0}}\n" + ] + } + ], "source": [ "# Statistics\n", "endpoint = '/users/statistics'\n", @@ -987,7 +2208,7 @@ ], "metadata": { "kernelspec": { - "display_name": "Python 3", + "display_name": "Python 3 (ipykernel)", "language": "python", "name": "python3" }, @@ -1001,7 +2222,7 @@ "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", - "version": "3.6.8" + "version": "3.8.10" } }, "nbformat": 4,