Repository files navigation

PyMISP is a Python library to accessMISP platforms via their REST API.

PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.

It is strongly recommended to use a virtual environment

If you want to know more about virtual environments,python has you covered

Only basic dependencies:

pip3 install pymisp

And there are a few optional dependencies:

• fileobjects: to create PE/ELF/Mach-o objects
• openioc: to import files in OpenIOC format (not really maintained)
• virustotal: to query VirusTotal and generate the appropriate objects
• docs: to generate te documentation
• pdfexport: to generate PDF reports out of MISP events
• url: to generate URL objects out of URLs with Pyfaup
• email: to generate MISP Email objects
• brotli: to use the brotli compression when interacting with a MISP instance

Example:

pip3 install pymisp[virustotal,email]

Note: poetry is required; e.g., "pip3 install poetry"

git clone https://github.com/MISP/PyMISP.git && cd PyMISPgit submodule update --initpoetry install -E fileobjects -E openioc -E virustotal -E docs -E pdfexport -E email

poetry run pytest --cov=pymisp tests/test_*.py

If you have a MISP instance to test against, you can also run the live ones:

Note: You need to update the key intests/testlive_comprehensive.py to the automation key of your admin account.

poetry run pytest --cov=pymisp tests/testlive_comprehensive.py

Various examples and samples scripts are in theexamples/ directory.

In the examples directory, you will need to change the keys.py.sample to enter your MISP url and API key.

cd examplescp keys.py.sample keys.pyvim keys.py

The API key of MISP is available in the Automation section of the MISP web interface.

To test if your URL and API keys are correct, you can test with examples/last.py tofetch the events published in the last x amount of time (supported time indicators: days (d), hours (h) and minutes (m)).last.py

cd examplespython3 last.py -l 10h # 10 hourspython3 last.py -l 5d  #  5 dayspython3 last.py -l 45m # 45 minutes

You have two options here:

1. Passdebug=True toPyMISP and it will enable logging.DEBUG to stderr on the whole module

2. Use the python logging module directly:

importlogginglogger=logging.getLogger('pymisp')# Configure it as you wish, for example, enable DEBUG mode:logger.setLevel(logging.DEBUG)

Or if you want to write the debug output to a file instead of stderr:

importpymispimportlogginglogger=logging.getLogger('pymisp')logging.basicConfig(level=logging.DEBUG,filename="debug.log",filemode='w',format=pymisp.FORMAT)

1. The content ofmispevent.py is tested on every commit
2. The test cases that require a running MISP instance can be run the following way:

# From poetrypytest --cov=pymisp tests/test_*.py tests/testlive_comprehensive.py:TestComprehensive.[test_name]

The documentation is availablehere.

A series ofJupyter notebooks for PyMISP tutorial are available in the repository.

... or at least everything that can be imported/exported from/to a json blob

AbstractMISP is the master class, and inherits fromcollections.MutableMapping which meansthe class can be represented as a python dictionary.

The abstraction assumes every property that should not be seen in the dictionary is prepended with a_,or its name is added to the private list__not_jsonable (accessible throughupdate_not_jsonable andset_not_jsonable.

This master class has helpers that make it easy to load, and export to, and from, a json string.

MISPEvent,MISPAttribute,MISPObjectReference,MISPObjectAttribute, andMISPObjectare subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.

Creating a new MISP object generator should be done using a pre-defined template and inheritAbstractMISPObjectGenerator.

Your new MISPObject generator must generate attributes and add them as class properties usingadd_attribute.

When the object is sent to MISP, all the class properties will be exported to the JSON export.

This is done using poetry and you need to have this repository cloned on your machine.The commands below have to be run from inside the cloned directory.

1. From a machine with access to the internet, get the dependencies:

mkdir offlinepoetryexport --all-extras> offline/requirements.txtpoetry run pip download -r offline/requirements.txt -d offline/packages/

2. Prepare the PyMISP Package

poetry buildmv dist/*.whl offline/packages/

3. Copy the content ofoffline/packages/ to the machine with no internet access.

4. Install the packages:

python -m pip install --no-index --no-deps packages/*.whl

PyMISP is distributed under anopen source license. A simplified 2-BSD license.