PyMISP DocumentationAbstractMISP is the master class, and inherit collections.MutableMapping which means the class can be represented as a python dictionary. The abstraction assumes

PyMISP DocumentationRelease main

Raphaeumll Vinot

Aug 04 2020

CONTENTS

1 README 3

2 pymisp 721 PyMISP 722 PyMISPExpanded (Python 36+ only) 2323 MISPAbstract 2324 MISPEncode 2425 MISPEvent 2426 MISPAttribute 2627 MISPObject 2828 MISPObjectAttribute 2929 MISPObjectReference 31210 MISPTag 32211 MISPUser 33212 MISPOrganisation 34

3 pymisp - Tools 3731 File Object 3732 ELF Object 3833 PE Object 3834 Mach-O Object 3835 VT Report Object 3836 STIX 4037 OpenIOC 40

4 Indices and tables 41

Python Module Index 43

Index 45

i

ii

PyMISP Documentation Release main

Contents

IMPORTANT NOTE This library will require at least python 36 starting the 1st of January 2020 If you have tolegacy versions of python please use PyMISP v241191 and consider updating your system(s) Anything releasedwithin the last 2 years will do starting with Ubuntu 1804

CONTENTS 1

PyMISP Documentation Release main

2 CONTENTS

CHAPTER

ONE

README

[[Documentation Status](httpsreadthedocsorgprojectspymispbadgeversion=latest)](httppymispreadthedocsiobadge=latest) [[Build Status](httpstravis-ciorgMISPPyMISPsvgbranch=main)](httpstravis-ciorgMISPPyMISP) [[Coverage Status](httpscoverallsioreposgithubMISPPyMISPbadgesvgbranch=main)](httpscoverallsiogithubMISPPyMISPbranch=main) [[Python 36](httpsimgshieldsiobadgepython-36+-bluesvg)](httpswwwpythonorgdownloadsreleasepython-360) [[PyPi ver-sion](httpsimgshieldsiopypivpymispsvg)](httpspypipythonorgpypipymisp) [[Number of PyPI down-loads](httpsimgshieldsiopypidmpymispsvg)](httpspypipythonorgpypipymisp)

PyMISP - Python Library to access MISP

PyMISP is a Python library to access [MISP](httpsgithubcomMISPMISP) platforms via their REST API

PyMISP allows you to fetch events add or update eventsattributes add or update samples or search for attributes

Install from pip

It is strongly recommended to use a virtual environment

If you want to know more about virtual environments [python has you covered](httpsdocspythonorg3tutorialvenvhtml)

Only basic dependencies ` pip3 install pymisp `

With optional dependencies ` pip3 install pymisp[fileobjectsopeniocvirustotal] `

Install the latest version from repo from development purposes

Note poetry is required

` git clone httpsgithubcomMISPPyMISPgit ampamp cd PyMISP git submoduleupdate --init poetry install -E fileobjects -E openioc -E virustotal -E docs-E pdfexport `

Running the tests

`bash poetry run nosetests-34 --with-coverage --cover-package=pymisptests--cover-tests teststest_py `

If you have a MISP instance to test against you can also run the live ones

Note You need to update the key in teststestlive_comprehensivepy to the automation key of your admin account

`bash poetry run nosetests-34 --with-coverage --cover-package=pymisptests--cover-tests teststestlive_comprehensivepy `

Samples and how to use PyMISP

Various examples and samples scripts are in the [examples](examples) directory

In the examples directory you will need to change the keyspysample to enter your MISP url and API key

3

PyMISP Documentation Release main

` cd examples cp keyspysample keyspy vim keyspy `

The API key of MISP is available in the Automation section of the MISP web interface

To test if your URL and API keys are correct you can test with exampleslastpy to fetch the events pub-lished in the last x amount of time (supported time indicators days (d) hours (h) and minutes (m))lastpy ` cd examples python3 lastpy -l 10h 10 hours python3 lastpy -l 5d 5days python3 lastpy -l 45m 45 minutes `

Debugging

You have two options there

1 Pass debug=True to PyMISP and it will enable loggingDEBUG to stderr on the whole module

2 Use the python logging module directly

```python

import logging logger = logginggetLogger(lsquopymisprsquo)

Configure it as you whish for example enable DEBUG mode loggersetLevel(loggingDEBUG) ```

Or if you want to write the debug output to a file instead of stderr

```python import pymisp import logging

logger = logginggetLogger(lsquopymisprsquo) loggingbasicConfig(level=loggingDEBUG filename=rdquodebuglogrdquo file-mode=rsquowrsquo format=pymispFORMAT) ```

Test cases

1 The content of mispeventpy is tested on every commit

2 The tests cases that require a running MISP instance can be run the following way

```bash From poetry

nosetests-34 -s ndashwith-coverage ndashcover-package=pymisptests ndashcover-tests teststestlive_comprehensivepyTestComprehensive[test_name]

```

Documentation

The documentation is available [here](httpspymispreadthedocsioenlatest)

Jupyter notebook

A series of [Jupyter notebooks for PyMISP tutorial](httpsgithubcomMISPPyMISPtreemaindocstutorial) areavailable in the repository

Everything is a Mutable Mapping

or at least everything that can be importedexported fromto a json blob

AbstractMISP is the master class and inherit collectionsMutableMapping which means the class can be representedas a python dictionary

The abstraction assumes every property that should not be seen in the dictionary is prepended with a _ or its name isadded to the private list __not_jsonable (accessible through update_not_jsonable and set_not_jsonable

This master class has helpers that will make it easy to load and export to and from a json string

MISPEvent MISPAttribute MISPObjectReference MISPObjectAttribute and MISPObject are subclasses of Abstract-MISP which mean that they can be handled as python dictionaries

MISP Objects

4 Chapter 1 README