Python PyMISP.new_event方法代码示例

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
 def test_newEvent(self, m):
     error_empty_info = {'message': 'The event could not be saved.', 'name': 'Add event failed.', 'errors': ['Error in info: Info cannot be empty.'], 'url': '/events/add'}
     error_empty_info_flatten = {u'message': u'The event could not be saved.', u'name': u'Add event failed.', u'errors': [u"Error in info: Info cannot be empty."], u'url': u'/events/add'}
     self.initURI(m)
     pymisp = PyMISP(self.domain, self.key)
     m.register_uri('POST', self.domain + 'events', json=error_empty_info)
     # TODO Add test exception if info field isn't set
     response = pymisp.new_event(0, 1, 0, 'Foo')
     self.assertEqual(response, error_empty_info_flatten)
     m.register_uri('POST', self.domain + 'events', json=self.new_misp_event)
     response = pymisp.new_event(0, 1, 0, "This is a test.", '2016-08-26', False)
     self.assertEqual(response, self.new_misp_event)

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
 def test_newEvent(self, m):
     error_empty_info = {
         "message": "The event could not be saved.",
         "name": "Add event failed.",
         "errors": {"Event": {"info": ["Info cannot be empty."]}},
         "url": "/events/add",
     }
     error_empty_info_flatten = {
         u"message": u"The event could not be saved.",
         u"name": u"Add event failed.",
         u"errors": [u"Error in info: Info cannot be empty."],
         u"url": u"/events/add",
     }
     self.initURI(m)
     pymisp = PyMISP(self.domain, self.key)
     m.register_uri("POST", self.domain + "events", json=error_empty_info)
     # TODO Add test exception if info field isn't set
     response = pymisp.new_event(0, 1, 0, "Foo")
     self.assertEqual(response, error_empty_info_flatten)
     m.register_uri("POST", self.domain + "events", json=self.new_misp_event)
     response = pymisp.new_event(0, 1, 0, "This is a test.", "2016-08-26", False)
     self.assertEqual(response, self.new_misp_event)

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
 def test_newEvent(self, m):
     error_empty_info = {'message': 'The event could not be saved.', 'name': 'Add event failed.', 'errors': {'Event': {'info': ['Info cannot be empty.']}}, 'url': '/events/add'}
     error_empty_info_flatten = {u'message': u'The event could not be saved.', u'name': u'Add event failed.', u'errors': [u"Error in info: Info cannot be empty."], u'url': u'/events/add'}
     self.initURI(m)
     pymisp = PyMISP(self.domain, self.key)
     with self.assertRaises(pm.api.NewEventError):
         pymisp.new_event()
     with self.assertRaises(pm.api.NewEventError):
         pymisp.new_event(0)
     with self.assertRaises(pm.api.NewEventError):
         pymisp.new_event(0, 1)
     m.register_uri('POST', self.domain + 'events', json=error_empty_info)
     response = pymisp.new_event(0, 1, 0)
     self.assertEqual(response, error_empty_info_flatten)
     m.register_uri('POST', self.domain + 'events', json=self.new_misp_event)
     response = pymisp.new_event(0, 1, 0, "This is a test.", '2016-08-26', False)
     self.assertEqual(response, self.new_misp_event)

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
class TestBasic(unittest.TestCase):

    def setUp(self):
        self.maxDiff = None
        self.misp = PyMISP(url, key, True, 'json')

    def _clean_event(self, event):
        event['Event'].pop('uuid', None)
        event['Event'].pop('timestamp', None)
        event['Event'].pop('date', None)
        event['Event'].pop('org', None)
        event['Event'].pop('orgc', None)
        event['Event'].pop('RelatedEvent', None)
        event['Event'].pop('publish_timestamp', None)
        if event['Event'].get('Attribute'):
            for a in event['Event'].get('Attribute'):
                a.pop('uuid', None)
                a.pop('event_id', None)
                a.pop('id', None)
                a.pop('timestamp', None)
        return event['Event'].pop('id', None)

    def new_event(self):
        event = self.misp.new_event(0, 1, 0, "This is a test")
        event_id = self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'0', u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': False,
                               u'distribution': u'0', u'Attribute': [], u'proposal_email_lock': False,
                               u'threat_level_id': u'1'}},
        self.assertEqual(event, to_check, 'Failed at creating a new Event')
        return int(event_id)

    def add_hashes(self, eventid):
        r = self.misp.get_event(eventid)
        event = r.json()
        event = self.misp.add_hashes(event, 'Payload installation', 'dll_installer.dll', '0a209ac0de4ac033f31d6ba9191a8f7a', '1f0ae54ac3f10d533013f74f48849de4e65817a7', '003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9', 'Fanny modules', False, 2)
        self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'3', u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': False, u'distribution': u'0',
                               u'Attribute': [
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|0a209ac0de4ac033f31d6ba9191a8f7a',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|md5'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|1f0ae54ac3f10d533013f74f48849de4e65817a7',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha1'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha256'}],
                               u'proposal_email_lock': False, u'threat_level_id': u'1'}}
        self.assertEqual(event, to_check, 'Failed at adding hashes')

    def publish(self, eventid):
        r = self.misp.get_event(eventid)
        event = r.json()
        event = self.misp.publish(event)
        self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'3', u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': True, u'distribution': u'0',
                               u'Attribute': [
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|0a209ac0de4ac033f31d6ba9191a8f7a',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|md5'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|1f0ae54ac3f10d533013f74f48849de4e65817a7',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha1'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha256'}],
                               u'proposal_email_lock': False, u'threat_level_id': u'1'}}
        self.assertEqual(event, to_check, 'Failed at publishing event')

    def delete(self, eventid):
        event = self.misp.delete_event(eventid)
        print event.json()

    def delete_attr(self, attrid):
        event = self.misp.delete_attribute(attrid)
        print event.json()

    def get(self, eventid):
        event = self.misp.get_event(eventid)
        print event.json()

    def add(self):
        event = {u'Event': {u'info': u'This is a test', u'locked': False,
                            u'attribute_count': u'3', u'analysis': u'0',
                            u'ShadowAttribute': [], u'published': False, u'distribution': u'0',
                            u'Attribute': [
                                {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                 u'to_ids': False, u'value': u'dll_installer.dll|0a209ac0de4ac033f31d6ba9191a8f7a',
                                 u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|md5'},
                                {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                 u'to_ids': False, u'value': u'dll_installer.dll|1f0ae54ac3f10d533013f74f48849de4e65817a7',
                                 u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha1'},
                                {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                 u'to_ids': False, u'value': u'dll_installer.dll|003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9',
#.........这里部分代码省略.........

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
class TestBasic(unittest.TestCase):

    def setUp(self):
        self.maxDiff = None
        self.misp = PyMISP(url, key, True, 'json')

    def _clean_event(self, event):
        event['Event'].pop('orgc_id', None)
        event['Event'].pop('uuid', None)
        event['Event'].pop('sharing_group_id', None)
        event['Event'].pop('timestamp', None)
        event['Event'].pop('org_id', None)
        event['Event'].pop('date', None)
        event['Event'].pop('RelatedEvent', None)
        event['Event'].pop('publish_timestamp', None)
        if event['Event'].get('Attribute'):
            for a in event['Event'].get('Attribute'):
                a.pop('uuid', None)
                a.pop('event_id', None)
                a.pop('id', None)
                a.pop('timestamp', None)
        if event['Event'].get('Orgc'):
            event['Event']['Orgc'].pop('uuid', None)
            event['Event']['Orgc'].pop('id', None)
        if event['Event'].get('Org'):
            event['Event']['Org'].pop('uuid', None)
            event['Event']['Org'].pop('id', None)
        return event['Event'].pop('id', None)

    def new_event(self):
        event = self.misp.new_event(0, 1, 0, "This is a test")
        event_id = self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'0', 'disable_correlation': False, u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': False,
                               u'distribution': u'0', u'event_creator_email': u'[email protected]', u'Attribute': [], u'proposal_email_lock': False,
                               u'Object': [], u'Org': {u'name': u'ORGNAME'},
                               u'Orgc': {u'name': u'ORGNAME'},
                               u'Galaxy': [],
                               u'threat_level_id': u'1'}}
        self.assertEqual(event, to_check, 'Failed at creating a new Event')
        return int(event_id)

    def add_hashes(self, eventid):
        r = self.misp.get_event(eventid)
        event = r.json()
        event = self.misp.add_hashes(event, 'Payload installation', 'dll_installer.dll', '0a209ac0de4ac033f31d6ba9191a8f7a', '1f0ae54ac3f10d533013f74f48849de4e65817a7', '003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9', 'Fanny modules', False, 2)
        self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'3', u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': False, u'distribution': u'0', u'event_creator_email': u'[email protected]',
                               u'Org': {u'name': u'ORGNAME'},
                               u'Orgc': {u'name': u'ORGNAME'},
                               u'Galaxy': [],
                               u'Attribute': [
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|0a209ac0de4ac033f31d6ba9191a8f7a',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|md5'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|1f0ae54ac3f10d533013f74f48849de4e65817a7',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha1'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha256'}],
                               u'proposal_email_lock': False, u'threat_level_id': u'1'}}
        self.assertEqual(event, to_check, 'Failed at adding hashes')

    def publish(self, eventid):
        r = self.misp.get_event(eventid)
        event = r.json()
        event = self.misp.publish(event)
        self._clean_event(event)
        to_check = {u'Event': {u'info': u'This is a test', u'locked': False,
                               u'attribute_count': u'3', u'analysis': u'0',
                               u'ShadowAttribute': [], u'published': True, u'distribution': u'0', u'event_creator_email': u'[email protected]',
                               u'Org': {u'name': u'ORGNAME'},
                               u'Orgc': {u'name': u'ORGNAME'},
                               u'Galaxy': [],
                               u'Attribute': [
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|0a209ac0de4ac033f31d6ba9191a8f7a',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|md5'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|1f0ae54ac3f10d533013f74f48849de4e65817a7',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha1'},
                                   {u'category': u'Payload installation', u'comment': u'Fanny modules',
                                    u'to_ids': False, u'value': u'dll_installer.dll|003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9',
                                    u'ShadowAttribute': [], u'distribution': u'2', u'type': u'filename|sha256'}],
                               u'proposal_email_lock': False, u'threat_level_id': u'1'}}
        self.assertEqual(event, to_check, 'Failed at publishing event')

    def delete(self, eventid):
        event = self.misp.delete_event(eventid)
        print(event)

    def delete_attr(self, attrid):
        event = self.misp.delete_attribute(attrid)
        print(event)

    def get(self, eventid):
#.........这里部分代码省略.........

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import json
from simplejson.decoder import JSONDecodeError

from pymisp import PyMISP
from keys import url, key


misp = PyMISP(url, key, True, 'json')

try:
    event = misp.new_event(0, 1, 0, "This is a test")
    print(event)
    print(json.dumps(event, indent=2))
except JSONDecodeError as e:
    print(e.doc)
    exit(0)

# 需要导入模块: from pymisp import PyMISP [as 别名]
# 或者: from pymisp.PyMISP import new_event [as 别名]
def send_to_misp(misp_data, misp_configs, user):
    
    debug_log=''
    
    misp_key = misp_configs['MISP API Key']
    misp_url = misp_configs['MISP URL']
    ssl = False
    proxies = ''
    distribution = misp_data['misp_distro']
    analysis = misp_data['misp_analysis']
    threat_level = misp_data['misp_threat']
    publish = misp_data['misp_pub']
    tags = misp_data['misp_tags']
    attributes = misp_data['attribs']
    
    dt = datetime.utcnow()
    event_date = dt.strftime('%Y-%m-%d')
    '''
    TODO: 
    + Add other options from configs 
    (misp_configs['proxies'], misp_configs['ssl'], etc)
    
    + Get Event Date from CRITs instance, rather than today
    '''
    from pprint import pformat
    # Load the PyMISP functions
    misp = PyMISP(misp_url, misp_key, ssl, 'json', proxies=proxies)
    # Build the event and tags if applicable
    misp_title = misp_data['misp_info']
    if misp_title=="None":
        # Modify this to build a more-sane Event Info if none was given
        for k,v in misp_data['attribs']:
            misp_title=k
            break
    
    if misp_data['options']['misp_dedup_events']==True:
        #Search for the event
        event = ''
        result = misp.search_index(eventinfo=misp_title)
        #debug_log+=pformat(result)
        if 'message' in result:
            if result['message']=='No matches.':
                event = misp.new_event(distribution, threat_level, analysis, 
                                       misp_title, date=event_date, published=publish)
        else:
            for evt in result['response']:
                # If the event exists, set 'event' to the event
                if evt['info']==misp_title:
                    event = {}
                    event['Event'] = evt
                    break
            if event=='':
                # Event not found, even though search results were returned
                # Build new event
                event = misp.new_event(distribution, threat_level, analysis, 
                                       misp_title, date=event_date, published=publish)
    else:
        event = misp.new_event(distribution, threat_level, analysis, 
                                misp_title, date=event_date, published=publish)
    
    misp_data['event']=event['Event']['id']
    
    if tags!=[]:
        for tag in tags:
            misp.tag(event['Event']['uuid'], str(tag.strip()))
        
    for k, v in attributes.iteritems():
        if v['misp-submit']==True:
            ind_kwargs = {}
            attr = misp.add_named_attribute(event, v['misp-type'], v['ioc'], 
                                                  category=v['misp-cat'], to_ids=v['misp-toids'], 
                                                  **ind_kwargs)
            #misp_data['debug']=attr
                        
            if 'response' in attr:
                attrib_uuid = attr['response']['Attribute']['uuid']
            elif 'message' in attr:
                kwargs = {'uuid': str(event['Event']['uuid'])}
                result = misp.search(controller='events', **kwargs)
                for evt in result['response']:
                    if evt['Event']['info']==event['Event']['info']:
                        event=evt
                        break
                single_attribute = (item for item in event['Event']['Attribute'] if item['value']==v['ioc'] 
                                and item['category']==v['misp-cat'] and item['type']==v['misp-type']).next()
                attrib_uuid = single_attribute['uuid']
            else: 
                v['tag']=''
                #misp_data['debug']=attr
            
            if v['tag']!='':
                for t in v['tag']:
                    t=t.strip()
                    misp.tag(attrib_uuid, t)
    
    return{
        'misp_data': misp_data,
        #'misp_configs': misp_configs,
        #'user': user,
        #'debug': debug_log,
#.........这里部分代码省略.........