All Projects → MISP → Pymisp

MISP / Pymisp

Licence: other
Python library using the MISP Rest API

Programming Languages

python
139335 projects - #7 most used programming language

Projects that are alternatives of or similar to Pymisp

Dnsimple Ruby
The DNSimple API client for Ruby.
Stars: ✭ 173 (-31.89%)
Mutual labels:  api, api-client
Api Development Tools
📚 A collection of useful resources for building RESTful HTTP+JSON APIs.
Stars: ✭ 2,519 (+891.73%)
Mutual labels:  api, api-client
Espn Fantasy Football Api
Connect to ESPN's fantasy football API via this JS API client for web and NodeJS. Available as an npm package.
Stars: ✭ 188 (-25.98%)
Mutual labels:  api, api-client
Dialogflow
Unofficial php sdk for Dialogflow
Stars: ✭ 165 (-35.04%)
Mutual labels:  api, api-client
Twitch
Interact with Twitch's API, chat, PubSub and subscribe to WebHooks.
Stars: ✭ 237 (-6.69%)
Mutual labels:  api, api-client
Coingecko Api
A Node.js wrapper for the CoinGecko API with no dependencies.
Stars: ✭ 159 (-37.4%)
Mutual labels:  api, api-client
Binance
A .NET Standard Binance API library.
Stars: ✭ 199 (-21.65%)
Mutual labels:  api, api-client
Anyapi
AnyAPI is a library that helps you to write any API wrappers with ease and in pythonic way.
Stars: ✭ 126 (-50.39%)
Mutual labels:  api, api-client
Php Bitcoinrpc
Fully unit-tested Bitcoin JSON-RPC client based on GuzzleHttp.
Stars: ✭ 231 (-9.06%)
Mutual labels:  api, api-client
Alpaca
Given a web API, Generate client libraries in node, php, python, ruby
Stars: ✭ 2,447 (+863.39%)
Mutual labels:  api, api-client
Mobx Rest
REST conventions for Mobx
Stars: ✭ 164 (-35.43%)
Mutual labels:  api, api-client
Protoman
Postman for protobuf APIs
Stars: ✭ 241 (-5.12%)
Mutual labels:  api, api-client
Thehive4py
Python API Client for TheHive
Stars: ✭ 143 (-43.7%)
Mutual labels:  api, api-client
Js Client
A Open-API derived JS + Node.js API client for Netlify
Stars: ✭ 170 (-33.07%)
Mutual labels:  api, api-client
Laravel Api Explorer
API explorer for laravel applications
Stars: ✭ 138 (-45.67%)
Mutual labels:  api, api-client
Virustotal Api
Virus Total Public/Private/Intel API
Stars: ✭ 189 (-25.59%)
Mutual labels:  api, api-client
Sdk Js
Directus JS SDK — JavaScript Software Development Kit for Node and Browser
Stars: ✭ 117 (-53.94%)
Mutual labels:  api, api-client
Tik4net
Manage mikrotik routers with .NET C# code via ADO.NET like API or enjoy O/R mapper like highlevel api.
Stars: ✭ 118 (-53.54%)
Mutual labels:  api, api-client
Twitch4j
Modular Async/Sync/Reactive Twitch API Client / IRC Client
Stars: ✭ 209 (-17.72%)
Mutual labels:  api, api-client
Coinapi Sdk
SDKs for CoinAPI
Stars: ✭ 238 (-6.3%)
Mutual labels:  api, api-client

IMPORTANT NOTE: This library will require at least python 3.6 starting the 1st of January 2020. If you have legacy versions of python, please use PyMISP v2.4.119.1, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 18.04.

PyMISP - Python Library to access MISP

Documentation Status Build Status Coverage Status Python 3.6 PyPi version Number of PyPI downloads

PyMISP is a Python library to access MISP platforms via their REST API.

PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.

Install from pip

It is strongly recommended to use a virtual environment

If you want to know more about virtual environments, python has you covered

Only basic dependencies:

pip3 install pymisp

With optional dependencies:

pip3 install pymisp[fileobjects,openioc,virustotal]

Install the latest version from repo from development purposes

Note: poetry is required; e.g., "pip3 install poetry"

git clone https://github.com/MISP/PyMISP.git && cd PyMISP
git submodule update --init
poetry install -E fileobjects -E openioc -E virustotal -E docs -E pdfexport

Running the tests

poetry run nosetests-3.4 --with-coverage --cover-package=pymisp,tests --cover-tests tests/test_*.py

If you have a MISP instance to test against, you can also run the live ones:

Note: You need to update the key in tests/testlive_comprehensive.py to the automation key of your admin account.

poetry run nosetests-3.4 --with-coverage --cover-package=pymisp,tests --cover-tests tests/testlive_comprehensive.py

Samples and how to use PyMISP

Various examples and samples scripts are in the examples/ directory.

In the examples directory, you will need to change the keys.py.sample to enter your MISP url and API key.

cd examples
cp keys.py.sample keys.py
vim keys.py

The API key of MISP is available in the Automation section of the MISP web interface.

To test if your URL and API keys are correct, you can test with examples/last.py to fetch the events published in the last x amount of time (supported time indicators: days (d), hours (h) and minutes (m)). last.py

cd examples
python3 last.py -l 10h # 10 hours
python3 last.py -l 5d  #  5 days
python3 last.py -l 45m # 45 minutes

Debugging

You have two options here:

  1. Pass debug=True to PyMISP and it will enable logging.DEBUG to stderr on the whole module

  2. Use the python logging module directly:

import logging
logger = logging.getLogger('pymisp')

# Configure it as you wish, for example, enable DEBUG mode:
logger.setLevel(logging.DEBUG)

Or if you want to write the debug output to a file instead of stderr:

import pymisp
import logging

logger = logging.getLogger('pymisp')
logging.basicConfig(level=logging.DEBUG, filename="debug.log", filemode='w', format=pymisp.FORMAT)

Test cases

  1. The content of mispevent.py is tested on every commit
  2. The test cases that require a running MISP instance can be run the following way:
# From poetry

nosetests-3.4 -s --with-coverage --cover-package=pymisp,tests --cover-tests tests/testlive_comprehensive.py:TestComprehensive.[test_name]

Documentation

The documentation is available here.

Jupyter notebook

A series of Jupyter notebooks for PyMISP tutorial are available in the repository.

Everything is a Mutable Mapping

... or at least everything that can be imported/exported from/to a json blob

AbstractMISP is the master class, and inherits from collections.MutableMapping which means the class can be represented as a python dictionary.

The abstraction assumes every property that should not be seen in the dictionary is prepended with a _, or its name is added to the private list __not_jsonable (accessible through update_not_jsonable and set_not_jsonable.

This master class has helpers that make it easy to load, and export to, and from, a json string.

MISPEvent, MISPAttribute, MISPObjectReference, MISPObjectAttribute, and MISPObject are subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.

MISP Objects

Creating a new MISP object generator should be done using a pre-defined template and inherit AbstractMISPObjectGenerator.

Your new MISPObject generator must generate attributes and add them as class properties using add_attribute.

When the object is sent to MISP, all the class properties will be exported to the JSON export.

License

PyMISP is distributed under an open source license. A simplified 2-BSD license.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].