Package: pymisp
IMPORTANT NOTE: This library will requireat leastPython 3.10 starting the 1st of January 2024. If you have legacy versions of python, please use the latest PyMISP version that will be released in December 2023, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 22.04.PyMISP - Python Library to access MISPPyMISP is a Python library to accessMISPplatforms via their REST API.PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.Install from pipIt is strongly recommended to use a virtual environmentIf you want to know more about virtual environments,python has you coveredOnly basic dependencies:pip3 install pymispAnd there are a few optional dependencies:fileobjects: to create PE/ELF/Mach-o objectsopenioc: to import files in OpenIOC format (not really maintained)virustotal: to query VirusTotal and generate the appropriate objectsdocs: to generate te documentationpdfexport: to generate PDF reports out of MISP eventsurl: to generate URL objects out of URLs with Pyfaupemail: to generate MISP Email objectsbrotli: to use the brotli compression when interacting with a MISP instanceExample:pip3 install pymisp[virustotal,email]Install the latest version from repo from development purposesNote: poetry is required; e.g., "pip3 install poetry"git clone https://github.com/MISP/PyMISP.git && cd PyMISP
git submodule update --init
poetry install -E fileobjects -E openioc -E virustotal -E docs -E pdfexport -E emailRunning the testspoetryrunpytest--cov=pymisptests/test_*.pyIf you have a MISP instance to test against, you can also run the live ones:Note: You need to update the key intests/testlive_comprehensive.pyto the automation key of your admin account.poetryrunpytest--cov=pymisptests/testlive_comprehensive.pySamples and how to use PyMISPVarious examples and samples scripts are in theexamples/directory.In the examples directory, you will need to change the keys.py.sample to enter your MISP url and API key.cd examples
cp keys.py.sample keys.py
vim keys.pyThe API key of MISP is available in the Automation section of the MISP web interface.To test if your URL and API keys are correct, you can test with examples/last.py to
fetch the events published in the last x amount of time (supported time indicators: days (d), hours (h) and minutes (m)).
last.pycd examples
python3 last.py -l 10h # 10 hours
python3 last.py -l 5d  #  5 days
python3 last.py -l 45m # 45 minutesDebuggingYou have two options here:Passdebug=TruetoPyMISPand it will enable logging.DEBUG to stderr on the whole moduleUse the python logging module directly:importlogginglogger=logging.getLogger('pymisp')# Configure it as you wish, for example, enable DEBUG mode:logger.setLevel(logging.DEBUG)Or if you want to write the debug output to a file instead of stderr:importpymispimportlogginglogger=logging.getLogger('pymisp')logging.basicConfig(level=logging.DEBUG,filename="debug.log",filemode='w',format=pymisp.FORMAT)Test casesThe content ofmispevent.pyis tested on every commitThe test cases that require a running MISP instance can be run the following way:# From poetrypytest--cov=pymisptests/test_*.pytests/testlive_comprehensive.py:TestComprehensive.[test_name]DocumentationThe documentation is availablehere.Jupyter notebookA series ofJupyter notebooks for PyMISP tutorialare available in the repository.Everything is a Mutable Mapping... or at least everything that can be imported/exported from/to a json blobAbstractMISPis the master class, and inherits fromcollections.MutableMappingwhich means
the class can be represented as a python dictionary.The abstraction assumes every property that should not be seen in the dictionary is prepended with a_,
or its name is added to the private list__not_jsonable(accessible throughupdate_not_jsonableandset_not_jsonable.This master class has helpers that make it easy to load, and export to, and from, a json string.MISPEvent,MISPAttribute,MISPObjectReference,MISPObjectAttribute, andMISPObjectare subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.MISP ObjectsCreating a new MISP object generator should be done using a pre-defined template and inheritAbstractMISPObjectGenerator.Your new MISPObject generator must generate attributes and add them as class properties usingadd_attribute.When the object is sent to MISP, all the class properties will be exported to the JSON export.Installing PyMISP on a machine with no internet accessThis is done using poetry and you need to have this repository cloned on your machine.
The commands below have to be run from inside the cloned directory.From a machine with access to the internet, get the dependencies:mkdiroffline
poetryexport--all-extras>offline/requirements.txt
poetryrunpipdownload-roffline/requirements.txt-doffline/packages/Prepare the PyMISP Packagepoetrybuild
mvdist/*.whloffline/packages/Copy the content ofoffline/packages/to the machine with no internet access.Install the packages:python-mpipinstall--no-index--no-depspackages/*.whlLicensePyMISP is distributed under anopen source license. A simplified 2-BSD license.