MISP V2 Deprecated
Deprecated. Use the MISP v3 integration instead.
Data Enrichment & Threat Intelligence · MISP
Details
| ID | MISP V2 |
|---|---|
| Provider | Open Source |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/pymisp:1.0.0.19190 |
| Supported Modules | Agentix XSIAM |
README
Use the MISP integration to create manage events, samples, and attributes, and add various object types.
Configure MISP V2 on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for MISP V2.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- MISP server URL (e.g., https://192.168.0.1)
- API Key
- Use system proxy settings
- Trust any certificate (not secure)
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- Search for events: misp-search
- Search for attributes: misp-search-attributes
- Get the reputation of a file: file
- Check if a URL is in MISP events: url
- Get the reputation of an IP address: ip
- Create a MISP event: misp-create-event
- Download a file sample: misp-download-sample
- Add an attribute to an event: misp-add-attribute
- Upload a file sample: misp-upload-sample
- Delete an event: misp-delete-event
- Add a tag to an event or attribute: misp-add-tag
- Add sighting to an attribute: misp-add-sighting
- Add an OSINT feed: misp-add-events-from-feed
- Add an email object to an event: misp-add-email-object
- Add a domain object to an event: misp-add-domain-object
- Add a URL object to an event: misp-add-url-object
- Add an object to an event: misp-add-object
- Add an IP object to an event: misp-add-ip-object
1. Search for events
Search for events in MISP.
Base Command
misp-search
Input
| Argument Name | Description | Required |
|---|---|---|
| type | The attribute type. Use any valid MISP attribute. | Optional |
| value | Search for the specified value in the attributes' value field. | Optional |
| category | The attribute category. Use any valid MISP attribute category. | Optional |
| org | Search by creator organization by supplying the organization ID. | Optional |
| tags | A comma-separated list of tags to include in the results. To exclude a tag, prefix the tag name with "!". Can be: "AND", "OR", and "NOT" followed by ":". To chain logical operators use ";". for example, "AND:tag1,tag2;OR:tag3". | Optional |
| from | Event search start date (2015-02-15) | Optional |
| to | Event search end date (2015-02-15) | Optional |
| last | Events published within the last "x" amount of time. Valid time values are days, hours, and minutes (for example "5d", "12h", "30m"). This filter uses the published timestamp of the event. | Optional |
| eventid | The events to include or exclude from the search | Optional |
| uuid | Return events that include an attribute with the given UUID. Alternatively the event's UUID must match the value(s) passed, e.g., 59523300-4be8-4fa6-8867-0037ac110002 | Optional |
| to_ids | Whether to return only the attributes set with the "to_ids" flag | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Distribution | number | MISP event distribution. |
| MISP.Event.ThreatLevelID | number | Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). |
| MISP.Event.PublishTimestamp | number | Timestamp of the publish time (if published). |
| MISP.Event.EventCreatorEmail | string | Email address of the event creator. |
| MISP.Event.Date | date | Event creation date. |
| MISP.Event.Locked | boolean | Is the event locked. |
| MISP.Event.OwnerOrganisation.ID | number | Owner organization ID. |
| MISP.Event.OwnerOrganisation.Name | string | Owner organization name. |
| MISP.Event.OwnerOrganisation.UUID | string | Owner organization UUID. |
| MISP.Event.RelatedEvent.ID | number | Event IDs of related events (can be a list). |
| MISP.Event.ProposalEmailLock | boolean | If email lock was proposed. |
| MISP.Event.Timestamp | number | Timestamp of the event. |
| MISP.Event.Galaxy.Description | string | Event's galaxy description. |
| MISP.Event.Galaxy.Name | string | Galaxy name. |
| MISP.Event.Galaxy.Type | number | Galaxy type. |
| MISP.Event.Published | boolean | Whether the event is published. |
| MISP.Event.DisableCorrelation | boolean | Whether correlation is disabled. |
| MISP.Event.UUID | string | Event UUID. |
| MISP.Event.ShadowAttribute | Unknown | Event shadow attributes. |
| MISP.Event.Attribute.Distribution | number | Attribute distribution. |
| MISP.Event.Attribute.Value | string | Attribute value. |
| MISP.Event.Attribute.EventID | number | Attribute event ID. |
| MISP.Event.Attribute.Timestamp | number | Attribute timestamp. |
| MISP.Event.Attribute.Deleted | boolean | Whether the attribute is deleted. |
| MISP.Event.Attribute.DisableCorrelation | boolean | Whether attribute correlation is disabled. |
| MISP.Event.Attribute.Type | string | Attribute type. |
| MISP.Event.Attribute.ID | number | Attribute ID. |
| MISP.Event.Attribute.UUID | string | Attribute UUID. |
| MISP.Event.Attribute.ShadowAttribute | Unknown | Attribute shadow attribute. |
| MISP.Event.Attribute.ToIDs | boolean | Whether the Intrusion Detection System flag is set. |
| MISP.Event.Attribute.Category | string | Attribute category. |
| MISP.Event.Attribute.SharingGroupID | number | Attribute sharing group ID. |
| MISP.Event.Attribute.Comment | string | Attribute comment. |
| MISP.Event.Analysis | number | Event analysis (0 Initial, 1 Ongoing, 2 Completed). |
| MISP.Event.SharingGroupID | number | Event sharing group ID. |
| MISP.Event.Tag.Name | string | All tag names in the event. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event which the object first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template |
| MISP.Event.Object.Timestamp | String | Timestamp of object creation |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of first event that originated from the object. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp of object creation. |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Type of object. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-search category="External analysis" type="url"
Context Example
{
"MISP.Event": [
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565012166",
"Object": [
{
"Comment": "",
"EventID": "743",
"Timestamp": "1565012146",
"Description": "Url object",
"UUID": "3c90797e-2aba-4ac2-bc4a-73c797425e1f",
"Deleted": false,
"Attribute": [
{
"Category": "Network activity",
"Comment": "",
"ShadowAttribute": [],
"UUID": "287e1b44-24c1-45b9-9ef9-541d00ae447b",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": true,
"Value": "www.google.com",
"ID": "26138",
"SharingGroupID": "0",
"ObjectRelation": "domain",
"EventID": "743",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "5",
"Galaxy": []
}
],
"TemplateUUID": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"TemplateVersion": "7",
"SharingGroupID": "0",
"ObjectReference": [],
"MetaCategory": "network",
"Distribution": "5",
"ID": "3223",
"Name": "ip-port"
}
],
"ThreatLevelID": "1",
"Date": "2019-08-05",
"RelatedEvent": [
{
"ID": "753"
}
],
"Info": "Example event",
"Locked": false,
"OwnerOrganisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"Analysis": "0",
"Published": false,
"DisableCorrelation": false,
"ID": "743",
"PublishTimestamp": "0",
"UUID": "5d48302c-bf84-4671-9080-0728ac110002",
"Attribute": [
{
"Category": "External analysis",
"Comment": "Just an example",
"ShadowAttribute": [],
"UUID": "c320c9f6-4619-450a-b150-9c62e341fbfe",
"ObjectID": "0",
"Deleted": false,
"Timestamp": "1565012014",
"ToIDs": false,
"Value": "www.example.com",
"ID": "26128",
"SharingGroupID": "0",
"ObjectRelation": null,
"EventID": "743",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "0",
"Galaxy": []
}
],
"Galaxy": []
},
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565013591",
"Object": [],
"ThreatLevelID": "1",
"Date": "2019-08-05",
"RelatedEvent": [
{
"ID": "743"
}
],
"Info": "Example event",
"Locked": false,
"OwnerOrganisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"Analysis": "0",
"Published": false,
"DisableCorrelation": false,
"ID": "753",
"PublishTimestamp": "0",
"UUID": "5d483655-ac78-4765-9169-70f7ac110002",
"Attribute": [
{
"Category": "External analysis",
"Comment": "Just an example",
"ShadowAttribute": [],
"UUID": "8468ac01-126f-4e73-8cff-7371303014aa",
"ObjectID": "0",
"Deleted": false,
"Timestamp": "1565013591",
"ToIDs": false,
"Value": "www.example.com",
"ID": "26160",
"SharingGroupID": "0",
"ObjectRelation": null,
"EventID": "753",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "0",
"Galaxy": []
}
],
"Galaxy": []
}
]
}
Human Readable Output
Results in MISP for search:
| category | type | type_attribute |
|---|---|---|
| External analysis | url | url |
| Total of 2 events found |
Event ID: 743
| Analysis | Attributes | Event Creator Email | Info | Related Events | Threat Level ID | Timestamp |
|---|---|---|---|---|---|---|
| Initial | [ { "ID": "26128", "Type": "url", "Category": "External analysis", "ToIDs": false, "UUID": "c320c9f6-4619-450a-b150-9c62e341fbfe", "EventID": "743", "Distribution": "0", "Timestamp": "1565012014", "Comment": "Just an example", "SharingGroupID": "0", "Deleted": false, "DisableCorrelation": false, "ObjectID": "0", "ObjectRelation": null, "Value": "www.example.com", "Galaxy": [], "ShadowAttribute": [] }, { "ID": "26136", "Type": "ip-src", "Category": "Payload delivery", "ToIDs": true, "UUID": "9fc2d7b1-b784-47fc-ad2d-cdcb5df85144", "EventID": "743", "Distribution": "5", "Timestamp": "1565012133", "Comment": "Unknown IP", "SharingGroupID": "0", "Deleted": false, "DisableCorrelation": false, "ObjectID": "0", "ObjectRelation": null, "Value": "8.8.3.3", "Galaxy": [], "ShadowAttribute": [] } ] |
admin@admin.test | Example event | {'ID': '753'} | HIGH | 2019-08-05 13:36:06 |
2. Search for attributes
Search for attributes in MISP.
Base Command
misp-search-attributes
Input
| Argument Name | Description | Required |
|---|---|---|
| type | The attribute type. Use any valid MISP attribute. | Optional |
| value | Search for the specified value in the attributes' value field. | Optional |
| category | The attribute category. Use any valid MISP attribute category. | Optional |
| uuid | Return events that include an attribute with the given UUID. Alternatively the event's UUID must match the value(s) passed, e.g., 59523300-4be8-4fa6-8867-0037ac110002. | Optional |
| to_ids | Whether to return only the attributes set with the "to_ids" flag. | Optional |
| last | Events published within the last "x" amount of time. Valid time values are days, hours, and minutes (for example "5d", "12h", "30m"). This filter uses the published timestamp of the event. | Optional |
| include_decay_score | Include the decay score at attribute level. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Attribute.Distribution | number | Attribute distribution. |
| MISP.Attribute.Value | string | Attribute value. |
| MISP.Attribute.EventID | number | Attribute event ID. |
| MISP.Attribute.Timestamp | number | Attribute timestamp. |
| MISP.Attribute.Deleted | boolean | Whether the attribute is deleted. |
| MISP.Attribute.DisableCorrelation | boolean | Whether attribute correlation is disabled. |
| MISP.Attribute.Type | string | Attribute type. |
| MISP.Attribute.ID | number | Attribute ID. |
| MISP.Attribute.UUID | string | Attribute UUID. |
| MISP.Attribute.ShadowAttribute | Unknown | Attribute shadow attribute. |
| MISP.Attribute.ToIDs | boolean | Whether the Intrusion Detection System flag is set. |
| MISP.Attribute.Category | string | Attribute category. |
| MISP.Attribute.SharingGroupID | number | Attribute sharing group ID. |
| MISP.Attribute.Comment | string | Attribute comment. |
| MISP.Attribute.Event.ID | number | MISP event ID. |
| MISP.Attribute.Event.Distribution | number | MISP event distribution. |
| MISP.Attribute.Event.ThreatLevelID | number | Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). |
| MISP.Attribute.Event.PublishTimestamp | number | Timestamp of the publish time (if published). |
| MISP.Attribute.Event.EventCreatorEmail | string | Email address of the event creator. |
| MISP.Attribute.Event.Date | date | Event creation date. |
| MISP.Attribute.Event.Locked | boolean | Is the event locked. |
| MISP.Attribute.Event.OwnerOrganisation.ID | number | Owner organization ID. |
| MISP.Attribute.Event.OwnerOrganisation.Name | string | Owner organization name. |
| MISP.Attribute.Event.OwnerOrganisation.UUID | string | Owner organization UUID. |
| MISP.Attribute.Event.RelatedEvent.ID | number | Event IDs of related events (can be a list). |
| MISP.Attribute.Event.ProposalEmailLock | boolean | If email lock was proposed. |
| MISP.Attribute.Event.Timestamp | number | Timestamp of the event. |
| MISP.Attribute.Event.Galaxy.Description | string | Event's galaxy description. |
| MISP.Attribute.Event.Galaxy.Name | string | Galaxy name. |
| MISP.Attribute.Event.Galaxy.Type | number | Galaxy type. |
| MISP.Attribute.Event.Published | boolean | Whether the event is published. |
| MISP.Attribute.Event.DisableCorrelation | boolean | Whether correlation is disabled. |
| MISP.Attribute.Event.UUID | string | Event UUID. |
| MISP.Attribute.Event.ShadowAttribute | Unknown | Event shadow attributes. |
| MISP.Attribute.Event.Analysis | number | Event analysis (0 Initial, 1 Ongoing, 2 Completed). |
| MISP.Attribute.Event.SharingGroupID | number | Event sharing group ID. |
| MISP.Attribute.Event.Tag.Name | string | All tag names in the event. |
| MISP.Attribute.Object.MetaCategory | String | Object meta category. |
| MISP.Attribute.Object.Distribution | Number | Distribution of object. |
| MISP.Attribute.Object.Name | String | Name of the object. |
| MISP.Attribute.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Attribute.Object.EventID | Number | ID of the event which the object first created. |
| MISP.Attribute.Object.TemplateUUID | String | UUID of the template. |
| MISP.Attribute.Object.Timestamp | String | Timestamp of object creation. |
| MISP.Attribute.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Attribute.Object.ID | Number | ID of object. |
| MISP.Attribute.Object.UUID | String | UUID of the object. |
| MISP.Attribute.Object.Description | String | Description of the object. |
| MISP.Attribute.Galaxy.Description | string | Event's galaxy description. |
| MISP.Attribute.Galaxy.Name | string | Galaxy name. |
| MISP.Attribute.Galaxy.Type | number | Galaxy type. |
| MISP.Attribute.Tag.Name | string | All tag names in the event. |
Command Example
!misp-search-attributes category="Other" value="TestMotors"
Context Example
{
"MISP.Attribute": [
{
'ID': '215746',
'EventID': '12041',
'ObjectID': '35655',
'ObjectRelation': 'make',
'Category': 'Other',
'Type': 'text',
'ToIDs': False,
'UUID': '175c30f8-8bba-44bc-9727-7065da0ed109',
'Timestamp': '1619620662',
'Distribution': '5',
'SharingGroupID': '0',
'Comment': '',
'Deleted': False,
'DisableCorrelation': True,
'Value': 'TestMotors',
'Event': {
'OrganisationID': '1',
'Distribution': '0',
'ID': '12041',
'Info': 'Testplayboook',
'OwnerOrganisation.ID': '1',
'UUID': '60897327-db98-4cab-8911-32faac110002'
},
'Object': {
'ID': '35655',
'Distribution': '5',
'SharingGroupID': '0'
}
}
]
}
Human Readable Output
MISP attributes-search returned 2 attributes.
Attribute ID: 67899
| Category | Comment | Deleted | DisableCorrelation | Distribution | Event | EventID | ID | Object | ObjectID | ObjectRelation | SharingGroupID | Timestamp | ToIDs | Type | UUID | Value |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Other | false | true | 5 | OrganisationID: 1 Distribution: 0 ID: 12041 Info: Testplayboook OwnerOrganisation.ID: 1 UUID: 60897327-db98-4cab-8911-32faac110002 |
12041 | 215746 | ID: 35655 Distribution: 5 SharingGroupID: 0 |
35655 | make | 0 | 1619620662 | false | text | 175c30f8-8bba-44bc-9727-7065da0ed109 | TestMotors |
3. Get the reputation of a file
Checks the file reputation of the given hash.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A CSV list of file hashes to query. Can be MD5, SHA1, or SHA256. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.MD5 | Unknown | Bad hash found. |
| File.SHA1 | Unknown | Bad SHA1 hash. |
| File.SHA256 | Unknown | Bad SHA256 hash. |
| File.Malicious.Vendor | Unknown | For malicious files, the vendor that made the decision. |
| File.Malicious.Description | Unknown | For malicious files, the reason that the vendor made the decision. |
| DBotScore.Indicator | Unknown | The indicator that was tested. |
| DBotScore.Type | Unknown | Indicator type. |
| DBotScore.Vendor | Unknown | The vendor used to calculate the score. |
| DBotScore.Score | Unknown | The actual score. |
Command Example
!file file="3d74da0a7276735f1afae01951b39ff7a9d92c94"
Context Example
{
"DBotScore": [
{
"Vendor": "MISP",
"Indicator": "3d74da0a7276735f1afae01951b39ff7a9d92c94",
"Score": 3,
"Type": "hash"
}
],
"File": [
{
"Malicious": {
"Vendor": "MISP",
"Description": "file hash found in MISP event with ID: 754"
},
"SHA1": "3d74da0a7276735f1afae01951b39ff7a9d92c94"
}
]
}
Human Readable Output
Results found in MISP for hash: 3d74da0a7276735f1afae01951b39ff7a9d92c94
| EventID | Organisation | Threat Level |
|---|---|---|
| 754 | MISP | HIGH |
4. Check if a URL is in MISP events
Checks if the URL is in MISP events.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
url
Input
| Argument Name | Description | Required |
|---|---|---|
| url | URL to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| URL.Data | Unknown | Bad URLs found. |
| URL.Malicious.Vendor | Unknown | For malicious URLs, the vendor that made the decision. |
| URL.Malicious.Description | Unknown | For malicious URLs, the reason that the vendor made the decision. |
| DBotScore.Indicator | Unknown | The indicator that was tested. |
| DBotScore.Type | Unknown | Indicator type. |
| DBotScore.Vendor | Unknown |
The vendor used to calculate the score. |
| DBotScore.Score | Unknown | The actual score. |
Command Example
!url url="www.example.com"
Context Example
{
"URL": [
{
"Malicious": {
"Vendor": "MISP.ORGNAME",
"Description": "IP Found in MISP event: 743"
},
"Data": "www.example.com"
},
{
"Malicious": {
"Vendor": "MISP.ORGNAME",
"Description": "IP Found in MISP event: 753"
},
"Data": "www.example.com"
}
],
"DBotScore": [
{
"Vendor": "MISP.ORGNAME",
"Indicator": "www.example.com",
"Score": 3,
"Type": "url"
},
{
"Vendor": "MISP.ORGNAME",
"Indicator": "www.example.com",
"Score": 3,
"Type": "url"
}
],
"MISP.Event": [
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565013625",
"Object": [],
"Attribute": [
{
"Category": "External analysis",
"Comment": "Just an example",
"ShadowAttribute": [],
"UUID": "c320c9f6-4619-450a-b150-9c62e341fbfe",
"ObjectID": "0",
"Deleted": false,
"Timestamp": "1565012014",
"ToIDs": false,
"Value": "www.example.com",
"ID": "26128",
"SharingGroupID": "0",
"ObjectRelation": null,
"EventID": "743",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "0",
"Galaxy": []
}
]
"Galaxy": []
}
]
}
Human Readable Output
MISP Reputation for URL: www.example.com
| EventID | Organisation | Threat Level |
|---|---|---|
| 743 | MISP.ORGNAME | HIGH |
| 753 | MISP.ORGNAME | HIGH |
5. Get the reputation of an IP address
Checks the reputation of an IP address
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | IP address to check. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| IP.Address | Unknown | Bad IP address found. |
| IP.Malicious.Vendor | Unknown | For malicious IPs, the vendor that made the decision. |
| IP.Malicious.Description | Unknown | For malicious IPs, the reason that the vendor made the decision. |
| DBotScore.Indicator | Unknown | The indicator that was tested. |
| DBotScore.Type | Unknown | Indicator type. |
| DBotScore.Vendor | Unknown | The vendor used to calculate the score. |
| DBotScore.Score | Unknown | The actual score. |
Command Example
!ip ip="8.8.3.3"
Context Example
{
"IP": [
{
"Malicious": {
"Vendor": "MISP.ORGNAME",
"Description": "IP Found in MISP event: 743"
},
"Address": "8.8.3.3"
}
],
"DBotScore": [
{
"Vendor": "MISP.ORGNAME",
"Indicator": "8.8.3.3",
"Score": 3,
"Type": "ip"
}
],
"MISP.Event": [
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565013625",
"Object": [
],
"Attribute": [
{
"Category": "External analysis",
"Comment": "Just an example",
"ShadowAttribute": [],
"UUID": "c320c9f6-4619-450a-b150-9c62e341fbfe",
"ObjectID": "0",
"Deleted": false,
"Timestamp": "1565012014",
"ToIDs": false,
"Value": "8.8.3.3",
"ID": "26128",
"SharingGroupID": "0",
"ObjectRelation": null,
"EventID": "743",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "0",
"Galaxy": []
}
"Galaxy": []
}
]
}
Human Readable Output
Results found in MISP for IP: 8.8.3.3
| EventID | Organisation | Threat Level |
|---|---|---|
| 743 | MISP.ORGNAME | HIGH |
6. Create a MISP event
Creates a new MISP event.
Base Command
misp-create-event
Input
| Argument Name | Description | Required |
|---|---|---|
| type | Event type of the new event. | Optional |
| category | Category of the new event. | Optional |
| to_ids | Create the event with the IDS flag. | Optional |
| distribution | Where to distribute the attribute. | Optional |
| comment | Comment for the event. | Optional |
| value | Value to add to the event. | Required |
| info | Event name. | Required |
| published | Whether to publish the event. | Optional |
| threat_level_id | MISP Threat level ID. Default is "high". | Optional |
| analysis | The analysis level. Default is "initial". | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Distribution | number | MISP event distribution. |
| MISP.Event.ThreatLevelID | number | Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). |
| MISP.Event.PublishTimestamp | number | Timestamp of the publish time (if published). |
| MISP.Event.EventCreatorEmail | string | Email address of the event creator. |
| MISP.Event.Date | date | Event creation date. |
| MISP.Event.Locked | boolean | Whether the event is locked. |
| MISP.Event.OwnerOrganisation.ID | number | Owner organization ID. |
| MISP.Event.OwnerOrganisation.Name | string | Owner organization name. |
| MISP.Event.OwnerOrganisation.UUID | string | Owner organization UUID. |
| MISP.Event.RelatedEvent.ID | number | Event IDs of related events (can be a list). |
| MISP.Event.ProposalEmailLock | boolean | Whether email lock is proposed. |
| MISP.Event.Timestamp | number | Timestamp of the event. |
| MISP.Event.Galaxy.Description | string | Event's galaxy description. |
| MISP.Event.Galaxy.Name | string | Galaxy name. |
| MISP.Event.Galaxy.Type | number | Galaxy type. |
| MISP.Event.Published | boolean | Whether the event is published. |
| MISP.Event.DisableCorrelation | boolean | Whether correlation is disabled. |
| MISP.Event.UUID | string | Event UUID. |
| MISP.Event.ShadowAttribute | Unknown | Event shadow attributes. |
| MISP.Event.Attribute.Distribution | number | Attribute distribution. |
| MISP.Event.Attribute.Value | string | Attribute value. |
| MISP.Event.Attribute.EventID | number | Attribute event ID. |
| MISP.Event.Attribute.Timestamp | number | Attribute timestamp. |
| MISP.Event.Attribute.Deleted | boolean | Whether the attribute was deleted. |
| MISP.Event.Attribute.DisableCorrelation | boolean | Whether attribute correlation is disabled. |
| MISP.Event.Attribute.Type | string | Attribute type. |
| MISP.Event.Attribute.ID | number | Attribute ID. |
| MISP.Event.Attribute.UUID | string | Attribute UUID. |
| MISP.Event.Attribute.ShadowAttribute | Unknown | Attribute shadow attribute. |
| MISP.Event.Attribute.ToIDs | boolean | Is the Intrusion Detection System flag set. |
| MISP.Event.Attribute.Category | string | Attribute category. |
| MISP.Event.Attribute.SharingGroupID | number | Attribute sharing group ID. |
| MISP.Event.Attribute.Comment | string | Attribute comment for the attribute. |
| MISP.Event.Analysis | number | Event analysis (0 Initial, 1 Ongoing, 2 Completed). |
| MISP.Event.SharingGroupID | number | Event sharing group ID. |
| MISP.Event.Tag.Name | string | All tag names in the event. |
Command Example
!misp-create-event info="Example event" value="www.example.com" category="External analysis" type="url" comment="Just an example"
Context Example
{
"MISP.Event": [
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565013591",
"Object": [],
"ThreatLevelID": "1",
"Date": "2019-08-05",
"RelatedEvent": [
{
"ID": "743"
}
],
"Info": "Example event",
"Locked": false,
"OwnerOrganisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"Analysis": "0",
"Published": false,
"DisableCorrelation": false,
"ID": "753",
"PublishTimestamp": "0",
"UUID": "5d483655-ac78-4765-9169-70f7ac110002",
"Attribute": [
{
"Category": "External analysis",
"Comment": "Just an example",
"ShadowAttribute": [],
"UUID": "8468ac01-126f-4e73-8cff-7371303014aa",
"ObjectID": "0",
"Deleted": false,
"Timestamp": "1565013591",
"ToIDs": false,
"Value": "www.example.com",
"ID": "26160",
"SharingGroupID": "0",
"ObjectRelation": null,
"EventID": "753",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "0",
"Galaxy": []
}
],
"Galaxy": []
}
]
}
Human Readable Output
MISP create event
New event with ID: 753 has been successfully created.
7. Download a file sample
Downloads a file sample from MISP.
Base Command
misp-download-sample
Input
| Argument Name | Description | Required |
|---|---|---|
| hash | A hash in MD5 format. If the "allSamples" argument is supplied, this can be any one of the following: md5, sha1, and sha256. | Required |
| eventID | If set, will only fetch data from the given event ID. | Optional |
| allSamples | If set, will return all samples from events that match the hash supplied in the "hash " argument. | Optional |
| unzip | Return one zipped file, or all files unzipped. Default is "false" (one zipped file). | Optional |
Context Output
There is no context output for this command.
Command Example
!misp-download-sample hash="3d74da0a7276735f1afae01951b39ff7a9d92c94"
Human Readable Output
Couldn't find file with hash 3d74da0a7276735f1afae01951b39ff7a9d92c94
8. Add an attribute to an event
Adds an attribute to an existing MISP event.
Base Command
misp-add-attribute
Input
| Argument Name | Description | Required |
|---|---|---|
| id | MISP event ID. | Required |
| type | Attribute type. | Required |
| category | Attribute category. | Required |
| to_ids | Whether to return only events set with the "to_ids" flag. Default is "true". | Optional |
| distribution | Where to distribute the attribute. | Optional |
| comment | Comment for the event. | .Required |
| value | Attribute value | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Distribution | number | MISP event distribution. |
| MISP.Event.ThreatLevelID | number | Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). |
| MISP.Event.PublishTimestamp | number | Timestamp of the publish time (if published). |
| MISP.Event.EventCreatorEmail | string | Email address of the event creator. |
| MISP.Event.Date | date | Event creation date. |
| MISP.Event.Locked | boolean | Is the event locked. |
| MISP.Event.OwnerOrganisation.ID | number | Owner organization ID. |
| MISP.Event.OwnerOrganisation.Name | string | Owner organization name. |
| MISP.Event.OwnerOrganisation.UUID | string | Owner organization UUID. |
| MISP.Event.RelatedEvent.ID | number | Event IDs of related events (can be a list). |
| MISP.Event.ProposalEmailLock | boolean | Wheter email lock is proposed. |
| MISP.Event.Timestamp | number | Timestamp of the event. |
| MISP.Event.Galaxy.Description | string | Galaxy description. |
| MISP.Event.Galaxy.Name | string | Galaxy name. |
| MISP.Event.Galaxy.Type | number | Galaxy type. |
| MISP.Event.Published | boolean | Whether the event is published. |
| MISP.Event.DisableCorrelation | boolean | Whether correlation disabled. |
| MISP.Event.UUID | string | Event UUID. |
| MISP.Event.ShadowAttribute | Unknown | Event shadow attributes. |
| MISP.Event.Attribute.Distribution | number | Attribute distribution. |
| MISP.Event.Attribute.Value | string | Attribute value. |
| MISP.Event.Attribute.EventID | number | Attribute event ID. |
| MISP.Event.Attribute.Timestamp | number | Attribute timestamp. |
| MISP.Event.Attribute.Deleted | boolean | Whether the attribute was deleted. |
| MISP.Event.Attribute.DisableCorrelation | boolean | Whether attribute correlation is disabled. |
| MISP.Event.Attribute.Type | string | Attribute type. |
| MISP.Event.Attribute.ID | number | Attribute ID. |
| MISP.Event.Attribute.UUID | string | Attribute UUID. |
| MISP.Event.Attribute.ShadowAttribute | Unknown | Attribute shadow attribute. |
| MISP.Event.Attribute.ToIDs | boolean | Whether the Intrusion Detection System flag is set. |
| MISP.Event.Attribute.Category | string | Attribute category. |
| MISP.Event.Attribute.SharingGroupID | number | Attribute sharing group ID. |
| MISP.Event.Attribute.Comment | string | Attribute comment. |
| MISP.Event.Analysis | number | Event analysis (0 Initial, 1 Ongoing, 2 Completed). |
| MISP.Event.SharingGroupID | number | Event sharing group ID. |
| MISP.Event.Tag.Name | string | All tag names in the event. |
Command Example
!misp-add-attribute id=743 comment="Unknown IP" value="8.8.3.3" category="Payload delivery" type="ip-src"
Context Example
{
"MISP.Event": [
{
"EventCreatorEmail": "admin@admin.test",
"SharingGroupID": "0",
"Organisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"ShadowAttribute": [],
"Distribution": "0",
"ProposalEmailLock": false,
"Timestamp": "1565013607",
"Object": [
{
"Comment": "",
"EventID": "743",
"Timestamp": "1565012146",
"Description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"UUID": "3c90797e-2aba-4ac2-bc4a-73c797425e1f",
"Deleted": false,
"Attribute": [
{
"Category": "Network activity",
"Comment": "",
"ShadowAttribute": [],
"UUID": "e3ada1ae-da37-4efe-9581-73aa95960624",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": false,
"Value": "8080",
"ID": "26137",
"SharingGroupID": "0",
"ObjectRelation": "dst-port",
"EventID": "743",
"DisableCorrelation": true,
"Type": "port",
"Distribution": "5",
"Galaxy": []
},
{
"Category": "Network activity",
"Comment": "",
"ShadowAttribute": [],
"UUID": "287e1b44-24c1-45b9-9ef9-541d00ae447b",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": true,
"Value": "google.com",
"ID": "26138",
"SharingGroupID": "0",
"ObjectRelation": "domain",
"EventID": "743",
"DisableCorrelation": false,
"Type": "domain",
"Distribution": "5",
"Galaxy": []
},
{
"Category": "Network activity",
"Comment": "",
"ShadowAttribute": [],
"UUID": "5ef0f03b-f85a-4d8d-97c3-c3f740623a73",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": true,
"Value": "8.8.8.8",
"ID": "26139",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"Galaxy": []
},
{
"Category": "Network activity",
"Comment": "",
"ShadowAttribute": [],
"UUID": "953e3da1-a4b5-4fe2-8d35-7e1afdb72e74",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": true,
"Value": "4.4.4.4",
"ID": "26140",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"Galaxy": []
},
{
"Category": "Other",
"Comment": "",
"ShadowAttribute": [],
"UUID": "f1d3cd7e-ed01-4aba-bb8f-65c0ac119707",
"ObjectID": "3223",
"Deleted": false,
"Timestamp": "1565012146",
"ToIDs": false,
"Value": "2018-05-05",
"ID": "26141",
"SharingGroupID": "0",
"ObjectRelation": "first-seen",
"EventID": "743",
"DisableCorrelation": true,
"Type": "datetime",
"Distribution": "5",
"Galaxy": []
}
],
"TemplateUUID": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"TemplateVersion": "7",
"SharingGroupID": "0",
"ObjectReference": [],
"MetaCategory": "network",
"Distribution": "5",
"ID": "3223",
"Name": "ip-port"
},
],
"ThreatLevelID": "1",
"Date": "2019-08-05",
"RelatedEvent": [
{
"ID": "753"
}
],
"Info": "Example event",
"Locked": false,
"OwnerOrganisation": {
"UUID": "5ce29ac4-3b54-459e-a6ee-00acac110002",
"ID": "1",
"Name": "ORGNAME"
},
"Analysis": "0",
"Published": false,
"DisableCorrelation": false,
"ID": "743",
"PublishTimestamp": "0",
"UUID": "5d48302c-bf84-4671-9080-0728ac110002",
"Attribute": [],
"Galaxy": []
}
]
}
Human Readable Output
MISP add attribute
New attribute: 8.8.3.3 was added to event id 743.
9 Upload a file sample
Uploads a file sample to MISP.
Base Command
misp-upload-sample
Input
| Argument Name | Description | Required |
|---|---|---|
| fileEntryID | Entry ID of the file to upload. | Required |
| event_id | The event ID of the event to which to add the uploaded file. | Optional |
| distribution | The distribution setting used for the attributes and for the newly created event, if relevant (0-3). | Optional |
| to_ids | Flags all attributes created during the transaction to be marked as "to_ids" or not. | Optional |
| category | The category that will be assigned to the uploaded samples, (Payload delivery, Artifacts dropped, Payload Installation, External Analysis). | Optional |
| info | Used to populate the event info field if no event ID is supplied. Alternatively, if not supplied, MISP will generate a message showing that it is a malware sample collection generated on the given day. | Optional |
| analysis | The analysis level. Default is "initial". | Optional |
| threat_level_id | The threat level ID of the newly created event. Default is "high". | Optional |
| comment | This will populate the comment field of any attribute created using this API. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.UploadedSample | Unknown | Object containing {filename: event id} of the uploaded file. |
Command Example
!misp-upload-sample fileEntryID=655@6 info="MISP V2 Integration"
Context Example
{
"MISP.UploadedSample": {
"MISP_V2_unified.yml": 754
}
}
Human Readable Output
MISP upload sample
- message: Success, saved all attributes.
- event id: 754
- file name: MISP_V2_unified.yml
10. Delete an event
Deletes an event according to event ID.
Base Command
misp-delete-event
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | Event ID to delete. | Required |
Context Output
There is no context output for this command.
Command Example
!misp-delete-event event_id=735
Human Readable Output
11. Add a tag to an event or attribute
Adds a tag to the given UUID event or attribute.
Base Command
misp-add-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| uuid | UUID of the attribute/event, for example: "59575300-4be8-4ff6-8767-0037ac110032". | Required |
| tag | Tag to add to the attribute or event. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Distribution | number | MISP event distribution. |
| MISP.Event.ThreatLevelID | number | Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). |
| MISP.Event.PublishTimestamp | number | Timestamp of the publish time (if published). |
| MISP.Event.EventCreatorEmail | string | Email address of the event creator. |
| MISP.Event.Date | date | Event creation date. |
| MISP.Event.Locked | boolean | Whether the event is locked. |
| MISP.Event.OwnerOrganisation.ID | number | Owner organization ID. |
| MISP.Event.OwnerOrganisation.Name | string | Owner organization name. |
| MISP.Event.OwnerOrganisation.UUID | string | Owner organization UUID. |
| MISP.Event.RelatedEvent.ID | number | Event IDs of related events (can be a list). |
| MISP.Event.ProposalEmailLock | boolean | Whether email lock is proposed. |
| MISP.Event.Timestamp | number | Timestamp of the event. |
| MISP.Event.Galaxy.Description | string | Galaxy description. |
| MISP.Event.Galaxy.Name | string | Galaxy name. |
| MISP.Event.Galaxy.Type | number | Galaxy type |
| MISP.Event.Published | boolean | Whether the event is published. |
| MISP.Event.DisableCorrelation | boolean | Whether correlation is disabled. |
| MISP.Event.UUID | string | Event UUID. |
| MISP.Event.ShadowAttribute | Unknown | Event shadow attributes. |
| MISP.Event.Attribute.Distribution | number | Attribute distribution. |
| MISP.Event.Attribute.Value | string | Attribute value. |
| MISP.Event.Attribute.EventID | number | Attribute event ID. |
| MISP.Event.Attribute.Timestamp | number | Attribute timestamp. |
| MISP.Event.Attribute.Deleted | boolean | Is the attribute deleted. |
| MISP.Event.Attribute.DisableCorrelation | boolean | Is attribute correlation disabled. |
| MISP.Event.Attribute.Type | string | Attribute type. |
| MISP.Event.Attribute.ID | number | Attribute ID. |
| MISP.Event.Attribute.UUID | string | Attribute UUID. |
| MISP.Event.Attribute.ShadowAttribute | Unknown | Attribute shadow attribute. |
| MISP.Event.Attribute.ToIDs | boolean | Is the Intrusion Detection System flag set. |
| MISP.Event.Attribute.Category | string | Attribute category. |
| MISP.Event.Attribute.SharingGroupID | number | Attribute sharing group ID. |
| MISP.Event.Attribute.Comment | string | Attribute comment. |
| MISP.Event.Analysis | number | Event analysis (0 Initial, 1 Ongoing, 2 Completed). |
| MISP.Event.SharingGroupID | number | Event sharing group ID. |
| MISP.Event.Tag.Name | string | All tag names in the event. |
Command Example
!misp-add-tag tag="Example tag" uuid=5ce29ac4-3b54-459e-a6ee-00acac110002
Context Example
{
"MISP.Event": []
}
Human Readable Output
Tag Example tag has been successfully added to event 5ce29ac4-3b54-459e-a6ee-00acac110002
12. Add sighting to an attribute
Adds sighting to an attribute. The id and uuid arguments are optional, but one must be specified in the command.
Base Command
misp-add-sighting
Input
| Argument Name | Description | Required |
|---|---|---|
| type | Type of sighting to add. | Required |
| id | ID of the attribute to which to add a sighting. Required if uuid is empty. Can be retrieved from the misp-search command. | Optional |
| uuid | UUID of the attribute to which to add a sighting. Required if id is empty. Can be retrieved from the misp-search command. | Optional |
Context Output
There is no context output for this command.
Command Example
!misp-add-sighting type=sighting uuid=23513ce2-2060-4bc8-9b44-6bd735e4f740
Human Readable Output
Sighting 'sighting' has been successfully added to attribute 23513ce2-2060-4bc8-9b44-6bd735e4f740
13. Add an OSINT feed
Adds an OSINT feed.
Base Command
misp-add-events-from-feed
Input
| Argument Name | Description | Required |
|---|---|---|
| feed | URL of the feed to add. | Optional |
| limit | Maximum number of files to add. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | IDs of newly created events. |
Command Example
!misp-add-events-from-feed limit=14 feed=CIRCL
Human Readable Output
Total of 0 events was added to MISP.
14. Add an email object to an event
Adds an email object to the specified event ID.
Base Command
misp-add-email-object
Input
| Argument Name | Description | Required |
|---|---|---|
| entry_id | Entry ID of the email. | Required |
| event_id | ID of the event to which to add the object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event in which the object was first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template. |
| MISP.Event.Object.Timestamp | String | Timestamp when the object was created. |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of the object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of the attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of the first event from which the object originated. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp when the object was created. |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Object type. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-add-email-object event_id=743 entry_id=678@6
Context Example
{
"MISP.Event": {
"Object": {
"Comment": "",
"EventID": "743",
"Timestamp": "1565013620",
"Description": "Email object describing an email with meta-information",
"UUID": "e00e6a2c-682b-48b3-bb01-aee21832ebf0",
"Deleted": false,
"Attribute": [
{
"Category": "External analysis",
"Comment": "",
"UUID": "52d1d881-a1fb-4a2c-b5bc-047fb0073c2f",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": false,
"Value": "Full email.eml",
"ID": "26175",
"SharingGroupID": "0",
"ObjectRelation": "eml",
"EventID": "743",
"value1": "Full email.eml",
"DisableCorrelation": true,
"Type": "attachment",
"Distribution": "5",
"value2": ""
}
{
"Category": "Payload delivery",
"Comment": "",
"UUID": "5ddaae1c-ce54-4191-9d61-907d2c101103",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": false,
"Value": "<example.gmail.com>",
"ID": "26177",
"SharingGroupID": "0",
"ObjectRelation": "message-id",
"EventID": "743",
"value1": "<example.gmail.com>",
"DisableCorrelation": true,
"Type": "email-message-id",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "26daac8a-730e-4951-bad1-d8134feba2cb",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": true,
"Value": "\"Example Demisto (ca)\" <example@demisto.com>",
"ID": "26178",
"SharingGroupID": "0",
"ObjectRelation": "to",
"EventID": "743",
"value1": "\"Example Demisto (ca)\" <example.>",
"DisableCorrelation": true,
"Type": "email-dst",
"Distribution": "5",
"value2": ""
},
{
"Category": "Payload delivery",
"Comment": "",
"UUID": "d6ca6b5f-edba-4d46-9a9f-15fec4f6bd2b",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": false,
"Value": "[TEST][DEMISTO] CASO 1 EMAIL DA SISTEMA DEMISTO | ZIP+PASSWORD",
"ID": "26179",
"SharingGroupID": "0",
"ObjectRelation": "subject",
"EventID": "743",
"value1": "[TEST][DEMISTO] CASO 1 EMAIL DA SISTEMA DEMISTO | ZIP+PASSWORD",
"DisableCorrelation": false,
"Type": "email-subject",
"Distribution": "5",
"value2": ""
},
{
"Category": "Payload delivery",
"Comment": "",
"UUID": "983eaba4-a94e-49ab-ae18-40151778a9ba",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": true,
"Value": "\"Example Demisto (ca)\" <example@demisto.com>",
"ID": "26180",
"SharingGroupID": "0",
"ObjectRelation": "from",
"EventID": "743",
"value1": "\"Example Demisto (ca)\" <example@demisto.com>",
"DisableCorrelation": false,
"Type": "email-src",
"Distribution": "5",
"value2": ""
},
{
"Category": "Payload delivery",
"Comment": "",
"UUID": "c432d6c7-5d34-4b64-a6b4-5813d1874bd2",
"ObjectID": "3231",
"Deleted": false,
"Timestamp": "1565013620",
"ToIDs": true,
"Value": "example@demisto.com",
"ID": "26181",
"SharingGroupID": "0",
"ObjectRelation": "return-path",
"EventID": "743",
"value1": "example@demisto.com",
"DisableCorrelation": false,
"Type": "email-src",
"Distribution": "5",
"value2": ""
}
],
"TemplateUUID": "a0c666e0-fc65-4be8-b48f-3423d788b552",
"TemplateVersion": "12",
"SharingGroupID": "0",
"MetaCategory": "network",
"Distribution": "5",
"ID": "3231",
"Name": "email"
},
"ID": "743"
}
}
Human Readable Output
Object has been added to MISP event ID 743
15. Add a domain object to an event
Adds a domain object.
Base Command
misp-add-domain-object
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | ID of a MISP event. | Required |
| name | The domain name, for example: "google.com". | Required |
| dns | A list (array) or IP addresses resolved by DNS. | Required |
| creation_date | Date that the domain was created. | Optional |
| last_seen | Datetime that the domain was last seen, for example: 2019-02-03. |
Optional |
| first_seen | Datetime that the domain was first seen, for example: 2019-02-03. |
Optional |
| text | A description of the domain. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of the object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event in which the object was first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template. |
| MISP.Event.Object.Timestamp | String | Timestamp when the object was created. |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of the object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of the attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of the first event from which the object originated. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp of object creation |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Object type. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-add-domain-object event_id=743 dns="8.8.8.8,8.8.4.4" name="google.com" text="Google DNS"
Context Example
{
"MISP.Event": {
"Object": {
"Comment": "",
"EventID": "743",
"Timestamp": "1565013623",
"Description": "A domain and IP address seen as a tuple in a specific time frame.",
"UUID": "ee732c55-78d4-4e2a-8616-e1b07c85397b",
"Deleted": false,
"Attribute": [
{
"Category": "Network activity",
"Comment": "",
"UUID": "c52ec904-30c9-47ce-a7d5-a1aaa9326576",
"ObjectID": "3232",
"Deleted": false,
"Timestamp": "1565013623",
"ToIDs": true,
"Value": "8.8.8.8",
"ID": "26182",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"value1": "8.8.8.8",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "b48f0132-c90a-4b79-ae12-190476155b47",
"ObjectID": "3232",
"Deleted": false,
"Timestamp": "1565013623",
"ToIDs": true,
"Value": "8.8.4.4",
"ID": "26183",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"value1": "8.8.4.4",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "8fc80065-07ca-4151-b8e4-df919aa53dbb",
"ObjectID": "3232",
"Deleted": false,
"Timestamp": "1565013623",
"ToIDs": true,
"Value": "google.com",
"ID": "26184",
"SharingGroupID": "0",
"ObjectRelation": "domain",
"EventID": "743",
"value1": "google.com",
"DisableCorrelation": false,
"Type": "domain",
"Distribution": "5",
"value2": ""
}
],
"TemplateUUID": "43b3b146-77eb-4931-b4cc-b66c60f28734",
"TemplateVersion": "6",
"SharingGroupID": "0",
"MetaCategory": "network",
"Distribution": "5",
"ID": "3232",
"Name": "domain-ip"
},
"ID": "743"
}
}
Human Readable Output
Object has been added to MISP event ID 743
16. Add a URL object to an event
Adds a URL object to a MISP event.
Base Command
misp-add-url-object
Input
| Argument Name | Description | Required |
|---|---|---|
| url | Full URL to add to the event. | Required |
| first_seen | Date that this URL was first seen, for example: 2019-02-03. |
Optional |
| text | Description of the URL. | Optional |
| last_seen | Date that this URL was last seen, for example: 2019-02-03. |
Optional |
| event_id | ID of the event. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of the object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event in which the object was first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template. |
| MISP.Event.Object.Timestamp | String | Timestamp when the object was created. |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of the object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of the attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of the first event from which the object originated. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp when the object was created. |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Object type. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-add-url-object event_id=743 url=https://github.com/MISP/misp-objects/blob/master/objects/url/definition.json?q=1
Context Example
{
"MISP.Event": {
"Object": {
"Comment": "",
"EventID": "743",
"Timestamp": "1565013625",
"Description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
"UUID": "f2da7f70-0fa9-446d-8c0e-e2b87f348d3d",
"Deleted": false,
"Attribute": [
{
"Category": "Network activity",
"Comment": "",
"UUID": "9abd47bd-749a-40a1-a79d-1dc8aa9d843f",
"ObjectID": "3233",
"Deleted": false,
"Timestamp": "1565013625",
"ToIDs": true,
"Value": "https://github.com/MISP/misp-objects/blob/master/objects/url/definition.json?q=1",
"ID": "26185",
"SharingGroupID": "0",
"ObjectRelation": "url",
"EventID": "743",
"value1": "https://github.com/MISP/misp-objects/blob/master/objects/url/definition.json?q=1",
"DisableCorrelation": false,
"Type": "url",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "b8595c60-8eca-4963-8bf9-656adbe86566",
"ObjectID": "3233",
"Deleted": false,
"Timestamp": "1565013625",
"ToIDs": false,
"Value": "https",
"ID": "26186",
"SharingGroupID": "0",
"ObjectRelation": "scheme",
"EventID": "743",
"value1": "https",
"DisableCorrelation": true,
"Type": "text",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "3f7a901d-07ac-4b65-9cf1-a2470d229a90",
"ObjectID": "3233",
"Deleted": false,
"Timestamp": "1565013625",
"ToIDs": false,
"Value": "/MISP/misp-objects/blob/master/objects/url/definition.json",
"ID": "26187",
"SharingGroupID": "0",
"ObjectRelation": "resource_path",
"EventID": "743",
"value1": "/MISP/misp-objects/blob/master/objects/url/definition.json",
"DisableCorrelation": false,
"Type": "text",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "8c2c385b-4f75-4aac-a670-15fe9eb08ce5",
"ObjectID": "3233",
"Deleted": false,
"Timestamp": "1565013625",
"ToIDs": false,
"Value": "q=1",
"ID": "26188",
"SharingGroupID": "0",
"ObjectRelation": "query_string",
"EventID": "743",
"value1": "q=1",
"DisableCorrelation": false,
"Type": "text",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "5098cb2c-27d8-483f-b467-b6d5732a2008",
"ObjectID": "3233",
"Deleted": false,
"Timestamp": "1565013625",
"ToIDs": true,
"Value": "github.com",
"ID": "26189",
"SharingGroupID": "0",
"ObjectRelation": "domain",
"EventID": "743",
"value1": "github.com",
"DisableCorrelation": false,
"Type": "domain",
"Distribution": "5",
"value2": ""
}
],
"TemplateUUID": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
"TemplateVersion": "7",
"SharingGroupID": "0",
"MetaCategory": "network",
"Distribution": "5",
"ID": "3233",
"Name": "url"
},
"ID": "743"
}
}
Human Readable Output
Object has been added to MISP event ID 743
17. Add an object to an event
Adds any other object to MISP.
Base Command
misp-add-object
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | ID of the event to add the object to. | Required |
| template | Template name. For more information, see the MISP documentation. | Required |
| attributes | attributes | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of the object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event in which the object was first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template. |
| MISP.Event.Object.Timestamp | String | Timestamp when the object was created. |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of the object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of the attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of the first event from which the object originated. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp when the object was created. |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted? |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Object type. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-add-object event_id="15" template="vehicle" attributes="{'description': 'Manager TestMotors', 'make': 'TestMotors', 'model': '308 GTS'}"
!misp-add-object event_id=15 template="http-request" attributes="{'url': 'https://foaas.com/awesome/Mom', 'method': 'GET', 'basicauth-user': 'username', 'basicauth-password': 'password'}
!misp-add-object event_id=15 template=device attributes="{'name': 'AndroidPhone', 'device-type': 'Mobile', 'OS': 'Android', 'version': '9 PKQ1'}"
Context Example
{
"MISP.Event": {
"Object": {
"Comment": "",
"EventID": "743",
"Timestamp": "1565013618",
"Description": "Vehicle object template to describe a vehicle information and registration",
"UUID": "00b4293d-2c4d-4c7d-83b6-e72b0a199402",
"Deleted": false,
"Attribute": [
{
"Category": "Other",
"Comment": "",
"UUID": "dc7fa7d8-afb4-4740-8f97-ed10adce735f",
"ObjectID": "3230",
"Deleted": false,
"Timestamp": "1565013618",
"ToIDs": false,
"Value": "Manager TestMotors",
"ID": "26172",
"SharingGroupID": "0",
"ObjectRelation": "description",
"EventID": "743",
"value1": "Manager TestMotors",
"DisableCorrelation": true,
"Type": "text",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "8eeabab2-627e-4b1f-b4bd-c11b624fdabe",
"ObjectID": "3230",
"Deleted": false,
"Timestamp": "1565013618",
"ToIDs": false,
"Value": "TestMotors",
"ID": "26173",
"SharingGroupID": "0",
"ObjectRelation": "make",
"EventID": "743",
"value1": "TestMotors",
"DisableCorrelation": true,
"Type": "text",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "bfa5455c-22c2-45b1-9212-eefc59e4b430",
"ObjectID": "3230",
"Deleted": false,
"Timestamp": "1565013618",
"ToIDs": false,
"Value": "308 GTS",
"ID": "26174",
"SharingGroupID": "0",
"ObjectRelation": "model",
"EventID": "743",
"value1": "308 GTS",
"DisableCorrelation": true,
"Type": "text",
"Distribution": "5",
"value2": ""
}
],
"TemplateUUID": "683c076c-f695-4ff2-8efa-e98a418049f4",
"TemplateVersion": "1",
"SharingGroupID": "0",
"MetaCategory": "misc",
"Distribution": "5",
"ID": "3230",
"Name": "vehicle"
},
"ID": "743"
}
}
Human Readable Output
Object has been added to MISP event ID 743
18. Add an IP object to an event
Adds an IP Object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".
Base Command
misp-add-ip-object
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | ID of an event. | Required |
| ip | IP address (require one of). | Optional |
| dst_port | Destination port number. | Optional |
| src_port | Source port number. | Optional |
| domain | Domain. | Optional |
| hostname | Hostname. | Optional |
| ip_src | IP source. | Optional |
| ip_dst | IP destination. | Optional |
| first_seen | Date when the tuple was first seen. | Optional |
| last_seen | Date when the tuple was last seen. | Optional |
| comment | A description of the object. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MISP.Event.ID | number | MISP event ID. |
| MISP.Event.Object.MetaCategory | String | Object meta category. |
| MISP.Event.Object.Distribution | Number | Distribution of the object. |
| MISP.Event.Object.Name | String | Name of the object. |
| MISP.Event.Object.TemplateVersion | Number | Template version of the object. |
| MISP.Event.Object.EventID | Number | ID of the event in which the object was first created. |
| MISP.Event.Object.TemplateUUID | String | UUID of the template. |
| MISP.Event.Object.Timestamp | String | Timestamp when the object was created. |
| MISP.Event.Object.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.ID | Number | ID of the object. |
| MISP.Event.Object.UUID | String | UUID of the object. |
| MISP.Event.Object.Attribute.Value | String | Value of the attribute. |
| MISP.Event.Object.Attribute.EventID | Number | ID of the first event from which the object originated. |
| MISP.Event.Object.Attribute.Timestamp | Date | Timestamp when the object was created. |
| MISP.Event.Object.Attribute.Deleted | Boolean | Whether the object was deleted. |
| MISP.Event.Object.Attribute.ObjectID | Number | ID of the object. |
| MISP.Event.Object.Attribute.DisableCorrelation | Boolean | Whether correlation is disabled. |
| MISP.Event.Object.Attribute.ID | Unknown | ID of the attribute. |
| MISP.Event.Object.Attribute.ObjectRelation | String | Relation of the object. |
| MISP.Event.Object.Attribute.Type | String | Object type. |
| MISP.Event.Object.Attribute.UUID | String | UUID of the attribute. |
| MISP.Event.Object.Attribute.ToIDs | Boolean | Whether the to_ids flag is on. |
| MISP.Event.Object.Attribute.Category | String | Category of the attribute. |
| MISP.Event.Object.Attribute.SharingGroupID | Number | ID of the sharing group. |
| MISP.Event.Object.Attribute.Comment | String | Comment of the attribute. |
| MISP.Event.Object.Description | String | Description of the object. |
Command Example
!misp-add-ip-object event_id="743" ip="8.8.8.8,4.4.4.4" dst_port="8080" domain="google.com" first_seen="2018-05-05" text="test dns"
Context Example
{
"MISP.Event": {
"Object": {
"Comment": "",
"EventID": "743",
"Timestamp": "1565013616",
"Description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"UUID": "14990bd5-aae0-4ceb-be1a-4fee9f6a0af4",
"Deleted": false,
"Attribute": [
{
"Category": "Network activity",
"Comment": "",
"UUID": "2136e8a8-33a3-4480-ba3a-54e165ef7a80",
"ObjectID": "3229",
"Deleted": false,
"Timestamp": "1565013616",
"ToIDs": false,
"Value": "8080",
"ID": "26167",
"SharingGroupID": "0",
"ObjectRelation": "dst-port",
"EventID": "743",
"value1": "8080",
"DisableCorrelation": true,
"Type": "port",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "0d5952c5-218c-4a25-8a0c-f361ef37420a",
"ObjectID": "3229",
"Deleted": false,
"Timestamp": "1565013616",
"ToIDs": true,
"Value": "google.com",
"ID": "26168",
"SharingGroupID": "0",
"ObjectRelation": "domain",
"EventID": "743",
"value1": "google.com",
"DisableCorrelation": false,
"Type": "domain",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "ebb067d7-4f5e-4536-a164-2df7eafc3060",
"ObjectID": "3229",
"Deleted": false,
"Timestamp": "1565013616",
"ToIDs": true,
"Value": "8.8.8.8",
"ID": "26169",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"value1": "8.8.8.8",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"value2": ""
},
{
"Category": "Network activity",
"Comment": "",
"UUID": "99e0cfe2-8581-4ffd-ad39-b8bee6325203",
"ObjectID": "3229",
"Deleted": false,
"Timestamp": "1565013616",
"ToIDs": true,
"Value": "4.4.4.4",
"ID": "26170",
"SharingGroupID": "0",
"ObjectRelation": "ip",
"EventID": "743",
"value1": "4.4.4.4",
"DisableCorrelation": false,
"Type": "ip-dst",
"Distribution": "5",
"value2": ""
},
{
"Category": "Other",
"Comment": "",
"UUID": "a85528af-5b1e-4bb4-99bd-80fa46c4f5ae",
"ObjectID": "3229",
"Deleted": false,
"Timestamp": "1565013616",
"ToIDs": false,
"Value": "2018-05-05",
"ID": "26171",
"SharingGroupID": "0",
"ObjectRelation": "first-seen",
"EventID": "743",
"value1": "2018-05-05",
"DisableCorrelation": true,
"Type": "datetime",
"Distribution": "5",
"value2": ""
}
],
"TemplateUUID": "9f8cea74-16fe-4968-a2b4-026676949ac6",
"TemplateVersion": "7",
"SharingGroupID": "0",
"MetaCategory": "network",
"Distribution": "5",
"ID": "3229",
"Name": "ip-port"
},
"ID": "743"
}
}
Human Readable Output
Object has been added to MISP event ID 743
Configuration parameters
url— MISP server URL (e.g., https://192.168.0.1) (required)api_key— API Key (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)context_select— Select which attribute data fields of the event to save to context. Leave empty to save all attributes.attributes_limit— Maximum attributes in the event
Commands (20)
-
fileChecks the file reputation of the given hash.
-
internal-misp-add-attributeDeprecatedAdds an attribute to an existing MISP event.
-
internal-misp-create-eventDeprecatedCreate a new MISP event.
-
ipChecks the reputation of an IP address.
-
misp-add-attributeAdds an attribute to an existing MISP event.
-
misp-add-domain-objectAdds a domain object.
-
misp-add-email-objectAdds an email object to the specified event ID.
-
misp-add-events-from-feedAdds an OSINT feed.
-
misp-add-ip-objectAdds an IP object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".
-
misp-add-objectAdds any other object to MISP.
-
misp-add-sightingAdd sighting to an attribute.
-
misp-add-tagAdds a tag to the given UUID event or attribute.
-
misp-add-url-objectAdds a URL object to a MISP event.
-
misp-create-eventCreates a new MISP event.
-
misp-delete-eventDeletes an event according to event ID.
-
misp-download-sampleDownloads a file sample from MISP.
-
misp-searchSearch for events in MISP.
-
misp-search-attributesSearch for attributes in MISP.
-
misp-upload-sampleUploads a file sample to MISP.
-
urlChecks if the URL is in MISP events.
import logging import warnings from typing import Union, List, Any, Tuple, Dict from urllib.parse import urlparse import requests from pymisp import ExpandedPyMISP, PyMISPError, MISPObject from pymisp.tools import EMailObject, GenericObjectGenerator import copy from CommonServerPython import * logging.getLogger("pymisp").setLevel(logging.CRITICAL) def warn(*args): """ Do nothing with warnings """ pass # Disable requests warnings requests.packages.urllib3.disable_warnings() # Disable python warnings warnings.warn = warn ''' GLOBALS/PARAMS ''' PARAMS = demisto.params() MISP_KEY = PARAMS.get('api_key') MISP_URL = PARAMS.get('url') USE_SSL = not PARAMS.get('insecure') proxies = handle_proxy() # type: ignore MISP_PATH = 'MISP.Event(obj.ID === val.ID)' MISP_ATTRIBUTE_PATH = 'MISP.Attribute(obj.ID === val.ID)' MISP = ExpandedPyMISP(url=MISP_URL, key=MISP_KEY, ssl=USE_SSL, proxies=proxies) # type: ExpandedPyMISP DATA_KEYS_TO_SAVE = PARAMS.get('context_select', []) try: MAX_ATTRIBUTES = int(PARAMS.get('attributes_limit') or 1000) except ValueError: return_error("Maximum attributes in event must be a positive number") else: if MAX_ATTRIBUTES < 1: return_error("Maximum attributes in event must be a positive number") """ dict format : MISP key:DEMISTO key """ PREDEFINED_FEEDS = { 'CIRCL': {'name': 'CIRCL OSINT Feed', 'url': 'https://www.circl.lu/doc/misp/feed-osint', 'format': 'misp', 'input': 'network'}, 'Botvrij.eu': {'name': 'The Botvrij.eu Data', 'url': 'http://www.botvrij.eu/data/feed-osint', 'format': 'misp', 'input': 'network'} } ENTITIESDICT = { 'deleted': 'Deleted', 'category': 'Category', 'comment': 'Comment', 'uuid': 'UUID', 'sharing_group_id': 'SharingGroupID', 'timestamp': 'Timestamp', 'to_ids': 'ToIDs', 'value': 'Value', 'event_id': 'EventID', 'ShadowAttribute': 'ShadowAttribute', 'disable_correlation': 'DisableCorrelation', 'distribution': 'Distribution', 'type': 'Type', 'id': 'ID', 'date': 'Date', 'info': 'Info', 'published': 'Published', 'attribute_count': 'AttributeCount', 'proposal_email_lock': 'ProposalEmailLock', 'locked': 'Locked', 'publish_timestamp': 'PublishTimestamp', 'event_creator_email': 'EventCreatorEmail', 'name': 'Name', 'analysis': 'Analysis', 'threat_level_id': 'ThreatLevelID', 'old_id': 'OldID', 'org_id': 'OrganisationID', 'Org': 'Organisation', 'Orgc': 'OwnerOrganisation', 'orgc_uuid': 'OwnerOrganisation.UUID', 'orgc_id': 'OwnerOrganisation.ID', 'orgc_name': 'OwnerOrganisation.Name', 'event_uuid': 'EventUUID', 'proposal_to_delete': 'ProposalToDelete', 'description': 'Description', 'version': 'Version', 'Object': 'Object', 'object_id': 'ObjectID', 'object_relation': 'ObjectRelation', 'template_version': 'TemplateVersion', 'template_uuid': 'TemplateUUID', 'meta-category': 'MetaCategory', 'decay_score': 'DecayScore' } THREAT_LEVELS_WORDS = { '1': 'HIGH', '2': 'MEDIUM', '3': 'LOW', '4': 'UNDEFINED' } THREAT_LEVELS_NUMBERS = { 'high': 1, 'medium': 2, 'low': 3, 'undefined': 4 } ANALYSIS_WORDS = { '0': 'Initial', '1': 'Ongoing', '2': 'Completed' } ANALYSIS_NUMBERS = { 'initial': 0, 'ongoing': 1, 'completed': 2 } DISTRIBUTION_NUMBERS = { 'Your_organisation_only': 0, 'This_community_only': 1, 'Connected_communities': 2, 'All_communities': 3 } ''' HELPER FUNCTIONS ''' def extract_error(error: list) -> List[dict]: """Extracting errors Args: error: list of responses from error section Returns: List[Dict[str, any]]: filtered response Examples: extract_error([ (403, { 'name': 'Could not add object', 'message': 'Could not add object', 'url': '/objects/add/156/', 'errors': 'Could not save object as at least one attribute has failed validation (ip). \ {"value":["IP address has an invalid format."]}' } ) ]) Response: [{ 'code': 403, 'message': 'Could not add object', 'errors': 'Could not save object as at least one attribute has failed validation (ip). \ {"value":["IP address has an invalid format."]}' }] """ return [{ 'code': err[0], 'message': err[1].get('message'), 'errors': err[1].get('errors') } for err in error] def build_list_from_dict(args: dict) -> List[dict]: """ Args: args: dictionary describes MISP object Returns: list: list containing dicts that GenericObjectGenerator can take. Examples: >>> {'ip': '8.8.8.8', 'domain': 'google.com'} [{'ip': '8.8.8.8'}, {'domain': 'google.com'}] """ return [{k: v} for k, v in args.items()] def build_generic_object(template_name: str, args: List[dict]) -> GenericObjectGenerator: """ Args: template_name: template name as described in args: arguments to create the generic object Returns: GenericObjectGenerator: object created in MISP Example: args should look like: [{'analysis_submitted_at': '2018-06-15T06:40:27'}, {'threat_score': {value=95, to_ids=False}}, {'permalink': 'https://panacea.threatgrid.com/mask/samples/2e445ef5389d8b'}, {'heuristic_raw_score': 7.8385159793597}, {'heuristic_score': 96}, {'original_filename': 'juice.exe'}, {'id': '2e445ef5389d8b'}] # guardrails-disable-line """ misp_object = GenericObjectGenerator(template_name) misp_object.generate_attributes(args) return misp_object def convert_timestamp(timestamp: Union[str, int]) -> str: """ Gets a timestamp from MISP response (1546713469) and converts it to human readable format """ return datetime.utcfromtimestamp(int(timestamp)).strftime('%Y-%m-%d %H:%M:%S') def replace_keys(obj_to_build: Union[dict, list, str]) -> Union[dict, list, str]: """ Replacing keys from MISP's format to Demisto's (as appear in ENTITIESDICT) Args: obj_to_build (Union[dict, list, str]): object to replace keys in Returns: Union[dict, list, str]: same object type that got in """ if isinstance(obj_to_build, list): return [replace_keys(item) for item in obj_to_build] if isinstance(obj_to_build, dict): return { (ENTITIESDICT[key] if key in ENTITIESDICT else key): replace_keys(value) for key, value in obj_to_build.items() } return obj_to_build def remove_unselected_context_keys(context_data): for attribute in context_data['Attribute']: for key in list(attribute.keys()): if key not in DATA_KEYS_TO_SAVE: del attribute[key] def limit_attributes_count(event: dict) -> dict: """ Gets a MISP's event and limiting the amount of attributes to MAX_ATTRIBUTES Args: event (dict): MISP's event Returns: dict: context output """ if event and 'Attribute' in event and len(event['Attribute']) > MAX_ATTRIBUTES: attributes = event['Attribute'] attributes_num = len(attributes) event_id = event.get('id', '') event_uuid = event.get('uuid') demisto.info(f'Limiting amount of attributes in event to {MAX_ATTRIBUTES} ' f'to keep context from being overwhelmed. ' f'This limit can be changed in the integration configuration. ' f'Event ID: {event_id}, Event UUID: {event_uuid}, Attributes in event: {attributes_num}') sorted_attributes = sorted(attributes, key=lambda at: int(at.get('timestamp', 0))) event['Attribute'] = sorted_attributes[attributes_num - MAX_ATTRIBUTES:] return event return event def arrange_context_according_to_user_selection(context_data): if not DATA_KEYS_TO_SAVE: return # each related event has it's own attributes for event in context_data: # Remove filtered fields in event remove_unselected_context_keys(event) # Remove filtered fields in object for obj in event['Object']: remove_unselected_context_keys(obj) def build_context(response: Union[dict, requests.Response]) -> dict: # type: ignore """ Gets a MISP's response and building it to be in context. If missing key, will return the one written. Args: response (requests.Response or dict): Returns: dict: context output """ event_args = [ 'id', 'date', 'threat_level_id', 'info', 'published', 'uuid', 'analysis', 'timestamp', 'distribution', 'proposal_email_lock', 'locked', 'publish_timestamp', 'sharing_group_id', 'disable_correlation', 'event_creator_email', 'Org', 'Orgc', 'Attribute', 'ShadowAttribute', 'RelatedEvent', 'Galaxy', 'Tag', 'Object' ] # Sometimes, PyMISP will return str instead of a dict. json.loads() wouldn't work unless we'll dumps it first if isinstance(response, str): response = json.loads(json.dumps(response)) # Remove 'Event' keyword events = [event.get('Event') for event in response] # type: ignore for i in range(0, len(events)): events[i] = limit_attributes_count(events[i]) # Filter object from keys in event_args events[i] = { key: events[i].get(key) for key in event_args if key in events[i] } # Remove 'Event' keyword from 'RelatedEvent' if events[i].get('RelatedEvent'): events[i]['RelatedEvent'] = [ r_event.get('Event') for r_event in events[i].get('RelatedEvent') ] # Get only IDs from related event events[i]['RelatedEvent'] = [ { 'id': r_event.get('id') } for r_event in events[i].get('RelatedEvent') ] # Build Galaxy if events[i].get('Galaxy'): events[i]['Galaxy'] = [ { 'name': star.get('name'), 'type': star.get('type'), 'description': star.get('description') } for star in events[i]['Galaxy'] ] # Build tag if events[i].get('Tag'): events[i]['Tag'] = [ {'Name': tag.get('name')} for tag in events[i].get('Tag') ] events = replace_keys(events) # type: ignore arrange_context_according_to_user_selection(events) # type: ignore return events # type: ignore def build_attribute_context(response: Union[dict, requests.Response]) -> dict: """ Convert the response of attribute search returned from MIPS to the context output format. """ attribute_fields = [ 'id', 'event_id', 'object_id', 'object_relation', 'category', 'type', 'to_ids', 'uuid', 'timestamp', 'distribution', 'sharing_group_id', 'comment', 'deleted', 'disable_correlation', 'value', 'Event', 'Object', 'Galaxy', # field wasn't tested as we don't see it in our responses. Was added by customer's request. 'Tag', 'decay_score' ] if isinstance(response, str): response = json.loads(json.dumps(response)) attributes = response.get('Attribute') for i in range(len(attributes)): attributes[i] = {key: attributes[i].get(key) for key in attribute_fields if key in attributes[i]} # Build Galaxy if attributes[i].get('Galaxy'): attributes[i]['Galaxy'] = [ { 'name': star.get('name'), 'type': star.get('type'), 'description': star.get('description') } for star in attributes[i]['Galaxy'] ] # Build Tag if attributes[i].get('Tag'): attributes[i]['Tag'] = [ {'Name': tag.get('name')} for tag in attributes[i].get('Tag') ] attributes = replace_keys(attributes) return attributes def get_misp_threat_level(threat_level_id: str) -> str: # type: ignore """Gets MISP's thread level and returning it in Demisto's format Args: threat_level_id: str of thread level in MISP Returns: str: Threat-level in Demisto """ if threat_level_id == '1': return 'HIGH' if threat_level_id == '2': return 'MEDIUM' if threat_level_id == '3': return 'LOW' if threat_level_id == '4': return 'UNDEFINED' return_error('Invalid MISP Threat Level with threat_level_id: ' + threat_level_id) def get_dbot_level(threat_level_id: str) -> int: """ MISP to DBOT: 4 = 0 (UNDEFINED to UNKNOWN) 3 = 2 (LOW to SUSPICIOUS) 1 | 2 = 3 (MED/HIGH to MALICIOUS) Args: threat_level_id (str): Returns: int: DBOT score """ if threat_level_id in ('1', '2'): return 3 if threat_level_id == '3': return 2 if threat_level_id == '4': return 0 return 0 def get_files_events(): files = argToList(demisto.args().get('file'), ',') for file_hash in files: check_file(file_hash) def check_file(file_hash): """ gets a file_hash and entities dict, returns MISP events file_hash (str): File's hash from demisto Returns: dict: MISP's output formatted to demisto: """ # hashFormat will be used only in output hash_format = get_hash_type(file_hash).upper() if hash_format == 'Unknown': return_error('Invalid hash length, enter file hash of format MD5, SHA-1 or SHA-256') # misp_response will remain the raw output of misp misp_response = MISP.search(value=file_hash) if misp_response: dbot_list = list() file_list = list() md_list = list() for i_event in misp_response: event = i_event['Event'] i_event['Event']['RelatedEvent'] = [r_event.get('Event') for r_event in event.get('RelatedEvent')] for i_event in misp_response: event = i_event['Event'] misp_organisation = f"MISP.{event.get('orgc_name')}" dbot_score = get_dbot_level(event.get('threat_level_id')) # Build RelatedEvent # if dbot_score is suspicious or malicious dbot_obj = { 'Indicator': file_hash, 'Type': 'hash', 'Vendor': 'MISP V2', 'Score': dbot_score } file_obj = { hash_format: file_hash } # if malicious, find file with given hash if dbot_score == 3: file_obj['Malicious'] = { 'Vendor': 'MISP V2', 'Description': f'file hash found in MISP event with ID: {event.get("id")}' } md_obj = { 'EventID': event.get('id'), 'Threat Level': THREAT_LEVELS_WORDS[event.get('threat_level_id')], 'Organisation': misp_organisation } file_list.append(file_obj) dbot_list.append(dbot_obj) md_list.append(md_obj) # Building entry outputs = { outputPaths.get('file'): file_list, outputPaths.get('dbotscore'): dbot_list } md = tableToMarkdown(f'Results found in MISP for hash: {file_hash}', md_list) else: md = f"No events found in MISP for hash {file_hash}" outputs = { outputPaths.get('dbotscore'): { 'Indicator': file_hash, 'Type': 'hash', 'Vendor': 'MISP V2', 'Score': Common.DBotScore.NONE, }, } return_results(CommandResults( readable_output=md, outputs=outputs, raw_response=misp_response, )) def get_ips_events(): ips = argToList(demisto.args().get('ip'), ',') for ip in ips: check_ip(ip) def check_ip(ip): """ Gets a IP and returning its reputation (if exists) ip (str): IP to check """ if not is_ip_valid(ip): return_error("IP isn't valid") misp_response = MISP.search(value=ip) if misp_response: dbot_list = list() ip_list = list() md_list = list() for event_in_response in misp_response: event = event_in_response.get('Event') dbot_score = get_dbot_level(event.get('threat_level_id')) misp_organisation = f'MISP.{event.get("Orgc").get("name")}' dbot_obj = { 'Indicator': ip, 'Type': 'ip', 'Vendor': 'MISP V2', 'Score': dbot_score } ip_obj = {'Address': ip} # if malicious if dbot_score == 3: ip_obj['Malicious'] = { 'Vendor': 'MISP V2', 'Description': f'IP Found in MISP event: {event.get("id")}' } md_obj = { 'EventID': event.get('id'), 'Threat Level': THREAT_LEVELS_WORDS[event.get('threat_level_id')], 'Organisation': misp_organisation } ip_list.append(ip_obj) dbot_list.append(dbot_obj) md_list.append(md_obj) outputs = { outputPaths.get('ip'): ip_list, outputPaths.get('dbotscore'): dbot_list, MISP_PATH: build_context(misp_response) } md = tableToMarkdown(f'Results found in MISP for IP: {ip}', md_list) else: md = f'No events found in MISP for IP: {ip}' outputs = { outputPaths.get('dbotscore'): { 'Indicator': ip, 'Type': DBotScoreType.IP, 'Vendor': 'MISP V2', 'Score': Common.DBotScore.NONE, }, } return_results(CommandResults( readable_output=md, outputs=outputs, raw_response=misp_response, )) def upload_sample(): """ Misp needs to get files in base64. in the old integration (js) it was converted by a script. """ # Creating dict with Demisto's arguments args = ['distribution', 'to_ids', 'category', 'info', 'analysis', 'comment', 'threat_level_id'] args = {key: demisto.args().get(key) for key in args if demisto.args().get(key)} args['threat_level_id'] = THREAT_LEVELS_NUMBERS.get(demisto.args().get('threat_level_id')) if demisto.args().get( 'threat_level_id') in THREAT_LEVELS_NUMBERS else demisto.args().get('threat_level_id') args['analysis'] = ANALYSIS_NUMBERS.get(demisto.args().get('analysis')) if demisto.args().get( 'analysis') in ANALYSIS_NUMBERS else demisto.args().get('analysis') event_id = demisto.args().get('event_id') file = demisto.getFilePath(demisto.args().get('fileEntryID')) filename = file.get('name') file = file.get('path') if not file: return_error(f'file {filename} is empty or missing') if not event_id: if not demisto.args().get('info'): demisto.args()['info'] = filename event_id = create_event(ret_only_event_id=True) res = MISP.upload_sample(filename=filename, filepath_or_bytes=file, event_id=event_id, **args) if res.get('name') == 'Failed': ec = None else: ec = {"MISP.UploadedSample": {filename: event_id}} demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['json'], 'Contents': res, 'ReadableContentsFormat': formats['markdown'], 'HumanReadable': f"MISP upload sample \n* message: {res.get('message')}\n* event id: {event_id}\n* file name: {filename}", 'EntryContext': ec, }) def get_time_now(): """ Returns: str: time in year--month--day format """ time_now = time.gmtime(time.time()) return f'{time_now.tm_year}--{time_now.tm_mon}--{time_now.tm_mday}' def create_event(ret_only_event_id: bool = False) -> Union[int, None]: """Creating event in MISP with the given attribute Args: ret_only_event_id (bool): returning event ID if set to True Returns: int: event_id """ d_args = demisto.args() # new_event in the old integration gets some args that belongs to attribute, so after creating the basic event, # we will add attribute event_dic = { 'distribution': d_args.get('distribution'), 'threat_level_id': THREAT_LEVELS_NUMBERS.get(d_args.get('threat_level_id')) if d_args.get( 'threat_level_id') in THREAT_LEVELS_NUMBERS else d_args.get('threat_level_id'), 'analysis': ANALYSIS_NUMBERS.get(demisto.args().get('analysis')) if demisto.args().get( 'analysis') in ANALYSIS_NUMBERS else demisto.args().get('analysis'), 'info': d_args.get('info') if d_args.get('info') else 'Event from Demisto', 'date': d_args.get('date') if d_args.get('date') else get_time_now(), 'published': True if d_args.get('published') == 'true' else False, 'orgc_id': d_args.get('orgc_id'), 'org_id': d_args.get('org_id'), 'sharing_group_id': d_args.get('sharing_group_id') } event = MISP.new_event(**event_dic) event_id = event.get('id') if isinstance(event_id, str) and event_id.isdigit(): event_id = int(event_id) elif not isinstance(event_id, int): return_error('EventID must be a number') if ret_only_event_id: return event_id # add attribute add_attribute(event_id=event_id, internal=True) event = MISP.search(eventid=event_id) md = f"## MISP create event\nNew event with ID: {event_id} has been successfully created.\n" ec = { MISP_PATH: build_context(event) } demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['json'], 'Contents': event, 'ReadableContentsFormat': formats['markdown'], 'HumanReadable': md, 'EntryContext': ec }) return None def add_attribute(event_id: int = None, internal: bool = None): """Adding attribute to given event Args: event_id (int): Event ID to add attribute to internal(bool): if set to True, will not post results to Demisto """ d_args = demisto.args() args = { 'id': d_args.get('id'), 'type': d_args.get('type') if d_args.get('type') else 'other', 'category': d_args.get('category'), 'to_ids': True if d_args.get('to_ids') == 'true' else False, 'distribution': d_args.get('distribution'), 'comment': d_args.get('comment'), 'value': d_args.get('value') } if event_id: args['id'] = event_id # type: ignore if isinstance(args.get('id'), str) and args.get('id').isdigit(): # type: ignore args['id'] = int(args['id']) elif not isinstance(args.get('id'), int): return_error('Invalid MISP event ID, must be a number') if args.get('distribution') is not None: if not isinstance(args.get('distribution'), int): if isinstance(args.get('distribution'), str) and args.get('distribution').isdigit(): # type: ignore args['distribution'] = int(args['distribution']) elif isinstance(args.get('distribution'), str) and args['distribution'] in DISTRIBUTION_NUMBERS: args['distribution'] = DISTRIBUTION_NUMBERS.get(args['distribution']) else: return_error( "Distribution can be 'Your_organisation_only', " "'This_community_only', 'Connected_communities' or 'All_communities'" ) event = MISP.get_event(args.get('id')) # add attributes event.add_attribute(**args) MISP.update_event(event=event) if internal: return event = MISP.search(eventid=args.get('id')) md = f"## MISP add attribute\nNew attribute: {args.get('value')} was added to event id {args.get('id')}.\n" ec = { MISP_PATH: build_context(event) } demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['json'], 'Contents': {}, 'ReadableContentsFormat': formats['markdown'], 'HumanReadable': md, 'EntryContext': ec }) def download_file(): """ Will post results of given file's hash if present. MISP's response should be in case of success: (True, [EventID, filename, fileContent]) in case of failure: (False, 'No hits with the given parameters.') """ file_hash = demisto.args().get('hash') event_id = demisto.args().get('eventID') unzip = True if demisto.args().get('unzip') == 'true' else False all_samples = True if demisto.args().get('allSamples') in ('1', 'true') else False response = MISP.download_samples(sample_hash=file_hash, event_id=event_id, all_samples=all_samples, unzip=unzip ) if not response[0]: demisto.results(f"Couldn't find file with hash {file_hash}") else: if unzip: files = list() for f in response: # Check if it's tuple. if so, f = (EventID, hash, fileContent) if isinstance(f, tuple) and len(f) == 3: filename = f[1] files.append(fileResult(filename, f[2].getbuffer())) demisto.results(files) else: file_buffer = response[1][0][2].getbuffer() filename = response[1][0][1] demisto.results(fileResult(filename, file_buffer)) # type: ignore def get_urls_events(): urls = argToList(demisto.args().get('url'), ',') demisto.results(urls) for url in urls: check_url(url) def check_url(url): response = MISP.search(value=url, type_attribute='url') if response: dbot_list = list() md_list = list() url_list = list() for event_in_response in response: event = event_in_response.get('Event') dbot_score = get_dbot_level(event.get('threat_level_id')) misp_organisation = f"MISP.{event.get('Orgc').get('name')}" dbot_obj = { 'Indicator': url, 'Type': 'url', 'Vendor': 'MISP V2', 'Score': dbot_score } url_obj = { 'Data': url, } if dbot_score == 3: url_obj['Malicious'] = { 'Vendor': 'MISP V2', 'Description': f'IP Found in MISP event: {event.get("id")}' } md_obj = { 'EventID': event.get('id'), 'Threat Level': THREAT_LEVELS_WORDS[event.get('threat_level_id')], 'Organisation': misp_organisation } dbot_list.append(dbot_obj) md_list.append(md_obj) url_list.append(url_obj) outputs = { outputPaths.get('url'): url_list, outputPaths.get('dbotscore'): dbot_list, MISP_PATH: build_context(response) } md = tableToMarkdown(f'MISP Reputation for URL: {url}', md_list) else: md = f'No events found in MISP for URL: {url}' outputs = { outputPaths.get('dbotscore'): { 'Indicator': url, 'Type': DBotScoreType.URL, 'Vendor': 'MISP V2', 'Score': Common.DBotScore.NONE, }, } return_results(CommandResults( readable_output=md, outputs=outputs, raw_response=response, )) def build_misp_complex_filter(demisto_query: str) -> str: """ Args: demisto_query: complex query contains saved words: 'AND:', 'OR:' and 'NOT:' using ',' as delimiter for parameters and ';' as delimiter for operators. using the operators is optional. if 'demisto_query' does not contains any of the complex operators the original input will be returned Returns: str: dictionary created for misp to perform complex query or if no complex query found returns the original input Example: demisto_query should look like: example 1: "AND:param1,param2;OR:param3;NOT:param4,param5" example 2: "NOT:param3,param5" example 3 (simple syntax): "param1,param2" """ regex_and = r'(AND:)([^\;]+)(;)?' regex_or = r'(OR:)([^\;]+)(;)?' regex_not = r'(NOT:)([^\;]+)(;)?' misp_query_params = dict() is_complex_search = False match_and = re.search(regex_and, demisto_query, re.MULTILINE) match_or = re.search(regex_or, demisto_query, re.MULTILINE) match_not = re.search(regex_not, demisto_query, re.MULTILINE) if match_and is not None: misp_query_params['and_parameters'] = match_and.group(2).split(',') is_complex_search = True if match_or is not None: misp_query_params['or_parameters'] = match_or.group(2).split(',') is_complex_search = True if match_not is not None: misp_query_params['not_parameters'] = match_not.group(2).split(',') is_complex_search = True if is_complex_search: misp_complex_query = MISP.build_complex_query(**misp_query_params) return misp_complex_query return demisto_query def search(post_to_warroom: bool = True) -> Tuple[dict, Any]: """ will search in MISP Returns dict: Object with results to demisto: """ d_args = demisto.args() # List of all applicable search arguments search_args = [ 'event_id', 'value', 'type', 'category', 'org', 'tags', 'from', 'to', 'last', 'eventid', 'uuid', 'to_ids', 'enforceWarninglist', ] args = dict() # Create dict to pass into the search for arg in search_args: if arg in d_args: args[arg] = d_args[arg] # Replacing keys and values from Demisto to Misp's keys if 'type' in args: args['type_attribute'] = d_args.pop('type') # search function 'to_ids' parameter gets 0 or 1 instead of bool. if 'to_ids' in args: args['to_ids'] = 1 if d_args.get('to_ids') in ('true', '1', 1) else 0 # search function 'enforceWarninglist' parameter gets 0 or 1 instead of bool. if 'enforceWarninglist' in args: args['enforceWarninglist'] = 1 if d_args.get('enforceWarninglist') in ('true', '1', 1) else 0 # build MISP complex filter if 'tags' in args: args['tags'] = build_misp_complex_filter(args['tags']) response = MISP.search(**args) if response: response_for_context = build_context(response) # Prepare MD. getting all keys and values if exists args_for_md = {key: value for key, value in args.items() if value} if post_to_warroom: md = tableToMarkdown('Results in MISP for search:', args_for_md) md_event = response_for_context[0] md += f'Total of {len(response_for_context)} events found\n' event_highlights = { 'Info': md_event.get('Info'), 'Timestamp': convert_timestamp(md_event.get('Timestamp')), 'Analysis': ANALYSIS_WORDS[md_event.get('Analysis')], 'Threat Level ID': THREAT_LEVELS_WORDS[md_event.get('ThreatLevelID')], 'Event Creator Email': md_event.get('EventCreatorEmail'), 'Attributes': json.dumps(md_event.get('Attribute'), indent=4), 'Related Events': md_event.get('RelatedEvent') } md += tableToMarkdown(f'Event ID: {md_event.get("ID")}', event_highlights) if md_event.get('Galaxy'): md += tableToMarkdown('Galaxy:', md_event.get('Galaxy')) demisto.results({ 'Type': entryTypes['note'], 'Contents': response, 'ContentsFormat': formats['json'], 'HumanReadable': md, 'ReadableContentsFormat': formats['markdown'], 'EntryContext': { MISP_PATH: response_for_context } }) return response_for_context, response else: demisto.results(f"No events found in MISP for {args}") return {}, {} def search_attributes() -> Tuple[dict, Any]: """ Execute a MIPS search using the 'attributes' controller. """ d_args = demisto.args() # List of all applicable search arguments search_args = [ 'value', 'type', 'category', 'uuid', 'to_ids', 'last', 'include_decay_score', 'enforceWarninglist', ] args = dict() # Create dict to pass into the search for arg in search_args: if arg in d_args: args[arg] = d_args[arg] # Replacing keys and values from Demisto to Misp's keys if 'type' in args: args['type_attribute'] = d_args.pop('type') # search function 'to_ids' parameter gets 0 or 1 instead of bool. if 'to_ids' in args: args['to_ids'] = 1 if d_args.get('to_ids') in ('true', '1', 1) else 0 # search function 'enforceWarninglist' parameter gets 0 or 1 instead of bool. if 'enforceWarninglist' in args: args['enforceWarninglist'] = 1 if d_args.get('enforceWarninglist') in ('true', '1', 1) else 0 if 'include_decay_score' in args: args['includeDecayScore'] = 1 if d_args.get('include_decay_score') in ('true', '1', 1) else 0 # Set the controller to attributes to search for attributes and not events args['controller'] = 'attributes' response = MISP.search(**args) if response: response_for_context = build_attribute_context(copy.deepcopy(response)) md = f'## MISP attributes-search returned {len(response_for_context)} attributes.\n' # if attributes were returned, display one to the warroom to visualize the result: if len(response_for_context) > 0: md += tableToMarkdown(f'Attribute ID: {response_for_context[0].get("ID")}', response_for_context[0]) demisto.results({ 'Type': entryTypes['note'], 'Contents': response, 'ContentsFormat': formats['json'], 'HumanReadable': md, 'ReadableContentsFormat': formats['markdown'], 'EntryContext': { MISP_ATTRIBUTE_PATH: response_for_context } }) return response_for_context, response else: demisto.results(f"No attributes found in MISP for {args}") return {}, {} def delete_event(): """ Gets an event id and deletes it. """ event_id = demisto.args().get('event_id') event = MISP.delete_event(event_id) if 'errors' in event: return_error(f'Event ID: {event_id} has not found in MISP: \nError message: {event}') else: md = f'Event {event_id} has been deleted' demisto.results({ 'Type': entryTypes['note'], 'Contents': event, 'ContentsFormat': formats['json'], 'ReadableContentsFormat': formats['markdown'], 'HumanReadable': md }) def add_tag(): """ Function will add tag to given UUID of event or attribute. """ uuid = demisto.args().get('uuid') tag = demisto.args().get('tag') MISP.tag(uuid, tag) event = MISP.search(uuid=uuid) ec = { MISP_PATH: build_context(event) } md = f'Tag {tag} has been successfully added to event {uuid}' demisto.results({ 'Type': entryTypes['note'], 'Contents': event, 'ContentsFormat': formats['json'], 'ReadableContentsFormat': formats['markdown'], 'HumanReadable': md, 'EntryContext': ec }) def add_sighting(): """Adds sighting to MISP attribute """ sighting = { 'sighting': 0, 'false_positive': 1, 'expiration': 2 } kargs = { 'id': demisto.args().get('id'), 'uuid': demisto.args().get('uuid'), 'type': sighting.get(demisto.args().get('type')) } att_id = demisto.args().get('id', demisto.args().get('uuid')) if att_id: MISP.set_sightings(kargs) demisto.results(f'Sighting \'{demisto.args().get("type")}\' has been successfully added to attribute {att_id}') else: return_error('ID or UUID not specified') def test(): """ Test module. """ if MISP.test_connection(): demisto.results('ok') else: return_error('MISP has not connected.') def add_events_from_feed(): """Gets an OSINT feed from url and publishing them to MISP urls with feeds for example: `https://www.misp-project.org/feeds/` feed format must be MISP. """ headers = {'Accept': 'application/json'} url = demisto.getArg('feed') # type: str url = url[:-1] if url.endswith('/') else url if PREDEFINED_FEEDS.get(url): url = PREDEFINED_FEEDS[url].get('url') # type: ignore limit = demisto.getArg('limit') # type: str limit_int = int(limit) if limit.isdigit() else 0 osint_url = f'{url}/manifest.json' not_added_counter = 0 try: uri_list = requests.get(osint_url, verify=USE_SSL, headers=headers, proxies=proxies).json() events_numbers = list() # type: List[Dict[str, int]] for num, uri in enumerate(uri_list, 1): req = requests.get(f'{url}/{uri}.json', verify=USE_SSL, headers=headers, proxies=proxies).json() event = MISP.add_event(req) if 'id' in event: events_numbers.append({'ID': event['id']}) else: not_added_counter += 1 # If limit exists if limit_int == num: break entry_context = {MISP_PATH: events_numbers} human_readable = tableToMarkdown( f'Total of {len(events_numbers)} events was added to MISP.', events_numbers, headers='Event IDs' ) if not_added_counter: human_readable = f'{human_readable}\n' \ f'{not_added_counter} events were not added. Might already been added earlier.' return_outputs(human_readable, outputs=entry_context) except ValueError: return_error(f'URL [{url}] is not a valid MISP feed') def add_object(event_id: str, obj: MISPObject): """Sending object to MISP and returning outputs Args: obj: object to add to MISP event_id: ID of event """ response = MISP.add_object(event_id, misp_object=obj) if 'errors' in response: errors = extract_error(response["errors"]) error_string = str() for err in errors: error_string += f'\n\tError code: {err["code"]} ' \ f'\n\tMessage: {err["message"]}' \ f'\n\tErrors: {err["errors"]}\n' return_error(f'Error in `{command}` command: {error_string}') for ref in obj.ObjectReference: response = MISP.add_object_reference(ref) formatted_response = replace_keys(response) entry_context = { MISP_PATH: { 'ID': event_id } } entry_context[MISP_PATH].update(formatted_response) # type: ignore human_readable = f'Object has been added to MISP event ID {event_id}' return_outputs( human_readable, entry_context, response ) # type: ignore def add_email_object(): entry_id = demisto.getArg('entry_id') event_id = demisto.getArg('event_id') email_path = demisto.getFilePath(entry_id).get('path') obj = EMailObject(email_path) add_object(event_id, obj) def add_domain_object(): """Adds a domain object to MISP domain-ip description: https://www.misp-project.org/objects.html#_domain_ip """ template = 'domain-ip' args = [ 'text', 'creation_date', 'first_seen', 'last_seen' ] event_id = demisto.getArg('event_id') domain = demisto.getArg('name') obj = MISPObject(template) ips = argToList(demisto.getArg('dns')) for ip in ips: obj.add_attribute('ip', value=ip) obj.add_attribute('domain', value=domain) for arg in args: value = demisto.getArg(arg) if value: obj.add_attribute(arg, value=value) add_object(event_id, obj) def add_url_object(): """Building url object in MISP scheme Scheme described https://www.misp-project.org/objects.html#_url """ template = 'url' url_args = [ 'text', 'last_seen', 'first_seen' ] event_id = demisto.getArg('event_id') url = demisto.getArg('url') url_parse = urlparse(url) url_obj = [ {'url': url} ] if url_parse.scheme: url_obj.append({'scheme': url_parse.scheme}) if url_parse.path: url_obj.append({'resource_path': url_parse.path}) if url_parse.query: url_obj.append({'query_string': url_parse.query}) if url_parse.netloc: url_obj.append({'domain': url_parse.netloc}) if url_parse.fragment: url_obj.append({'fragment': url_parse.fragment}) if url_parse.port: url_obj.append({'port': url_parse.port}) if url_parse.username and url_parse.password: url_obj.append({'credential': (url_parse.username, url_parse.password)}) for arg in url_args: new_arg = demisto.getArg(arg) if new_arg: url_obj.append({arg.replace('_', '-'): new_arg}) g_object = build_generic_object(template, url_obj) add_object(event_id, g_object) def add_generic_object_command(): event_id = demisto.getArg('event_id') template = demisto.getArg('template') attributes = demisto.getArg('attributes') # type: str attributes = attributes.replace("'", '"') try: args = json.loads(attributes) if not isinstance(args, list): args = build_list_from_dict(args) obj = build_generic_object(template, args) add_object(event_id, obj) except ValueError as e: return_error(f'`attribute` parameter could not be decoded, may not a valid JSON\nattribute: {attributes}', str(e)) def add_ip_object(): template = 'ip-port' event_id = demisto.getArg('event_id') args = [ 'dst_port', 'src_port', 'domain', 'hostname', 'ip_src', 'ip_dst' ] attr = [{arg.replace('_', '-'): demisto.getArg(arg)} for arg in args if demisto.getArg(arg)] ips = argToList(demisto.getArg('ip')) for ip in ips: attr.append({'ip': ip}) if attr: non_req_args = [ 'first_seen', 'last_seen', ] attr.extend({arg.replace('_', '-'): demisto.getArg(arg)} for arg in non_req_args if demisto.getArg(arg)) if demisto.getArg('comment'): attr.append({'text': demisto.getArg('comment')}) obj = build_generic_object(template, attr) add_object(event_id, obj) else: return_error(f'None of required arguments presents. command {command} requires one of {args}') ''' COMMANDS MANAGER / SWITCH PANEL ''' command = demisto.command() def main(): LOG(f'command is {command}') demisto.info(f'command is {command}') try: if command == 'test-module': # This is the call made when pressing the integration test button. test() elif command == 'misp-upload-sample': upload_sample() elif command == 'misp-download-sample': download_file() elif command in ('internal-misp-create-event', 'misp-create-event'): create_event() elif command in ('internal-misp-add-attribute', 'misp-add-attribute'): add_attribute() elif command == 'misp-search': search() elif command == 'misp-search-attributes': search_attributes() elif command == 'misp-delete-event': delete_event() elif command == 'misp-add-sighting': add_sighting() elif command == 'misp-add-tag': add_tag() elif command == 'misp-add-events-from-feed': add_events_from_feed() elif command == 'file': get_files_events() elif command == 'url': get_urls_events() elif command == 'ip': get_ips_events() # Object commands elif command == 'misp-add-email-object': add_email_object() elif command == 'misp-add-domain-object': add_domain_object() elif command == 'misp-add-url-object': add_url_object() elif command == 'misp-add-ip-object': add_ip_object() elif command == 'misp-add-object': add_generic_object_command() except PyMISPError as e: return_error(e.message) except Exception as e: return_error(str(e)) if __name__ in ('__builtin__', 'builtins'): main() # TODO: in 5.0 # * Add !file (need docker change).