or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

attribute-management.mdcore-api.mddata-models.mdevent-management.mdindex.mdobject-generators.mdobject-management.mdsearch-query.mdserver-sync.mdtag-taxonomy.mduser-org-management.md
tile.json

tessl/pypi-pymisp

Python API for MISP threat intelligence platform enabling programmatic access to MISP instances.

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/pymisp@2.5.x

To install, run

npx @tessl/cli install tessl/pypi-pymisp@2.5.0

index.mddocs/

PyMISP

A comprehensive Python library for programmatic access to MISP (Malware Information Sharing Platform) instances via their REST API. PyMISP enables cybersecurity professionals to automate threat intelligence sharing, manage events and attributes, perform complex searches, and integrate MISP functionality into security workflows.

Package Information

  • Package Name: pymisp
  • Language: Python
  • Installation: pip install pymisp
  • Optional Dependencies: pip install pymisp[fileobjects,virustotal,email,pdfexport]

Core Imports

from pymisp import PyMISP

For specific components:

from pymisp import (
    PyMISP, MISPEvent, MISPAttribute, MISPObject, 
    MISPUser, MISPOrganisation, MISPTag
)

Basic Usage

from pymisp import PyMISP, MISPEvent, MISPAttribute

# Initialize PyMISP client
misp = PyMISP('https://your-misp-instance.com', 'your-api-key', ssl=True)

# Get recent events
events = misp.search(timestamp='5d', limit=10)

# Create a new event
event = MISPEvent()
event.info = "Suspicious Activity Detected"
event.distribution = 1  # Community only
event.threat_level_id = 2  # Medium

# Add event to MISP
response = misp.add_event(event)

# Add an attribute
attribute = MISPAttribute()
attribute.type = 'ip-dst'
attribute.value = '192.168.1.100'
attribute.comment = 'Malicious IP address'

misp.add_attribute(event_id, attribute)

# Search for specific indicators
results = misp.search(value='192.168.1.100', type_attribute='ip-dst')

Architecture

PyMISP provides a multi-layered architecture for MISP interaction:

  • PyMISP Client: Main API interface handling authentication and HTTP communication
  • Data Model Objects: Rich Python objects representing MISP entities (events, attributes, objects, users)
  • Object Generators: Specialized tools for creating structured threat intelligence objects
  • Search & Filter System: Comprehensive querying capabilities across all MISP data types
  • Synchronization Tools: Multi-server data sharing and federation support

This design enables both simple one-off queries and complex automated threat intelligence workflows.

Capabilities

Core API Client

The main PyMISP class providing comprehensive REST API access to MISP instances, including event management, searching, user administration, and server synchronization.

class PyMISP:
    def __init__(self, url: str, key: str, ssl: bool = True, debug: bool = False) -> None: ...
    
    # Properties
    @property
    def version(self) -> str: ...
    @property
    def misp_instance_version(self) -> dict: ...

Core API Client

Event Management

Comprehensive event lifecycle management including creation, modification, publishing, and deletion of MISP events with full attribute and object support.

def events(self, **kwargs) -> list: ...
def get_event(self, event_id: int | str, **kwargs) -> dict: ...
def add_event(self, event: MISPEvent | dict, **kwargs) -> dict: ...
def update_event(self, event: MISPEvent | dict, **kwargs) -> dict: ...
def delete_event(self, event_id: int | str) -> dict: ...
def publish(self, event_id: int | str) -> dict: ...

Event Management

Attribute Management

Detailed attribute handling for managing indicators and observables within events, including attribute creation, updates, and validation.

def attributes(self, **kwargs) -> list: ...
def get_attribute(self, attribute_id: int | str) -> dict: ...
def add_attribute(self, event_id: int | str, attribute: MISPAttribute | dict, **kwargs) -> dict: ...
def update_attribute(self, attribute: MISPAttribute | dict, **kwargs) -> dict: ...
def delete_attribute(self, attribute_id: int | str) -> dict: ...

Attribute Management

Object Management

MISP object handling for structured threat intelligence data including file objects, network objects, and custom object types.

def get_object(self, object_id: int | str) -> dict: ...
def add_object(self, event_id: int | str, misp_object: MISPObject | dict, **kwargs) -> dict: ...
def update_object(self, misp_object: MISPObject | dict, **kwargs) -> dict: ...
def delete_object(self, object_id: int | str) -> dict: ...
def object_templates(self) -> list: ...

Object Management

Search & Query

Powerful search capabilities across events, attributes, sightings, and other MISP data with complex filtering and correlation support.

def search(self, **kwargs) -> list: ...
def search_index(self, **kwargs) -> list: ...
def search_sightings(self, **kwargs) -> list: ...
def search_logs(self, **kwargs) -> list: ...
def search_tags(self, **kwargs) -> list: ...

Search & Query

Data Model Classes

Rich Python objects representing all MISP entities with validation, serialization, and relationship management capabilities.

class MISPEvent(AbstractMISP): ...
class MISPAttribute(AbstractMISP): ...
class MISPObject(AbstractMISP): ...
class MISPUser(AbstractMISP): ...
class MISPOrganisation(AbstractMISP): ...

Data Model Classes

User & Organization Management

Complete user account and organization administration including roles, permissions, and settings management.

def users(self, **kwargs) -> list: ...
def get_user(self, user_id: int | str) -> dict: ...
def add_user(self, user: MISPUser | dict, **kwargs) -> dict: ...
def organisations(self, **kwargs) -> list: ...
def get_organisation(self, org_id: int | str) -> dict: ...

User & Organization Management

Object Generators & Tools

Specialized object creation tools for generating structured threat intelligence objects from various data sources.

class FileObject(AbstractMISPObjectGenerator): ...
class URLObject(AbstractMISPObjectGenerator): ...
class EmailObject(AbstractMISPObjectGenerator): ...
class VTReportObject(AbstractMISPObjectGenerator): ...

Object Generators & Tools

Server & Synchronization

Multi-server synchronization and federation capabilities for sharing threat intelligence across MISP instances.

def servers(self, **kwargs) -> list: ...
def add_server(self, server: MISPServer | dict) -> dict: ...
def server_pull(self, server_id: int | str, **kwargs) -> dict: ...
def server_push(self, server_id: int | str, **kwargs) -> dict: ...

Server & Synchronization

Tag & Taxonomy Management

Comprehensive tagging and classification system management including taxonomies, warning lists, and custom tags.

def tags(self, **kwargs) -> list: ...
def add_tag(self, tag: MISPTag | dict, **kwargs) -> dict: ...
def taxonomies(self, **kwargs) -> list: ...
def warninglists(self, **kwargs) -> list: ...

Tag & Taxonomy Management