or run

tessl search
Log in

Version

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/pymisp@2.5.x

evals

scenario-10

rubric.jsontask.md
tile.json

tessl/pypi-pymisp

tessl install tessl/pypi-pymisp@2.5.0

Python API for MISP threat intelligence platform enabling programmatic access to MISP instances.

Agent Success

Agent success rate when using this tile

96%

Improvement

Agent success rate improvement when using this tile compared to baseline

1.25x

Baseline

Agent success rate without this tile

77%

task.mdevals/scenario-10/

Threat Intelligence Object Manager

Build a threat intelligence object management system that creates, links, and manages structured security artifacts for a threat intelligence platform.

Overview

Your system should help analysts document phishing campaigns by creating structured objects that represent emails, files, and domain infrastructure, then establish relationships between these objects to map the attack flow.

Capabilities

Object Creation

Create structured objects for different security artifacts:

  • Create an email object with sender, recipient, and subject fields @test
  • Create a file object with filename and hash values @test
  • Create a domain-ip object linking a domain to its IP address @test

Object Relationships

Establish connections between related security artifacts:

  • Link a file object to an email object with an "attachment" relationship @test
  • Link a domain object to an email object with a "sender-infrastructure" relationship @test

Template Discovery

Query available object templates to understand supported object types:

  • List all available object templates @test
  • Retrieve details of the "email" template including its required and optional attributes @test

Object Retrieval

Fetch created objects with their relationships:

  • Retrieve an object by its ID including its references to other objects @test

Implementation

@generates

API

class ThreatIntelligenceObjectManager:
    """Manages threat intelligence objects and their relationships."""

    def __init__(self, misp_url: str, api_key: str):
        """
        Initialize the object manager.

        Parameters:
        - misp_url: URL of the MISP instance
        - api_key: API key for authentication
        """
        pass

    def create_email_object(self, event_id: int, sender: str, recipient: str, subject: str) -> dict:
        """
        Create an email object within an event.

        Parameters:
        - event_id: ID of the event to add the object to
        - sender: Email sender address
        - recipient: Email recipient address
        - subject: Email subject line

        Returns:
        Dictionary containing the created object with its ID and UUID
        """
        pass

    def create_file_object(self, event_id: int, filename: str, md5: str, sha1: str) -> dict:
        """
        Create a file object within an event.

        Parameters:
        - event_id: ID of the event to add the object to
        - filename: Name of the file
        - md5: MD5 hash of the file
        - sha1: SHA1 hash of the file

        Returns:
        Dictionary containing the created object with its ID and UUID
        """
        pass

    def create_domain_ip_object(self, event_id: int, domain: str, ip: str) -> dict:
        """
        Create a domain-ip object within an event.

        Parameters:
        - event_id: ID of the event to add the object to
        - domain: Domain name
        - ip: IP address associated with the domain

        Returns:
        Dictionary containing the created object with its ID and UUID
        """
        pass

    def link_objects(self, source_uuid: str, target_uuid: str, relationship: str) -> dict:
        """
        Create a reference between two objects.

        Parameters:
        - source_uuid: UUID of the source object
        - target_uuid: UUID of the target object (the object being referenced)
        - relationship: Type of relationship (e.g., "attachment", "sender-infrastructure")

        Returns:
        Dictionary containing the created reference
        """
        pass

    def list_templates(self) -> list:
        """
        Get all available object templates.

        Returns:
        List of object template definitions
        """
        pass

    def get_template_details(self, template_name: str) -> dict:
        """
        Get detailed information about a specific object template.

        Parameters:
        - template_name: Name of the template (e.g., "email", "file")

        Returns:
        Dictionary containing template details including attributes and requirements
        """
        pass

    def get_object_with_references(self, object_id: int) -> dict:
        """
        Retrieve an object including its references to other objects.

        Parameters:
        - object_id: ID of the object to retrieve

        Returns:
        Dictionary containing the object data with references included
        """
        pass

Dependencies { .dependencies }

pymisp { .dependency }

Python library for interacting with MISP (Malware Information Sharing Platform) threat intelligence platform.