or run

tessl search
Log in

Version

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/pymisp@2.5.x

evals

scenario-4

rubric.jsontask.md
tile.json

tessl/pypi-pymisp

tessl install tessl/pypi-pymisp@2.5.0

Python API for MISP threat intelligence platform enabling programmatic access to MISP instances.

Agent Success

Agent success rate when using this tile

96%

Improvement

Agent success rate improvement when using this tile compared to baseline

1.25x

Baseline

Agent success rate without this tile

77%

task.mdevals/scenario-4/

Threat Intelligence Event Builder

A command-line tool for creating and managing threat intelligence events with indicators and structured threat objects.

Capabilities

Event Creation and Management

  • Creates a new threat intelligence event with basic metadata (title, distribution level, threat level, analysis status) @test
  • Adds multiple IP address indicators to an event with appropriate categorization @test
  • Adds file hash indicators (MD5, SHA1, SHA256) to an event with proper typing @test

Structured Object Support

  • Creates a file object containing multiple hash attributes with proper relationships @test
  • Adds the file object to the event and ensures it's properly attached @test

Data Serialization

  • Converts the complete event structure to JSON format for storage or transmission @test
  • Reconstructs an event from JSON data preserving all attributes and objects @test

Implementation

@generates

API

class ThreatEventBuilder:
    """Builder for creating threat intelligence events with indicators and objects."""

    def __init__(self):
        """Initialize a new threat event builder."""
        pass

    def create_event(self, title: str, distribution: int = 0, threat_level: int = 2, analysis: int = 0):
        """
        Create a new threat intelligence event.

        Args:
            title: The event title/description
            distribution: Distribution level (0=Your org only, 1=This community, 2=Connected communities, 3=All communities)
            threat_level: Threat level (1=High, 2=Medium, 3=Low, 4=Undefined)
            analysis: Analysis status (0=Initial, 1=Ongoing, 2=Complete)

        Returns:
            Self for method chaining
        """
        pass

    def add_ip_attribute(self, ip_address: str, category: str = "Network activity", comment: str = ""):
        """
        Add an IP address indicator to the event.

        Args:
            ip_address: The IP address value
            category: Attribute category (default: "Network activity")
            comment: Optional comment about the indicator

        Returns:
            Self for method chaining
        """
        pass

    def add_hash_attribute(self, hash_value: str, hash_type: str, category: str = "Payload delivery", comment: str = ""):
        """
        Add a file hash indicator to the event.

        Args:
            hash_value: The hash value
            hash_type: Hash type ("md5", "sha1", "sha256")
            category: Attribute category (default: "Payload delivery")
            comment: Optional comment about the indicator

        Returns:
            Self for method chaining
        """
        pass

    def add_file_object(self, filename: str, md5: str = None, sha1: str = None, sha256: str = None, size: int = None):
        """
        Add a structured file object to the event.

        Args:
            filename: The filename
            md5: MD5 hash (optional)
            sha1: SHA1 hash (optional)
            sha256: SHA256 hash (optional)
            size: File size in bytes (optional)

        Returns:
            Self for method chaining
        """
        pass

    def to_json(self) -> str:
        """
        Serialize the event to JSON format.

        Returns:
            JSON string representation of the event
        """
        pass

    def from_json(self, json_str: str):
        """
        Load an event from JSON format.

        Args:
            json_str: JSON string representation of an event

        Returns:
            Self for method chaining
        """
        pass

    def get_event(self):
        """
        Get the underlying event object.

        Returns:
            The event object
        """
        pass

Dependencies { .dependencies }

pymisp { .dependency }

Provides data structures and models for MISP threat intelligence events, attributes, and objects.