{
  "context": "This criteria evaluates how well the engineer uses PyMISP's external service integration capabilities, specifically for enriching MISP events with VirusTotal reputation data. The focus is on proper usage of PyMISP's connection management, event retrieval, VirusTotal integration methods, and enrichment record creation.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "MISP Connection Setup",
      "description": "Uses PyMISP's connection class (PyMISP or ExpandedPyMISP) with proper initialization parameters (URL and API key). Should instantiate the connection object correctly to establish authenticated communication with the MISP instance.",
      "max_score": 15
    },
    {
      "name": "Event Retrieval",
      "description": "Uses PyMISP's get_event() method or similar event retrieval function to fetch the event by ID. Should properly handle the event object and access its attributes.",
      "max_score": 15
    },
    {
      "name": "Attribute Extraction",
      "description": "Correctly accesses and filters attributes from the retrieved event to identify IOCs that need enrichment (file hashes and URLs). Should iterate through event.Attribute or event.attributes to extract relevant indicators based on their type.",
      "max_score": 15
    },
    {
      "name": "VirusTotal Integration",
      "description": "Uses PyMISP's VirusTotal integration functionality (methods like get_virustotal() or virustotal methods on the PyMISP object) to query VirusTotal for IOC reputation data. Should pass the appropriate parameters (IOC value and API key) to the VirusTotal query methods.",
      "max_score": 25
    },
    {
      "name": "Enrichment Record Creation",
      "description": "Creates enrichment records or sightings in MISP using appropriate PyMISP methods (such as add_sighting(), add_attribute(), or object creation methods) to link the VirusTotal reputation data back to the original attributes. Should properly structure the enrichment data including detection ratios and service information.",
      "max_score": 20
    },
    {
      "name": "Error Handling",
      "description": "Implements proper error handling for PyMISP operations including checking for PyMISP exceptions, handling API errors, validating event existence, and managing VirusTotal API failures using PyMISP's error response patterns.",
      "max_score": 10
    }
  ]
}