or run

tessl search
Log in

Version

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/pymisp@2.5.x

evals

scenario-8

rubric.jsontask.md
tile.json

tessl/pypi-pymisp

tessl install tessl/pypi-pymisp@2.5.0

Python API for MISP threat intelligence platform enabling programmatic access to MISP instances.

Agent Success

Agent success rate when using this tile

96%

Improvement

Agent success rate improvement when using this tile compared to baseline

1.25x

Baseline

Agent success rate without this tile

77%

task.mdevals/scenario-8/

MISP Event Management Tool

Build a simple command-line tool for managing threat intelligence events in a MISP instance. The tool should support creating, retrieving, updating, publishing, and deleting events.

Requirements

The tool should implement the following functionality:

  1. Event Creation: Create a new threat intelligence event with a descriptive title, threat level, and distribution settings
  2. Event Retrieval: Retrieve and display event details by ID or UUID
  3. Event Updates: Update an existing event's information and metadata
  4. Event Publishing: Publish an event to make it available for sharing
  5. Event Deletion: Delete an event from the MISP instance

Implementation Details

Create a Python module event_manager.py that provides the following functions:

  • A function to initialize a connection to a MISP instance
  • A function to create a new event with specified parameters
  • A function to retrieve an event by its identifier
  • A function to update an event's properties
  • A function to publish an event
  • A function to delete an event

Each function should properly handle errors and return appropriate success/failure indicators.

Test Cases

  • Creating a new event with title "Malware Campaign X" and threat level "high" returns a valid event with an ID @test
  • Retrieving an event by its ID returns the event details including title and threat level @test
  • Updating an event's title from "Original" to "Updated" successfully modifies the event @test
  • Publishing an unpublished event changes its published status to True @test
  • Deleting an event by ID removes it from the instance @test

API

from typing import Optional, Dict, Any

def init_connection(url: str, api_key: str) -> Any:
    """
    Initialize connection to MISP instance.

    Args:
        url: MISP instance URL
        api_key: API authentication key

    Returns:
        Connected MISP client instance
    """

def create_event(client: Any, info: str, threat_level: str, distribution: int = 1) -> Dict[str, Any]:
    """
    Create a new event in MISP.

    Args:
        client: MISP client instance
        info: Event description/title
        threat_level: Threat level (high, medium, low, undefined)
        distribution: Distribution level (0-4)

    Returns:
        Created event data with id and other properties
    """

def get_event(client: Any, event_id: Any) -> Dict[str, Any]:
    """
    Retrieve event by ID or UUID.

    Args:
        client: MISP client instance
        event_id: Event ID or UUID

    Returns:
        Event details dictionary
    """

def update_event(client: Any, event_id: Any, **updates) -> Dict[str, Any]:
    """
    Update an existing event.

    Args:
        client: MISP client instance
        event_id: Event ID or UUID
        **updates: Key-value pairs of properties to update

    Returns:
        Updated event data
    """

def publish_event(client: Any, event_id: Any, send_alert: bool = False) -> bool:
    """
    Publish an event for distribution.

    Args:
        client: MISP client instance
        event_id: Event ID or UUID
        send_alert: Whether to send email alerts

    Returns:
        True if successful, False otherwise
    """

def delete_event(client: Any, event_id: Any) -> bool:
    """
    Delete an event from MISP.

    Args:
        client: MISP client instance
        event_id: Event ID or UUID

    Returns:
        True if successful, False otherwise
    """

@generates

Dependencies { .dependencies }

pymisp { .dependency }

Python library for interacting with MISP threat intelligence platform.

@satisfied-by