PyMISP
PyMISP copied to clipboard
Feature Request: Mark taxonomies as required via PyMISP
Hi,
I'm trying to write a Python script to take a clean install of MISP to a fully configured production instnace, the bit I'm currently stuck on is making a taxonomy required.
This is where I've got to so far, any advice on the last step of pushing the required taxonomy back to MISP - or another way of doing so woud be appreciatd.
Thanks
from pymisp import PyMISP
AuthKey = "***"
MISP = PyMISP("https://misp.***", AuthKey)
MISP.update_taxonomies()
ToEnable = ["admiralty-scale", "PAP", "tlp"]
ToRequire = ["tlp"]
for taxonomy in MISP.taxonomies(True):
if taxonomy.namespace in ToEnable:
MISP.enable_taxonomy(taxonomy.id)
MISP.enable_taxonomy_tags(taxonomy.id)
if taxonomy.namespace in ToRequire:
taxonomy.required = True
# TODO Push back to MISP
Currently PyMISP doesn't have the ability to enable this, but it's a very simple fix to make. I'm happy to take a look at this for you, might take me a few days to get around to it.
If you fancy the challenge (the MISP team always welcome new contributors!), a new function is required in PyMISP that performs a GET request to /taxonomies/toggleRequired/<id>
, where id
is the ID of the taxonomy local to the MISP instance. It's a toggle, so creating one of the two functions would be sufficient:
- Function of
toggle_taxonomy(taxonomy: MISPTaxonomy)
to toggle, handling the check in your own code - Function of
set_taxonomy_required(taxonomy: MISPTaxonomy, required: bool)
which only toggles if the taxonomy flag is differs to therequired
param.
Let me know if you want to take it on yourself.
@JoeP-oss,
I had a bit of time to look into this further and have added this functionality into PyMISP, please refer to the PR above. Once merged and released, you will be able to do something like this (continuing on your script):
from pymisp import PyMISP
AuthKey = "***"
MISP = PyMISP("https://misp.***", AuthKey)
MISP.update_taxonomies()
ToEnable = ["admiralty-scale", "PAP", "tlp"]
ToRequire = ["tlp"]
for taxonomy in MISP.taxonomies(True):
if taxonomy.namespace in ToEnable:
MISP.enable_taxonomy(taxonomy.id)
MISP.enable_taxonomy_tags(taxonomy.id)
if taxonomy.namespace in ToRequire and not taxonomy.required:
MISP.set_taxonomy_required(taxonomy, True)
# Optional - Only if you require the up-to-date taxonomy with the correct flag
taxonomy = MISP.get_taxonomy(taxonomy)
Merged, thank you @tomking2 !