{"id":22180561,"url":"https://github.com/dcso/fn_misp_dcso","last_synced_at":"2025-10-12T20:31:01.414Z","repository":{"id":209446128,"uuid":"724066424","full_name":"DCSO/fn_misp_dcso","owner":"DCSO","description":null,"archived":false,"fork":false,"pushed_at":"2023-12-15T15:04:12.000Z","size":622,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-12-02T09:18:36.584Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DCSO.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2023-11-27T10:27:04.000Z","updated_at":"2023-12-07T14:42:52.000Z","dependencies_parsed_at":"2023-12-15T08:31:12.959Z","dependency_job_id":"7623e802-fe8c-46ac-8633-7d3a96219fd8","html_url":"https://github.com/DCSO/fn_misp_dcso","commit_stats":null,"previous_names":["dcso/fn_misp_dcso"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ffn_misp_dcso","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ffn_misp_dcso/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ffn_misp_dcso/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2Ffn_misp_dcso/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DCSO","download_url":"https://codeload.github.com/DCSO/fn_misp_dcso/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":236272997,"owners_count":19122531,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-02T09:18:39.499Z","updated_at":"2025-10-12T20:31:00.988Z","avatar_url":"https://github.com/DCSO.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!--\n  This README.md is generated by running:\n  \"resilient-sdk docgen -p fn_misp\"\n\n  It is best edited using a Text Editor with a Markdown Previewer. VS Code\n  is a good example. Checkout https://guides.github.com/features/mastering-markdown/\n  for tips on writing with Markdown\n\n  If you make manual edits and run docgen again, a .bak file will be created\n\n  Store any screenshots in the \"doc/screenshots\" directory and reference them like:\n  ![screenshot: screenshot_1](./screenshots/screenshot_1.png)\n--\u003e\n\n# fn-misp for IBM Resilient\n\n## Table of Contents\n- [Release Notes](#release-notes)\n- [Overview](#overview)\n  - [Key Features](#key-features)\n- [Installation](#installation)\n  - [Requirements](#requirements)\n  - [Install](#install)\n  - [App Configuration](#app-configuration)\n- [Function - MISP Create Event](#function---misp-create-event)\n- [Function - MISP Sighting List](#function---misp-sighting-list)\n- [Function - MISP Create Sighting](#function---misp-create-sighting)\n- [Function - MISP Search Attribute](#function---misp-search-attribute)\n- [Function - MISP Create Tag](#function---misp-create-tag)\n- [Function - MISP Create Attribute](#function---misp-create-attribute)\n- [Custom Fields](#custom-fields)\n- [Rules](#rules)\n- [Troubleshooting \u0026 Support](#troubleshooting-\u0026-support)\n---\n\n## Release Notes\n\u003c!--\n  Specify all changes in this release. Do not remove the release \n  notes of a previous release\n--\u003e\n### Version 3.0.1\n* App Host support\n* Proxy support\n\n### Version 3.0.0\n\n* There have been significant changes to the app for version 3, the community built a python3 compatible version of the app. This meant there was 2 different version in circulation.\n* This version of the app is designed to reunify the fn-misp apps. To support both python2 and python3 automatically - using the latest recommended libraries from the MISP community.\n* Finally, the Lookup Att\u0026ck function has been removed, as MISP now stores Att\u0026ck information as Tags - this is returned via the search attribute function, so no special function is required.\n* The old separate apps are packaged inside the app directory, marked as ARCHIVE. They are unsupported and just for code documentation purposes.\n\n### Version 1.6.1\n* Fixed Issue with verify certs\n* Added support for tags in search attribute\n* Workflow update to show use of parsing tags, e.g. TLP etc\n* Packaged as zip for easy install (no unzip required)\n\n### Version 1.5.1\n* Full documentation for Att\u0026ck Support\n\n### Version 1.5.0\n* Added MITRE Att\u0026ck support\n\n### Version 1.0.0\n* Initial Release\n\n---\n\n## Overview\n\u003c!--\n  Provide a high-level description of the function itself and its remote software or application.\n  The text below is parsed from the \"description\" and \"long_description\" attributes in the setup.py file\n--\u003e\n**Creates Events, Attributes and Sightings in MISP from incidents and artifacts in Resilient.**\n\nThe purpose of this package is to allow the creation of an event in MISP from an incident in Resilient.\nThis could represent a multiple-to-one or a one-to-one relationship. Once the event is created, attributes can be populated to it.\nFor artifacts which have a hit in MISP, one can create a sighting back to MISP to show threat intelligence teams the \nindicator has been seen in the wild. \nAdditional search functions allow one to search all attributes and return sightings from an event. \nThis package does not replace or supersede the MISP Custom Threat Service, the aim is to supplement it and create a \nbi-directional connection and integration. \nThe package is built in a flexible way so it can be used with any real rule or workflow configuration. \nSample rules and workflows are provided. \nCustom attribute types can be mapped from the workflow pre-processing script of the function. \nSee the sample workflows for sample payloads returned.\n\n### Key Features\n\u003c!--\n  List the Key Features of the Integration\n--\u003e\n* Create Events in MISP from Resilient Incidents\n* Add or list MISP sightings from Resilient\n* Create tags and attributes from Resilient Aritfacts\n\n---\n\n## Installation\n\n### Requirements\n\u003c!--\n  List any Requirements \n--\u003e\n* Resilient platform \u003e= `v35.2.32`\n* App Host \u003e= `v1.2.132` (if using App Host)\n  * To setup up an App Host see:  [ibm.biz/res-app-host-setup](https://ibm.biz/res-app-host-setup)\n* An Integration Server running `resilient_circuits\u003e=32.0` (if using an Integration Server)\n  * To set up an Integration Server see: [ibm.biz/res-int-server-guide](https://ibm.biz/res-int-server-guide)\n  * If using an API key account, minimum required permissions are:\n    | Name | Permissions |\n    | ---- | ----------- |\n    | Org Data | Read, Edit |\n    | Function | Read |\n* Proxy supported: Yes\n\n---\n\n### Install\n* To install or uninstall an App using the App Host see [ibm.biz/res-install-app](https://ibm.biz/res-install-app)\n\n* To install or uninstall an Integration using the Integration Server see the [ibm.biz/res-install-int](https://ibm.biz/res-install-int)\n---\n\n### App Configuration\nThe following table describes the settings you need to configure in the app.config file. If using App Host, see the Resilient System Administrator Guide. If using the integration server, see the Integration Server Guide.\n\n  | Config | Required | Example | Description |\n  | ------ | :------: | ------- | ----------- |\n  | **misp_url** | Yes | `10.10.10.10:5000` | *IP or URL of the MISP instance along with the http port* |\n  | **misp_key** | Yes | `someAPIkey` | *API key to access the MISP API* |\n  | **verify_cert** | Yes | `True` | *Secure connection* |\n  | **https_proxy** | No | https://your.proxy.com | *https proxy for connecting to MISP* |\n  | **http_proxy** | No | http://your.proxy.com | *http proxy for connecting to MISP* |\n\n---\n\n\n## Function - MISP Create Event\nCreate a MISP event from an incident\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_analysis_level` | `number` | No | `-` | initial =0, ongoing=1, complete=2 |\n| `misp_distribution` | `number` | No | `-` | Organization only=0 |\n| `misp_event_name` | `text` | Yes | `-` | - |\n| `misp_threat_level` | `number` | No | `-` | high=1, medium=2, low=3 |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n    \"success\": True,\n    \"content\": \n        {\n          \"Event\": {\n            \"id\": \"66\",\n            \"orgc_id\": \"1\",\n            \"org_id\": \"1\",\n            \"date\": \"2020-09-25\",\n            \"threat_level_id\": \"1\",\n            \"info\": \"Example Event\",\n            \"published\": false,\n            \"uuid\": \"17538fd2-54da-4280-bd98-25ba6723ea92\",\n            \"attribute_count\": \"0\",\n            \"analysis\": \"1\",\n            \"timestamp\": \"1601060754\",\n            \"distribution\": \"1\",\n            \"proposal_email_lock\": false,\n            \"locked\": false,\n            \"publish_timestamp\": \"0\",\n            \"sharing_group_id\": \"0\",\n            \"disable_correlation\": false,\n            \"extends_uuid\": \"\",\n            \"event_creator_email\": \"admin@admin.test\",\n            \"Org\": {\n              \"id\": \"1\",\n              \"name\": \"ORGNAME\",\n              \"uuid\": \"00e8cf4b-ba62-4edb-a990-90049cd53df2\",\n              \"local\": true\n            },\n            \"Orgc\": {\n              \"id\": \"1\",\n              \"name\": \"ORGNAME\",\n              \"uuid\": \"00e8cf4b-ba62-4edb-a990-90049cd53df2\",\n              \"local\": true\n            },\n            \"Attribute\": [],\n            \"ShadowAttribute\": [],\n            \"RelatedEvent\": [],\n            \"Galaxy\": [],\n            \"Object\": []\n          }\n        }       \n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  #inputs.misp_analysis_level = 0\n#inputs.misp_distribution = 0\n#inputs.misp_threat_level = 2\ninputs.misp_event_name = incident.name\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  # {'success': True, 'content': {'Event': {'id': '4', 'orgc_id': '1', 'org_id': '1', 'date': '2019-03-23', 'threat_level_id': '1', 'info': 'misp 2', 'published': False, 'uuid': '5c96475a-3170-48e7-b0b5-0138ac110002', 'attribute_count': '0', 'analysis': '2', 'timestamp': '1553352538', 'distribution': '0', 'proposal_email_lock': False, 'locked': False, 'publish_timestamp': '0', 'sharing_group_id': '0', 'disable_correlation': False, 'extends_uuid': '', 'event_creator_email': 'admin@admin.test', 'Org': {'id': '1', 'name': 'ORGNAME', 'uuid': '5c963124-caa0-4dee-a783-00b6ac110002'}, 'Orgc': {'id': '1', 'name': 'ORGNAME', 'uuid': '5c963124-caa0-4dee-a783-00b6ac110002'}, 'Attribute': [], 'ShadowAttribute': [], 'RelatedEvent': [], 'Galaxy': [], 'Object': []}}}\nincident.properties.misp_event_id = results.content['Event']['id']\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n## Function - MISP Sighting List\nList all sightings associated with an event\n\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_event_id` | `number` | No | `-` | - |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n          \"success\": true,\n          \"content\": [\n            {\n              \"Sighting\": {\n                \"id\": \"5\",\n                \"attribute_id\": \"5\",\n                \"event_id\": \"27\",\n                \"org_id\": \"1\",\n                \"date_sighting\": \"1601061492\",\n                \"uuid\": \"1ec3931f-c718-4913-9f45-b5ec5eb97ed4\",\n                \"source\": \"IBM Resilient SOAR\",\n                \"type\": \"0\"\n              },\n              \"Organisation\": {\n                \"name\": \"ORGNAME\"\n              }\n            }\n          ]\n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  inputs.misp_event_id = incident.properties.misp_event_id\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  content = results.content\nincident.addNote(u\"Sightings for associated event.\\n{}\".format(content))\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n## Function - MISP Create Sighting\nCreate a MISP sighting from an incident artifact\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_sighting` | `text` | No | `-` | - |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n          \"success\": true,\n          \"content\": {\n            \"Sighting\": {\n              \"id\": \"5\",\n              \"attribute_id\": \"5\",\n              \"event_id\": \"27\",\n              \"org_id\": \"1\",\n              \"date_sighting\": \"1601061492\",\n              \"uuid\": \"1ec3931f-c718-4913-9f45-b5ec5eb97ed4\",\n              \"source\": \"IBM Resilient SOAR\",\n              \"type\": \"0\"\n            }\n          }\n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  \n\ninputs.misp_sighting = artifact.value\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  # Result: {'success': True, 'content': {'message': 'Sighting added'}}\nexisting_description = artifact.description.content+'\\n' if artifact.description else \"\"\n\n#if results.content[0].get('errors'):\n#  artifact.description = u\"{}MISP Attribute failure: {}\".format(existing_description, results.content[0]['errors']['value'])\n#else:\nartifact.description = u\"{}MISP Attribute created: {}\".format(existing_description, results.content['message'])\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n## Function - MISP Search Attribute\nSearch MISP event attributes for a given match on an artifact\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_attribute_value` | `text` | No | `-` | - |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n            \"success\": true,\n            \"content\": [\n                {\n                  \"Event\": {\n                    \"id\": \"66\",\n                    \"orgc_id\": \"1\",\n                    \"org_id\": \"1\",\n                    \"date\": \"2020-09-25\",\n                    \"threat_level_id\": \"1\",\n                    \"info\": \"Example Event\",\n                    \"published\": false,\n                    \"uuid\": \"17538fd2-54da-4280-bd98-25ba6723ea92\",\n                    \"attribute_count\": \"1\",\n                    \"analysis\": \"1\",\n                    \"timestamp\": \"1601062027\",\n                    \"distribution\": \"1\",\n                    \"proposal_email_lock\": false,\n                    \"locked\": false,\n                    \"publish_timestamp\": \"0\",\n                    \"sharing_group_id\": \"0\",\n                    \"disable_correlation\": false,\n                    \"extends_uuid\": \"\",\n                    \"event_creator_email\": \"admin@admin.test\",\n                    \"Org\": {\n                      \"id\": \"1\",\n                      \"name\": \"ORGNAME\",\n                      \"uuid\": \"00e8cf4b-ba62-4edb-a990-90049cd53df2\",\n                      \"local\": true\n                    },\n                    \"Orgc\": {\n                      \"id\": \"1\",\n                      \"name\": \"ORGNAME\",\n                      \"uuid\": \"00e8cf4b-ba62-4edb-a990-90049cd53df2\",\n                      \"local\": true\n                    },\n                    \"Attribute\": [\n                      {\n                        \"id\": \"6\",\n                        \"type\": \"text\",\n                        \"category\": \"Other\",\n                        \"to_ids\": false,\n                        \"uuid\": \"b4e6230a-98a2-4935-9706-f5ebc6a1b628\",\n                        \"event_id\": \"66\",\n                        \"distribution\": \"5\",\n                        \"timestamp\": \"1601062027\",\n                        \"comment\": \"\",\n                        \"sharing_group_id\": \"0\",\n                        \"deleted\": false,\n                        \"disable_correlation\": false,\n                        \"object_id\": \"0\",\n                        \"object_relation\": null,\n                        \"first_seen\": null,\n                        \"last_seen\": null,\n                        \"value\": \"example attribute\",\n                        \"Galaxy\": [],\n                        \"ShadowAttribute\": []\n                      }\n                    ],\n                    \"ShadowAttribute\": [],\n                    \"RelatedEvent\": [],\n                    \"Galaxy\": [],\n                    \"Object\": []\n                  }\n                }\n              ],\n              \"tags\": []\n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  inputs.misp_attribute_value = artifact.value\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  # Result: {\"response\": {\"Attribute\": [{\"id\":\"3\",\"event_id\":\"3\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"ip-dst\",\"to_ids\":false,\"uuid\":\"666a6890-fddd-4a5d-a474-22c85c6a1ce5\",\"timestamp\":\"1553352781\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"value\":\"8.8.8.8\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"0\",\"id\":\"3\",\"info\":\"misp\",\"orgc_id\":\"1\",\"uuid\":\"5c96443b-1dcc-42fc-910a-01afac110002\"}}]}}\nexisting_description = artifact.description.content+'\\n' if artifact.description else \"\"\n\nif not results.success:\n  artifact.description = u\"{}No matching attribute found\".format(existing_description)\nelse:\n  matched = []\n  for match in results.content:\n      matched.append(u\"Event: {}, ID: {}, Tags: {}\".format(match['Event']['info'], match['Event']['id'], results.tags))\n\n  artifact.description = u\"{} Attribute Search Matches:\\n {}\".format(existing_description, '\\n'.join(matched))\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n## Function - MISP Create Tag\nCreates a Tag\n\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_attribute_value` | `text` | No | `-` | - |\n| `misp_event_id` | `number` | No | `-` | - |\n| `misp_tag_name` | `text` | No | `-` | - |\n| `misp_tag_type` | `select` | No | `-` | - |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n    \"success\": True\n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  inputs.misp_attribute_value = artifact.value\ninputs.misp_event_id = incident.properties.misp_event_id\ninputs.misp_tag_name = \"tlp:white\"\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  None\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n## Function - MISP Create Attribute\nCreate a MISP attribute from an incident artifact\n\n\u003cdetails\u003e\u003csummary\u003eInputs:\u003c/summary\u003e\n\u003cp\u003e\n\n| Name | Type | Required | Example | Tooltip |\n| ---- | :--: | :------: | ------- | ------- |\n| `misp_attribute_type` | `text` | No | `-` | - |\n| `misp_attribute_value` | `text` | No | `-` | - |\n| `misp_event_id` | `number` | No | `-` | - |\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eOutputs:\u003c/summary\u003e\n\u003cp\u003e\n\n```python\nresults = {\n            \"success\": true,\n              \"content\": {\n                \"Attribute\": {\n                  \"id\": \"7\",\n                  \"event_id\": \"6\",\n                  \"object_id\": \"0\",\n                  \"object_relation\": null,\n                  \"category\": \"Network activity\",\n                  \"type\": \"hostname\",\n                  \"value1\": \"ibm.com\",\n                  \"value2\": \"\",\n                  \"to_ids\": true,\n                  \"uuid\": \"943207c1-a8f1-40f1-9566-1eaa3c2fcfb9\",\n                  \"timestamp\": \"1601062824\",\n                  \"distribution\": \"5\",\n                  \"sharing_group_id\": \"0\",\n                  \"comment\": \"\",\n                  \"deleted\": false,\n                  \"disable_correlation\": false,\n                  \"first_seen\": null,\n                  \"last_seen\": null,\n                  \"value\": \"ibm.com\"\n                },\n                \"AttributeTag\": []\n              }\n}\n```\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eWorkflows\u003c/summary\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Pre-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  inputs.misp_attribute_value = artifact.value\ninputs.misp_event_id = incident.properties.misp_event_id\n\n\nresilient_to_misp_map = { \n    \"DNS Name\": \"domain\",\n    \"Email Attachment\": \"email-attachment\",\n    \"Email Body\": \"email-body\",\n    \"Email Recipient\": \"email-dst\",\n    \"Email Sender\": \"email-src\",\n    \"Email subject\": \"email-subject\",\n    \"File Name\": \"filename\",\n    \"DNS Name\": \"hostname\",\n    \"MAC Address\": \"mac-address\",\n    \"Malware MD5 Hash\": \"md5\",\n    \"Port\": \"port\",\n    \"Malware SHA-1 Hash\": \"sha1\",\n    \"Malware SHA-256 Hash\": \"sha256\",\n    \"URI Path\": \"uri\",\n    \"URL\": \"url\",\n    \"Threat CVE ID\": \"vulnerability\",\n    \"IP Address\": \"ip-dst\"\n}\n\ntry:\n  misp_type = resilient_to_misp_map[artifact.type]\n  inputs.misp_attribute_type = misp_type\nexcept Exception, e:\n  helper.fail(u\"You do not have this artifact type {} mapped to a type in MISP - Ask your Admin\".format(artifact.value))\n  raise e \n\n\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n  \u003cdetails\u003e\u003csummary\u003eExample Post-Process Script:\u003c/summary\u003e\n  \u003cp\u003e\n\n  ```python\n  # Result: {'success': True, 'content': [{'Attribute': {'id': '3', 'event_id': '3', 'object_id': '0', 'object_relation': None, 'category': 'Network activity', 'type': 'ip-dst', 'value1': '8.8.8.8', 'value2': '', 'to_ids': False, 'uuid': '666a6890-fddd-4a5d-a474-22c85c6a1ce5', 'timestamp': '1553352781', 'distribution': '5', 'sharing_group_id': '0', 'comment': '', 'deleted': False, 'disable_correlation': False, 'value': '8.8.8.8'}}]}\n# Result: {'success': True, 'content': [{'name': 'Could not add Attribute', 'message': 'Could not add Attribute', 'url': '/attributes/add', 'errors': {'value': ['A similar attribute already exists for this event.']}}]}\nexisting_description = artifact.description.content+'\\n' if artifact.description else \"\"\n\nif results.content[0].get('errors'):\n  artifact.description = u\"{}MISP Attribute failure: {}\".format(existing_description, results.content[0]['errors']['value'])\nelse:\n  artifact.description = u\"{}MISP Attribute created: {}\".format(existing_description, results.content[0]['Attribute']['category'])\n  ```\n\n  \u003c/p\u003e\n  \u003c/details\u003e\n\n\u003c/details\u003e\n\n---\n\n\n\n## Custom Fields\n| Label | API Access Name | Type | Prefix | Placeholder | Tooltip |\n| ----- | --------------- | ---- | ------ | ----------- | ------- |\n| MISP Event Id | `misp_event_id` | `text` | `properties` | - | - |\n\n---\n\n\n## Rules\n| Rule Name | Object | Workflow Triggered |\n| --------- | ------ | ------------------ |\n| Example: Create MISP Event | incident | `example_misp_create_event` |\n| Example: MISP Sighting List | incident | `example_misp_sighting_list` |\n| Example: Create MISP Sighting | artifact | `example_misp_create_sighting` |\n| Example: Create MISP Attribute | artifact | `example_misp_create_attribute` |\n| Example: MISP Search Attribute | artifact | `example_misp_search_attribute` |\n\n---\n\n## Troubleshooting \u0026 Support\nIf using the app with an App Host, see the Resilient System Administrator Guide and the App Host Deployment Guide for troubleshooting procedures. You can find these guides on the [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SSBRUQ), where you can select which version of the Resilient platform you are using.\n\nIf using the app with an integration server, see the [Integration Server Guide](https://ibm.biz/res-int-server-guide)\n\n### For Support\nThis is a IBM Community Provided App. Please search the Community https://ibm.biz/resilientcommunity for assistance.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ffn_misp_dcso","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdcso%2Ffn_misp_dcso","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ffn_misp_dcso/lists"}