https://github.com/eset/eti
Last synced: about 1 month ago
JSON representation
- Host: GitHub
- URL: https://github.com/eset/eti
- Owner: eset
- License: bsd-2-clause
- Created: 2024-11-05T21:41:48.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2025-10-02T18:53:50.000Z (10 months ago)
- Last Synced: 2025-10-24T21:01:50.661Z (10 months ago)
- Language: Jupyter Notebook
- Size: 9.77 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Table of Contents
=================
* [ETI scripts](#eti-scripts)
* [YARA extractor](#yara-extractor)
* [Threat Actor's Region extractor](#threat-actors-region-extractor)
* [Examples of common queries](#examples-of-common-queries)
## ETI scripts
Collection of scripts to interact with ESET MISP instance.
### YARA extractor
[Script](./extract_yara_from_misp.py) to extract yara rules from MISP for a given event or ESET Threat Actor.
Usage:
`python extract_yara_from_misp.py -e EVENT_ID`
`python extract_yara_from_misp.py -g "GROUP NAME"`
`python extract_yara_from_misp.py -a` (extracts all yara rules)
### Threat Actor's Region extractor
[Script](./extract_threat_actor_country.py) to extract Threat Actor's region
from MISP for a given event.
Usage:
`python extract_threat_actor_country.py -e EVENT_ID`
### Examples of common queries
[Examples.ipynb](./Examples.ipynb) is a Jupyter Notebook (https://jupyter.org)
is inspired from PyMISP doc and examples
(https://github.com/MISP/PyMISP/tree/main/examples) and contains the whole
setup and few queries allowing to start playing with ESET MISP instance.