### MISP STIX Structured Data Example (JSON) Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_objects_to_stix21.md This JSON example shows structured data within MISP, including parent directory references, content references, and attachment details with base64 encoded data. ```json { "parent_directory_ref": "directory--34cb1a7c-55ec-412a-8684-ba4a88d83a45", "content_ref": "artifact--91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "x_misp_attachment": { "value": "non", "data": "Tm9uLW1hbGljaW91cyBmaWxlCg==" } } ``` -------------------------------- ### Convert X.509 SHA1 Fingerprint from MISP JSON to STIX XML Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix1.md This example demonstrates the conversion of an X.509 SHA1 fingerprint from MISP's JSON format to STIX XML. Similar to the MD5 example, it shows how MISP attributes are mapped to STIX Indicator and Observable objects, specifically capturing the SHA1 signature algorithm and value. ```json { "uuid": "518b4bcb-a86b-4783-9457-391d548b605b", "type": "x509-fingerprint-sha1", "category": "Payload delivery", "value": "46aba99aa7158e4609aaa72b50990842fd22ae86", "timestamp": "1603642920", "comment": "X509 SHA1 fingerprint test attribute", "to_ids": true } ``` ```xml Payload delivery: 46aba99aa7158e4609aaa72b50990842fd22ae86 (MISP Attribute) Malware Artifacts X509 SHA1 fingerprint test attribute SHA1 46aba99aa7158e4609aaa72b50990842fd22ae86 ``` -------------------------------- ### Convert MISP Regkey to STIX Indicator Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix20.md This example demonstrates the conversion of a MISP 'regkey' attribute to a STIX 'indicator'. It maps the registry key path to the STIX 'windows-registry-key' object and constructs the appropriate pattern for detection. ```json { "type": "indicator", "id": "indicator--91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "description": "Regkey test attribute", "pattern": "[windows-registry-key:key = 'HKLM\\\\Software\\\\mthjk']", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Persistence mechanism" } ], "labels": [ "misp:type=\"regkey\"", "misp:category=\"Persistence mechanism\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### Convert MISP Regkey|value to STIX Indicator Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix20.md This example shows the conversion of a MISP 'regkey|value' attribute into a STIX 'indicator'. It maps both the registry key and its associated value data into a comprehensive STIX pattern. ```json { "type": "indicator", "id": "indicator--91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "description": "Regkey | value test attribute", "pattern": "[windows-registry-key:key = 'HKLM\\\\Software\\\\mthjk' AND windows-registry-key:values.data = '\\%DATA\\\\%\\\\1234567890']", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Persistence mechanism" } ], "labels": [ "misp:type=\"regkey|value\"", "misp:category=\"Persistence mechanism\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### Convert MISP Registry Key to STIX Indicator Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix1.md This example demonstrates the conversion of a MISP 'regkey' attribute into a STIX Indicator. It maps the registry key path and associated metadata like comments and confidence levels. ```json { "uuid": "91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "type": "regkey", "category": "Persistence mechanism", "value": "HKLM\\Software\\mthjk", "timestamp": "1603642920", "comment": "Regkey test attribute", "to_ids": true } ``` ```xml Persistence mechanism: HKLM\Software\mthjk (MISP Attribute) Host Characteristics Regkey test attribute HKLM\Software\mthjk High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none MISP ``` -------------------------------- ### MISP File Hash to STIX Conversion Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix1.md Shows the conversion of a MISP file hash attribute into STIX format. This example includes the indicator title, type, description, and observable details including file hashes like SHA1. ```xml Payload delivery: 38b01861f223a9ae2cc2a0388cef222a9730d438 (MISP Attribute) File Hash Watchlist cdhash test attribute SHA1 68b01861f223a9ae2cc2a0688cef222a9730d468 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none MISP ``` -------------------------------- ### Convert MISP email-header to STIX Indicator Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix20.md This example demonstrates transforming a MISP 'email-header' into a STIX 'indicator'. The email header content is captured in the 'pattern' field using STIX AQL syntax. MISP labels are preserved in the 'labels' field. ```json { "type": "indicator", "id": "indicator--91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "pattern": "[email-message:received_lines = 'from mail.example.com ([198.51.100.3]) by smtp.gmail.com']", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-header\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### STIX 2.1 Observed Data Example Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_events_to_stix21.md This snippet shows an example of MISP 'observed-data' object converted to STIX 2.1 format. It includes details like creation timestamps, observed time range, and references to other STIX objects. ```json { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5b23c82b-6508-4bdc-b580-045b0a00020f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "first_observed": "2020-10-25T16:22:00Z", "last_observed": "2020-10-25T16:22:00Z", "number_observed": 1, "object_refs": [ "autonomous-system--52edeb5f-e79a-5775-938c-de02f26c9ce6" ], "labels": [ "misp:category=\"network\"", "misp:name=\"asn\"", "misp:to_ids=\"False\"" ] } ``` -------------------------------- ### STIX Indicator: SHA512 Hash (Example) Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix1.md An example of a file hash indicator in STIX XML format for a SHA512 hash. This representation includes the indicator's unique ID, timestamp, type, title, description, and observable object containing the file's SHA512 hash. It also specifies confidence and producer information. ```xml Payload delivery: 06f531e49154d59f684475da95693df1fccd50b505e6d3ca028c9d84fcfc79ef287704dd0b24b022bfac6ba9ee581d19f440773dd00cfcfecf068b644ecbecb5 (MISP Attribute) File Hash Watchlist sha512 test attribute SHA512 06f531e49154d59f684475da95693df1fccd50b505e6d3ca028c9d84fcfc79ef287704dd0b24b022bfac6ba9ee581d19f440773dd00cfcfecf068b644ecbecb5 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none MISP ``` -------------------------------- ### LNK File Representation: MISP Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_objects_to_stix21.md Represents a Windows LNK (shortcut) file object within MISP. It includes attributes such as filename, full path, MD5, SHA1, SHA256 hashes, malware sample reference, size, and creation timestamp. The 'malware-sample' attribute links to a specific file hash. ```json { "name": "lnk", "descrption": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", "meta-category": "file", "uuid": "153ef8d5-9182-45ec-bf1c-5819932b9ab7", "timestamp": "1603642920", "Attribute": [ { "type": "filename", "object_relation": "filename", "value": "oui" }, { "uuid": "34cb1a7c-55ec-412a-8684-ba4a88d83a45", "type": "text", "object_relation": "fullpath", "value": "/var/www/MISP/app/files/scripts/tmp" }, { "type": "md5", "object_relation": "md5", "value": "8764605c6f388c89096b534d33565802" }, { "type": "sha1", "object_relation": "sha1", "value": "46aba99aa7158e4609aaa72b50990842fd22ae86" }, { "type": "sha256", "object_relation": "sha256", "value": "ec5aedf5ecc6bdadd4120932170d1b10f6cfa175cfda22951dfd882928ab279b" }, { "uuid": "91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "type": "malware-sample", "object_relation": "malware-sample", "value": "oui|8764605c6f388c89096b534d33565802", "data": "UEsDBAoACQAAAAaOU1EvUbi[...]AACAAIA2QAAAB8BAAAAAA==" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "35" }, { "type": "datetime", "object_relation": "lnk-creation-time" ``` -------------------------------- ### SHA512 MISP and STIX Indicator Representation Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix20.md Provides examples of SHA512 hash representation in MISP and STIX Indicator format. Crucial for malware analysis and threat hunting. ```json { "type": "sha512", "category": "Payload delivery", "timestamp": "1603642920", "comment": "SHA512 test attribute", "value": "28c9409ebaed767fe240ecacf727f9a5bd9f17fbd054f7dff2770a81878e56b176bf5f0cd196217ac785dd88e807a78ef3ee8b8122aba15c9ffb5c143794e6fe", "uuid": "55ffda25-c3fe-48b5-a6eb-59c986cb593e" } ``` ```json { "type": "indicator", "id": "indicator--55ffda25-c3fe-48b5-a6eb-59c986cb593e", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "description": "SHA512 test attribute", "pattern": "[file:hashes.SHA512 = '28c9409ebaed767fe240ecacf727f9a5bd9f17fbd054f7dff2770a81878e56b176bf5f0cd196217ac785dd88e807a78ef3ee8b8122aba15c9ffb5c143794e6fe']", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha512\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### Import STIX to MISP Command-Line Interface (Bash) Source: https://context7.com/misp/misp-stix/llms.txt This section outlines command-line commands for importing STIX files into MISP. It covers various options such as specifying STIX version, distribution settings, output file names/directories, direct API integration, sharing groups, and SSL options. ```bash # Convert STIX 2.1 bundle to MISP with distribution settings misp_stix_converter import \ --file threat_intel.stix21.json \ --version 2 \ --distribution 1 \ --cluster-distribution 0 \ --output-name misp_event.json # Import multiple STIX files as separate MISP events misp_stix_converter import \ --file stix_feeds/*.json \ --version 2 \ --distribution 3 \ --output-dir ./misp_events/ # Import STIX and push directly to MISP instance misp_stix_converter import \ --file external_feed.stix21.json \ --url https://misp.example.com \ --api-key YOUR_API_KEY \ --distribution 2 \ --title "External Threat Feed" \ --producer "ACME Threat Intel" # Import STIX 1.x with sharing group misp_stix_converter import \ --file report.stix12.xml \ --version 1 \ --distribution 4 \ --sharing-group 5 \ --single-event \ --galaxies-as-tags # Batch import with custom organization UUID misp_stix_converter import \ --file feeds/*.stix21.json \ --url https://misp.internal \ --api-key API_KEY \ --org-uuid a1b2c3d4-e5f6-7890-abcd-ef1234567890 \ --cluster-distribution 1 \ --skip-ssl ``` -------------------------------- ### STIX Observed Data with Filename and SHA-384 Hash (Example 2) Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix20.md Another representation of a filename and its SHA-384 hash within STIX observed data. Demonstrates variations in observed file names. ```json { "type": "observed-data", "id": "observed-data--90bd7dae-b78c-4025-9073-568950c780fb", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "first_observed": "2020-10-25T16:22:00Z", "last_observed": "2020-10-25T16:22:00Z", "number_observed": 1, "objects": { "0": { "type": "file", "hashes": { "SHA-384": "ec1f92f1d30b71ffd866fe643a5fde9b64ac86398bfd3f24302bb2bae97e2b281f67666e7167dfdeb60006e2924636ce" }, "name": "filename6" } }, "labels": [ "misp:type=\"filename|sha384\"", "misp:category=\"Payload delivery\"" ] } ``` -------------------------------- ### Convert MISP URL to STIX Indicator and Observed Data Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_objects_to_stix20.md This example demonstrates the transformation of a MISP URL object into STIX indicator and observed-data formats. It shows how different components of a URL (value, domain, host, IP, port) are represented. The indicator uses a STIX pattern, while observed data structures the URL components within an object. ```json { "name": "url", "meta-category": "network", "description": "url object describes an url along with its normalized field", "uuid": "5ac347ca-dac4-4562-9775-04120a00020f", "timestamp": "1603642920", "Attribute": [ { "uuid": "91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "type": "url", "object_relation": "url", "value": "https://www.circl.lu/team" }, { "uuid": "518b4bcb-a86b-4783-9457-391d548b605b", "type": "domain", "object_relation": "domain", "value": "circl.lu" }, { "uuid": "34cb1a7c-55ec-412a-8684-ba4a88d83a45", "type": "hostname", "object_relation": "host", "value": "www.circl.lu" }, { "uuid": "94a2b00f-bec3-4f8a-bea4-e4ccf0de776f", "type": "ip-dst", "object_relation": "ip", "value": "149.13.33.14" }, { "uuid": "f2259650-bc33-4b64-a3a8-a324aa7ea6bb", "type": "port", "object_relation": "port", "value": "443" } ] } ``` ```json { "type": "indicator", "id": "indicator--5ac347ca-dac4-4562-9775-04120a00020f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "pattern": "[url:value = 'https://www.circl.lu/team' AND url:x_misp_domain = 'circl.lu' AND url:x_misp_host = 'www.circl.lu' AND url:x_misp_ip = '149.13.33.14' AND url:x_misp_port = '443']", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "network" } ], "labels": [ "misp:name=\"url"", "misp:meta-category=\"network"", "misp:to_ids=\"True"" ] } ``` ```json { "type": "observed-data", "id": "observed-data--5ac347ca-dac4-4562-9775-04120a00020f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "first_observed": "2020-10-25T16:22:00Z", "last_observed": "2020-10-25T16:22:00Z", "number_observed": 1, "objects": { "0": { "type": "url", "value": "https://www.circl.lu/team", "x_misp_domain": "circl.lu", "x_misp_host": "www.circl.lu", "x_misp_ip": "149.13.33.14", ``` -------------------------------- ### STIX Indicator Example in JSON Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_objects_to_stix21.md This JSON object represents a STIX 2.1 Indicator, detailing a user account and associated properties. It includes pattern matching logic and labels for classification within MISP. ```json { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d234f25-539c-4d12-bf93-2c46a964451a", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "pattern": "[user-account:account_type = 'unix' AND user-account:display_name = 'Code Monkey' AND user-account:credential = 'P4ssw0rd1234!' AND user-account:user_id = 'iglocska' AND user-account:account_login = 'iglocska' AND user-account:credential_last_changed = '2020-10-25T16:22:00Z' AND user-account:extensions.'unix-account-ext'.groups = 'viktor-fan' AND user-account:extensions.'unix-account-ext'.groups = 'donald-fan' AND user-account:extensions.'unix-account-ext'.gid = '2004' AND user-account:extensions.'unix-account-ext'.home_dir = '/home/iglocska' AND user-account:x_misp_user_avatar.data = 'iVBORw0KGgoAAAANSUhEUgA[...]hIu9Wl1AAAAAElFTkSuQmCC' AND user-account:x_misp_user_avatar.value = 'octocat.png']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "misc" } ], "labels": [ "misp:name=\"user-account\"", "misp:meta-category=\"misc\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### Representing Malware Samples: MISP JSON to STIX XML Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix1.md This snippet demonstrates the transformation of a malware sample observable from MISP JSON to STIX XML. It includes the mapping of the sample's hash, file name, and associated metadata for indicator creation. ```json { "uuid": "91ae0a21-c7ae-4c7f-b84b-b84a7ce53d1f", "type": "malware-sample", "category": "Payload delivery", "value": "oui|8764605c6f388c89096b534d33565802", "data": "UEsDBAoACQAAAAaOU1EvUbiwLwAAACMAAAAgABwAODc2NDYwNWM2ZjM4OGM4OTA5NmI1MzRkMzM1NjU4MDJVVAkAAzu1jV87tY1fdXgLAAEEIQAAAAQhAAAAUxIrDdj2V8dHuHoKPVDwAeOqqY3shFf5CKvJ/TZg7iNXlXSgxTaWwMnb6fESF/RQSwcIL1G4sC8AAAAjAAAAUEsDBAoACQAAAAaOU1FAAezaDwAAAAMAAAAtABwAODc2NDYwNWM2ZjM4OGM4OTA5NmI1MzRkMzM1NjU4MDIuZmlsZW5hbWUudHh0VVQJAAM7tY1fO7WNX3V4CwABBCEAAAAEIQAAAI7lFn9K1EsuznCkFF9PRFBLBwhAAezaDwAAAAMAAABQSwECHgMKAAkAAAAGjlNRL1G4sC8AAAAjAAAAIAAYAAAAAAABAAAApIEAAAAAODc2NDYwNWM2ZjM4OGM4OTA5NmI1MzRkMzM1NjU4MDJVVAUAAzu1jV91eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAAAGjlNRQAHs2g8AAAADAAAALQAYAAAAAAABAAAApIGZAAAAODc2NDYwNWM2ZjM4OGM4OTA5NmI1MzRkMzM1NjU4MDIuZmlsZW5hbWUudHh0VVQFAAM7tY1fdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAB8BAAAAAA==", "timestamp": "1603642920", "comment": "Malware Sample test attribute", "to_ids": true } ``` ```xml Payload delivery: oui|8764605c6f388c89096b534d33565802 (MISP Attribute) Malware Artifacts Malware Sample test attribute oui MD5 8764605c6f388c89096b534d33565802 ``` -------------------------------- ### MISP Filename|ssdeep to STIX Indicator Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix21.md Illustrates the conversion of a MISP filename with ssdeep hash to a STIX 2.1 Indicator object. This example highlights how ssdeep hashes can be represented within STIX, maintaining descriptive attributes. ```json { "type": "indicator", "spec_version": "2.1", "id": "indicator--9060e814-a36f-45ab-84e5-66fc82dc7cff", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "description": "Filename|ssdeep test attribute", "pattern": "[file:name = 'filename7' AND file:hashes.SSDEEP = '96:QRWkwoBevsL0JsIQ3pq8dxbuTet7eU/uEzAfue9atn0JbIi:QRWktBe80JsIIq8dxKyPew0JbIi']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename|ssdeep\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] } ``` -------------------------------- ### STIX Observed Data Object Example (JSON) Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_objects_to_stix21.md This snippet illustrates a STIX 2.1 Observed Data object, which is used in MISP to represent concrete observations of events. It includes details about the observed entities and their references. ```json [ { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5ac3379c-3e74-44ba-9160-04120a00020f", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "first_observed": "2020-10-25T16:22:00Z", "last_observed": "2020-10-25T16:22:00Z", "number_observed": 1, "object_refs": [ "windows-registry-key--5ac3379c-3e74-44ba-9160-04120a00020f" ], "labels": [ "misp:name=\"registry-key\"", "misp:meta-category=\"file\"", "misp:to_ids=\"False\"" ] }, { "type": "windows-registry-key", "spec_version": "2.1", "id": "windows-registry-key--5ac3379c-3e74-44ba-9160-04120a00020f", "key": "hkey_local_machine\system\bar\foo", "values": [ { "name": "RegistryName", "data": "%DATA%\qwertyuiop", "data_type": "REG_SZ" } ], "modified_time": "2020-10-25T16:22:00Z", "x_misp_hive": "hklm" } ] ``` -------------------------------- ### Directly Push STIX to MISP Instance (Python) Source: https://context7.com/misp/misp-stix/llms.txt This Python code demonstrates how to push STIX 2.1 bundles directly to a MISP instance using the `stix2_to_misp_instance` function. It requires the `pymisp` library for MISP connection and handles success and failure scenarios. ```python from misp_stix_converter import stix2_to_misp_instance from pymisp import PyMISP # Initialize MISP connection misp = PyMISP( url='https://misp.example.com', key='YOUR_API_KEY_HERE', ssl=True ) # Import STIX 2.1 bundle directly to MISP response = stix2_to_misp_instance( misp=misp, filename='threat_bundle.stix21.json', distribution=1, cluster_distribution=0, single_event=True, organisation_uuid='5ce29ac4-3b54-459e-a6ee-00a4c0a83832' ) # Check if event was created if response.get('success') == 1: event_id = response['results'][0] print(f"Event created with ID: {event_id}") print(f"View at: https://misp.example.com/events/view/{event_id}") else: print(f"Failed to create event: {response.get('pymisp_errors', {})}") # Import multiple STIX files to MISP from pathlib import Path stix_files = list(Path('./stix_feeds/').glob('*.json')) for stix_file in stix_files: result = stix2_to_misp_instance( misp=misp, filename=stix_file, distribution=3, title=f"Imported from {stix_file.name}" ) if result.get('success') == 1: print(f"Imported {stix_file.name} as event {result['results'][0]}") ``` -------------------------------- ### Convert MISP MD5 to STIX Indicator and Observed Data Source: https://github.com/misp/misp-stix/blob/main/documentation/misp_attributes_to_stix21.md This example demonstrates converting a MISP MD5 hash attribute into STIX objects. It includes a STIX 'indicator' object with the MD5 hash in its pattern and a STIX 'observed-data' object that references a 'file' object containing the MD5 hash. ```json { "type": "indicator", "spec_version": "2.1", "id": "indicator--34cb1a7c-55ec-412a-8684-ba4a88d83a45", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "description": "MD5 test attribute", "pattern": "[file:hashes.MD5 = 'b2a5abfeef9e36964281a31e17b57c97']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-10-25T16:22:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] } ``` ```json [ { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--34cb1a7c-55ec-412a-8684-ba4a88d83a45", "created_by_ref": "identity--a0c22599-9e58-4da4-96ac-7051603fa951", "created": "2020-10-25T16:22:00.000Z", "modified": "2020-10-25T16:22:00.000Z", "first_observed": "2020-10-25T16:22:00Z", "last_observed": "2020-10-25T16:22:00Z", "number_observed": 1, "object_refs": [ "file--34cb1a7c-55ec-412a-8684-ba4a88d83a45" ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--34cb1a7c-55ec-412a-8684-ba4a88d83a45", "hashes": { "MD5": "b2a5abfeef9e36964281a31e17b57c97" } } ] ```