misp/misp-data.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Jupyter Notebook for Querying MISP Instance"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Connecting to the API\n",
    "\n",
    "- Replace `MISP_URL` with the IP address of the current MISP instance\n",
    "- Replace `MISP_KEY` with your API AuthKey\n",
    "- Need to disable SSL cert verification (currently)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from pymisp import PyMISP\n",
    "from pprint import pprint\n",
    "import matplotlib_inline\n",
    "import pandas as pd\n",
    "from config import config\n",
    "\n",
    "# create misp instance\n",
    "MISP_URL = config.MISP_URL\n",
    "MISP_KEY = config.MISP_KEY\n",
    "MISP_VERIFYCERT = config.MISP_VERIFYCERT\n",
    "misp = PyMISP(MISP_URL, MISP_KEY, MISP_VERIFYCERT, debug=False)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Search for IOCs that are in the MISP database\n",
    "\n",
    "- Replace `IOC` with domain, IP, hash, filename, etc.\n",
    "- Returns the MISP Event the Attribute (IOC) is associated with\n",
    "- You can pull information from this Event (e.g. enriched threat intelligence)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# searching for attributes (IOCs)\n",
    "IOC = \"oxcdntech.com\"\n",
    "response = misp.search(value=IOC)\n",
    "\n",
    "if response:\n",
    "    print(\"--- Matching Event ---\")\n",
    "    print(f\"Event ID: {response[0]['Event']['id']}\")\n",
    "    print(f\"Event Info: {response[0]['Event']['info']}\")\n",
    "    print(f\"Date Added: {response[0]['Event']['date']}\")\n",
    "    print(f\"Tags: {response[0]['Event']['date']}\")\n",
    "    for tag in response[0]['Event']['Tag']:\n",
    "        print(f\"- {tag['name']}\")\n",
    "    print(\"-\" * 20)\n",
    "\n",
    "else:\n",
    "    print(f\"The IOC {IOC} is not in MISP\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Show Statistics\n",
    "\n",
    "- Prints data about MISP, such as users, tags, and attributes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def general_statistics():\n",
    "    res = misp.users_statistics()\n",
    "    print(\"--- General Stats ---\")\n",
    "    print(f\"Users: {res['stats']['user_count']}\")\n",
    "    print(f\"Events: {res['stats']['event_count']}\")\n",
    "    print(f\"- added this month: {res['stats']['event_count_month']}\")\n",
    "    print(f\"Attributes: {res['stats']['attribute_count']}\")\n",
    "    print(f\"- added this month: {res['stats']['attribute_count_month']}\")\n",
    "    print()\n",
    "\n",
    "\n",
    "def tag_statistics():\n",
    "    res = misp.tags_statistics()\n",
    "    print(\"--- Tag Stats ---\")\n",
    "    print(f\"Threat Intelligence Articles: \" + res['tags']['cssa:origin=\"report\"'])\n",
    "    print(f\"Manual Investigations: \" + res['tags']['cssa:origin=\"manual_investigation\"'])\n",
    "    print(f\"Past Incidents: \" + res['tags']['past-incident'])\n",
    "    print(f\"Malware Research: \" + res['tags']['software-research'])\n",
    "    print()\n",
    "\n",
    "def attribute_statistics():\n",
    "    res = misp.attributes_statistics()\n",
    "    print(\"--- Attribute Stats ---\")\n",
    "    values_all = list(res.values())\n",
    "    total_all = 0 \n",
    "    for i in values_all:\n",
    "        total_all += int(i)\n",
    "    print(f\"Total: {total_all}\")\n",
    "\n",
    "    total_endpoint = int(res['md5']) + int(res['sha1']) + int(res['sha256']) \n",
    "    print(f\"Endpoint Indicators: {total_endpoint}\")\n",
    "    print(f\"- MD5 hash: {res['md5']}\")\n",
    "    print(f\"- SHA1 hash: {res['sha1']}\")\n",
    "    print(f\"- SHA256 hash: {res['sha256']}\")\n",
    "\n",
    "    totaL_network = int(res['domain']) + int(res['ip-dst']) + int(res['hostname']) + int(res['url']) + int(res['email-src'])\n",
    "    print(f\"Network Indicators: {totaL_network}\")\n",
    "    print(f\"- domains: {res['domain']}\")\n",
    "    print(f\"- ip addresses: {res['ip-dst']}\")\n",
    "    print(f\"- hostnames: {res['hostname']}\")\n",
    "    print(f\"- URLs: {res['url']}\")\n",
    "    print(f\"- email address: {res['email-src']}\")\n",
    "\n",
    "print(\"=\" * 25)\n",
    "print(\"=== MISP Statistics ===\")\n",
    "print(\"=\" * 25)\n",
    "print()\n",
    "general_statistics()\n",
    "tag_statistics()\n",
    "attribute_statistics()\n",
    "print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Finding the most commont TTPS\n",
    "\n",
    "- Searches across all Events and counts TTPs to return the most common ones\n",
    "- Plots the TTPs in a bar graph"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# finding most common TTPs across all events\n",
    "# get all events in MISP instance\n",
    "all = misp.search(controller=\"events\")\n",
    "# create dictionary containing MITRE ATT&CK TTPs mapped to a count\n",
    "ttps = {\n",
    "    \"T1548\" : 0,\n",
    "    \"T1548.002\" : 0,\n",
    "    \"T1548.004\" : 0,\n",
    "    \"T1548.001\" : 0,\n",
    "    \"T1548.003\" : 0,\n",
    "    \"T1134\" : 0,\n",
    "    \"T1134.002\" : 0,\n",
    "    \"T1134.003\" : 0,\n",
    "    \"T1134.004\" : 0,\n",
    "    \"T1134.005\" : 0,\n",
    "    \"T1134.001\" : 0,\n",
    "    \"T1531\" : 0,\n",
    "    \"T1087\" : 0,\n",
    "    \"T1087.004\" : 0,\n",
    "    \"T1087.002\" : 0,\n",
    "    \"T1087.003\" : 0,\n",
    "    \"T1087.001\" : 0,\n",
    "    \"T1098\" : 0,\n",
    "    \"T1098.001\" : 0,\n",
    "    \"T1098.003\" : 0,\n",
    "    \"T1098.002\" : 0,\n",
    "    \"T1098.005\" : 0,\n",
    "    \"T1098.004\" : 0,\n",
    "    \"T1650\" : 0,\n",
    "    \"T1583\" : 0,\n",
    "    \"T1583.005\" : 0,\n",
    "    \"T1583.002\" : 0,\n",
    "    \"T1583.001\" : 0,\n",
    "    \"T1583.008\" : 0,\n",
    "    \"T1583.004\" : 0,\n",
    "    \"T1583.007\" : 0,\n",
    "    \"T1583.003\" : 0,\n",
    "    \"T1583.006\" : 0,\n",
    "    \"T1595\" : 0,\n",
    "    \"T1595.001\" : 0,\n",
    "    \"T1595.002\" : 0,\n",
    "    \"T1595.003\" : 0,\n",
    "    \"T1557\" : 0,\n",
    "    \"T1557.002\" : 0,\n",
    "    \"T1557.003\" : 0,\n",
    "    \"T1557.001\" : 0,\n",
    "    \"T1071\" : 0,\n",
    "    \"T1071.004\" : 0,\n",
    "    \"T1071.002\" : 0,\n",
    "    \"T1071.003\" : 0,\n",
    "    \"T1071.001\" : 0,\n",
    "    \"T1010\" : 0,\n",
    "    \"T1560\" : 0,\n",
    "    \"T1560.003\" : 0,\n",
    "    \"T1560.002\" : 0,\n",
    "    \"T1560.001\" : 0,\n",
    "    \"T1123\" : 0,\n",
    "    \"T1119\" : 0,\n",
    "    \"T1020\" : 0,\n",
    "    \"T1020.001\" : 0,\n",
    "    \"T1197\" : 0,\n",
    "    \"T1547\" : 0,\n",
    "    \"T1547.014\" : 0,\n",
    "    \"T1547.002\" : 0,\n",
    "    \"T1547.006\" : 0,\n",
    "    \"T1547.008\" : 0,\n",
    "    \"T1547.015\" : 0,\n",
    "    \"T1547.010\" : 0,\n",
    "    \"T1547.012\" : 0,\n",
    "    \"T1547.007\" : 0,\n",
    "    \"T1547.001\" : 0,\n",
    "    \"T1547.005\" : 0,\n",
    "    \"T1547.009\" : 0,\n",
    "    \"T1547.003\" : 0,\n",
    "    \"T1547.004\" : 0,\n",
    "    \"T1547.013\" : 0,\n",
    "    \"T1037\" : 0,\n",
    "    \"T1037.002\" : 0,\n",
    "    \"T1037.001\" : 0,\n",
    "    \"T1037.003\" : 0,\n",
    "    \"T1037.004\" : 0,\n",
    "    \"T1037.005\" : 0,\n",
    "    \"T1176\" : 0,\n",
    "    \"T1217\" : 0,\n",
    "    \"T1185\" : 0,\n",
    "    \"T1110\" : 0,\n",
    "    \"T1110.004\" : 0,\n",
    "    \"T1110.002\" : 0,\n",
    "    \"T1110.001\" : 0,\n",
    "    \"T1110.003\" : 0,\n",
    "    \"T1612\" : 0,\n",
    "    \"T1115\" : 0,\n",
    "    \"T1651\" : 0,\n",
    "    \"T1580\" : 0,\n",
    "    \"T1538\" : 0,\n",
    "    \"T1526\" : 0,\n",
    "    \"T1619\" : 0,\n",
    "    \"T1059\" : 0,\n",
    "    \"T1059.002\" : 0,\n",
    "    \"T1059.009\" : 0,\n",
    "    \"T1059.007\" : 0,\n",
    "    \"T1059.008\" : 0,\n",
    "    \"T1059.001\" : 0,\n",
    "    \"T1059.006\" : 0,\n",
    "    \"T1059.004\" : 0,\n",
    "    \"T1059.005\" : 0,\n",
    "    \"T1059.003\" : 0,\n",
    "    \"T1092\" : 0,\n",
    "    \"T1586\" : 0,\n",
    "    \"T1586.003\" : 0,\n",
    "    \"T1586.002\" : 0,\n",
    "    \"T1586.001\" : 0,\n",
    "    \"T1554\" : 0,\n",
    "    \"T1584\" : 0,\n",
    "    \"T1584.005\" : 0,\n",
    "    \"T1584.002\" : 0,\n",
    "    \"T1584.001\" : 0,\n",
    "    \"T1584.004\" : 0,\n",
    "    \"T1584.007\" : 0,\n",
    "    \"T1584.003\" : 0,\n",
    "    \"T1584.006\" : 0,\n",
    "    \"T1609\" : 0,\n",
    "    \"T1613\" : 0,\n",
    "    \"T1136\" : 0,\n",
    "    \"T1136.003\" : 0,\n",
    "    \"T1136.002\" : 0,\n",
    "    \"T1136.001\" : 0,\n",
    "    \"T1543\" : 0,\n",
    "    \"T1543.001\" : 0,\n",
    "    \"T1543.004\" : 0,\n",
    "    \"T1543.002\" : 0,\n",
    "    \"T1543.003\" : 0,\n",
    "    \"T1555\" : 0,\n",
    "    \"T1555.003\" : 0,\n",
    "    \"T1555.001\" : 0,\n",
    "    \"T1555.005\" : 0,\n",
    "    \"T1555.002\" : 0,\n",
    "    \"T1555.004\" : 0,\n",
    "    \"T1485\" : 0,\n",
    "    \"T1132\" : 0,\n",
    "    \"T1132.002\" : 0,\n",
    "    \"T1132.001\" : 0,\n",
    "    \"T1486\" : 0,\n",
    "    \"T1565\" : 0,\n",
    "    \"T1565.003\" : 0,\n",
    "    \"T1565.001\" : 0,\n",
    "    \"T1565.002\" : 0,\n",
    "    \"T1001\" : 0,\n",
    "    \"T1001.001\" : 0,\n",
    "    \"T1001.003\" : 0,\n",
    "    \"T1001.002\" : 0,\n",
    "    \"T1074\" : 0,\n",
    "    \"T1074.001\" : 0,\n",
    "    \"T1074.002\" : 0,\n",
    "    \"T1030\" : 0,\n",
    "    \"T1530\" : 0,\n",
    "    \"T1602\" : 0,\n",
    "    \"T1602.002\" : 0,\n",
    "    \"T1602.001\" : 0,\n",
    "    \"T1213\" : 0,\n",
    "    \"T1213.003\" : 0,\n",
    "    \"T1213.001\" : 0,\n",
    "    \"T1213.002\" : 0,\n",
    "    \"T1005\" : 0,\n",
    "    \"T1039\" : 0,\n",
    "    \"T1025\" : 0,\n",
    "    \"T1622\" : 0,\n",
    "    \"T1491\" : 0,\n",
    "    \"T1491.002\" : 0,\n",
    "    \"T1491.001\" : 0,\n",
    "    \"T1140\" : 0,\n",
    "    \"T1610\" : 0,\n",
    "    \"T1587\" : 0,\n",
    "    \"T1587.002\" : 0,\n",
    "    \"T1587.003\" : 0,\n",
    "    \"T1587.004\" : 0,\n",
    "    \"T1587.001\" : 0,\n",
    "    \"T1652\" : 0,\n",
    "    \"T1006\" : 0,\n",
    "    \"T1561\" : 0,\n",
    "    \"T1561.001\" : 0,\n",
    "    \"T1561.002\" : 0,\n",
    "    \"T1484\" : 0,\n",
    "    \"T1484.002\" : 0,\n",
    "    \"T1484.001\" : 0,\n",
    "    \"T1482\" : 0,\n",
    "    \"T1189\" : 0,\n",
    "    \"T1568\" : 0,\n",
    "    \"T1568.003\" : 0,\n",
    "    \"T1568.002\" : 0,\n",
    "    \"T1568.001\" : 0,\n",
    "    \"T1114\" : 0,\n",
    "    \"T1114.003\" : 0,\n",
    "    \"T1114.001\" : 0,\n",
    "    \"T1114.002\" : 0,\n",
    "    \"T1573\" : 0,\n",
    "    \"T1573.002\" : 0,\n",
    "    \"T1573.001\" : 0,\n",
    "    \"T1499\" : 0,\n",
    "    \"T1499.003\" : 0,\n",
    "    \"T1499.004\" : 0,\n",
    "    \"T1499.001\" : 0,\n",
    "    \"T1499.002\" : 0,\n",
    "    \"T1611\" : 0,\n",
    "    \"T1585\" : 0,\n",
    "    \"T1585.003\" : 0,\n",
    "    \"T1585.002\" : 0,\n",
    "    \"T1585.001\" : 0,\n",
    "    \"T1546\" : 0,\n",
    "    \"T1546.008\" : 0,\n",
    "    \"T1546.009\" : 0,\n",
    "    \"T1546.010\" : 0,\n",
    "    \"T1546.011\" : 0,\n",
    "    \"T1546.001\" : 0,\n",
    "    \"T1546.015\" : 0,\n",
    "    \"T1546.014\" : 0,\n",
    "    \"T1546.012\" : 0,\n",
    "    \"T1546.016\" : 0,\n",
    "    \"T1546.006\" : 0,\n",
    "    \"T1546.007\" : 0,\n",
    "    \"T1546.013\" : 0,\n",
    "    \"T1546.002\" : 0,\n",
    "    \"T1546.005\" : 0,\n",
    "    \"T1546.004\" : 0,\n",
    "    \"T1546.003\" : 0,\n",
    "    \"T1480\" : 0,\n",
    "    \"T1480.001\" : 0,\n",
    "    \"T1048\" : 0,\n",
    "    \"T1048.002\" : 0,\n",
    "    \"T1048.001\" : 0,\n",
    "    \"T1048.003\" : 0,\n",
    "    \"T1041\" : 0,\n",
    "    \"T1011\" : 0,\n",
    "    \"T1011.001\" : 0,\n",
    "    \"T1052\" : 0,\n",
    "    \"T1052.001\" : 0,\n",
    "    \"T1567\" : 0,\n",
    "    \"T1567.002\" : 0,\n",
    "    \"T1567.001\" : 0,\n",
    "    \"T1567.003\" : 0,\n",
    "    \"T1190\" : 0,\n",
    "    \"T1203\" : 0,\n",
    "    \"T1212\" : 0,\n",
    "    \"T1211\" : 0,\n",
    "    \"T1068\" : 0,\n",
    "    \"T1210\" : 0,\n",
    "    \"T1133\" : 0,\n",
    "    \"T1008\" : 0,\n",
    "    \"T1083\" : 0,\n",
    "    \"T1222\" : 0,\n",
    "    \"T1222.002\" : 0,\n",
    "    \"T1222.001\" : 0,\n",
    "    \"T1495\" : 0,\n",
    "    \"T1187\" : 0,\n",
    "    \"T1606\" : 0,\n",
    "    \"T1606.002\" : 0,\n",
    "    \"T1606.001\" : 0,\n",
    "    \"T1592\" : 0,\n",
    "    \"T1592.004\" : 0,\n",
    "    \"T1592.003\" : 0,\n",
    "    \"T1592.001\" : 0,\n",
    "    \"T1592.002\" : 0,\n",
    "    \"T1589\" : 0,\n",
    "    \"T1589.001\" : 0,\n",
    "    \"T1589.002\" : 0,\n",
    "    \"T1589.003\" : 0,\n",
    "    \"T1590\" : 0,\n",
    "    \"T1590.002\" : 0,\n",
    "    \"T1590.001\" : 0,\n",
    "    \"T1590.005\" : 0,\n",
    "    \"T1590.006\" : 0,\n",
    "    \"T1590.004\" : 0,\n",
    "    \"T1590.003\" : 0,\n",
    "    \"T1591\" : 0,\n",
    "    \"T1591.002\" : 0,\n",
    "    \"T1591.001\" : 0,\n",
    "    \"T1591.003\" : 0,\n",
    "    \"T1591.004\" : 0,\n",
    "    \"T1615\" : 0,\n",
    "    \"T1200\" : 0,\n",
    "    \"T1564\" : 0,\n",
    "    \"T1564.008\" : 0,\n",
    "    \"T1564.005\" : 0,\n",
    "    \"T1564.001\" : 0,\n",
    "    \"T1564.002\" : 0,\n",
    "    \"T1564.003\" : 0,\n",
    "    \"T1564.004\" : 0,\n",
    "    \"T1564.010\" : 0,\n",
    "    \"T1564.009\" : 0,\n",
    "    \"T1564.006\" : 0,\n",
    "    \"T1564.007\" : 0,\n",
    "    \"T1574\" : 0,\n",
    "    \"T1574.012\" : 0,\n",
    "    \"T1574.001\" : 0,\n",
    "    \"T1574.002\" : 0,\n",
    "    \"T1574.004\" : 0,\n",
    "    \"T1574.006\" : 0,\n",
    "    \"T1574.005\" : 0,\n",
    "    \"T1574.013\" : 0,\n",
    "    \"T1574.007\" : 0,\n",
    "    \"T1574.008\" : 0,\n",
    "    \"T1574.009\" : 0,\n",
    "    \"T1574.010\" : 0,\n",
    "    \"T1574.011\" : 0,\n",
    "    \"T1562\" : 0,\n",
    "    \"T1562.008\" : 0,\n",
    "    \"T1562.002\" : 0,\n",
    "    \"T1562.007\" : 0,\n",
    "    \"T1562.004\" : 0,\n",
    "    \"T1562.001\" : 0,\n",
    "    \"T1562.010\" : 0,\n",
    "    \"T1562.003\" : 0,\n",
    "    \"T1562.006\" : 0,\n",
    "    \"T1562.009\" : 0,\n",
    "    \"T1562.011\" : 0,\n",
    "    \"T1525\" : 0,\n",
    "    \"T1070\" : 0,\n",
    "    \"T1070.003\" : 0,\n",
    "    \"T1070.002\" : 0,\n",
    "    \"T1070.008\" : 0,\n",
    "    \"T1070.007\" : 0,\n",
    "    \"T1070.009\" : 0,\n",
    "    \"T1070.001\" : 0,\n",
    "    \"T1070.004\" : 0,\n",
    "    \"T1070.005\" : 0,\n",
    "    \"T1070.006\" : 0,\n",
    "    \"T1202\" : 0,\n",
    "    \"T1105\" : 0,\n",
    "    \"T1490\" : 0,\n",
    "    \"T1056\" : 0,\n",
    "    \"T1056.004\" : 0,\n",
    "    \"T1056.002\" : 0,\n",
    "    \"T1056.001\" : 0,\n",
    "    \"T1056.003\" : 0,\n",
    "    \"T1559\" : 0,\n",
    "    \"T1559.001\" : 0,\n",
    "    \"T1559.002\" : 0,\n",
    "    \"T1559.003\" : 0,\n",
    "    \"T1534\" : 0,\n",
    "    \"T1570\" : 0,\n",
    "    \"T1036\" : 0,\n",
    "    \"T1036.007\" : 0,\n",
    "    \"T1036.001\" : 0,\n",
    "    \"T1036.008\" : 0,\n",
    "    \"T1036.004\" : 0,\n",
    "    \"T1036.005\" : 0,\n",
    "    \"T1036.003\" : 0,\n",
    "    \"T1036.002\" : 0,\n",
    "    \"T1036.006\" : 0,\n",
    "    \"T1556\" : 0,\n",
    "    \"T1556.001\" : 0,\n",
    "    \"T1556.007\" : 0,\n",
    "    \"T1556.006\" : 0,\n",
    "    \"T1556.004\" : 0,\n",
    "    \"T1556.008\" : 0,\n",
    "    \"T1556.002\" : 0,\n",
    "    \"T1556.003\" : 0,\n",
    "    \"T1556.005\" : 0,\n",
    "    \"T1578\" : 0,\n",
    "    \"T1578.002\" : 0,\n",
    "    \"T1578.001\" : 0,\n",
    "    \"T1578.003\" : 0,\n",
    "    \"T1578.004\" : 0,\n",
    "    \"T1112\" : 0,\n",
    "    \"T1601\" : 0,\n",
    "    \"T1601.002\" : 0,\n",
    "    \"T1601.001\" : 0,\n",
    "    \"T1111\" : 0,\n",
    "    \"T1621\" : 0,\n",
    "    \"T1104\" : 0,\n",
    "    \"T1106\" : 0,\n",
    "    \"T1599\" : 0,\n",
    "    \"T1599.001\" : 0,\n",
    "    \"T1498\" : 0,\n",
    "    \"T1498.001\" : 0,\n",
    "    \"T1498.002\" : 0,\n",
    "    \"T1046\" : 0,\n",
    "    \"T1135\" : 0,\n",
    "    \"T1040\" : 0,\n",
    "    \"T1095\" : 0,\n",
    "    \"T1571\" : 0,\n",
    "    \"T1003\" : 0,\n",
    "    \"T1003.008\" : 0,\n",
    "    \"T1003.005\" : 0,\n",
    "    \"T1003.006\" : 0,\n",
    "    \"T1003.004\" : 0,\n",
    "    \"T1003.001\" : 0,\n",
    "    \"T1003.003\" : 0,\n",
    "    \"T1003.007\" : 0,\n",
    "    \"T1003.002\" : 0,\n",
    "    \"T1027\" : 0,\n",
    "    \"T1027.001\" : 0,\n",
    "    \"T1027.010\" : 0,\n",
    "    \"T1027.004\" : 0,\n",
    "    \"T1027.007\" : 0,\n",
    "    \"T1027.009\" : 0,\n",
    "    \"T1027.011\" : 0,\n",
    "    \"T1027.006\" : 0,\n",
    "    \"T1027.005\" : 0,\n",
    "    \"T1027.002\" : 0,\n",
    "    \"T1027.003\" : 0,\n",
    "    \"T1027.008\" : 0,\n",
    "    \"T1588\" : 0,\n",
    "    \"T1588.003\" : 0,\n",
    "    \"T1588.004\" : 0,\n",
    "    \"T1588.005\" : 0,\n",
    "    \"T1588.001\" : 0,\n",
    "    \"T1588.002\" : 0,\n",
    "    \"T1588.006\" : 0,\n",
    "    \"T1137\" : 0,\n",
    "    \"T1137.006\" : 0,\n",
    "    \"T1137.001\" : 0,\n",
    "    \"T1137.002\" : 0,\n",
    "    \"T1137.003\" : 0,\n",
    "    \"T1137.004\" : 0,\n",
    "    \"T1137.005\" : 0,\n",
    "    \"T1201\" : 0,\n",
    "    \"T1120\" : 0,\n",
    "    \"T1069\" : 0,\n",
    "    \"T1069.003\" : 0,\n",
    "    \"T1069.002\" : 0,\n",
    "    \"T1069.001\" : 0,\n",
    "    \"T1566\" : 0,\n",
    "    \"T1598\" : 0,\n",
    "    \"T1598.002\" : 0,\n",
    "    \"T1598.003\" : 0,\n",
    "    \"T1598.001\" : 0,\n",
    "    \"T1566.001\" : 0,\n",
    "    \"T1566.002\" : 0,\n",
    "    \"T1566.003\" : 0,\n",
    "    \"T1647\" : 0,\n",
    "    \"T1542\" : 0,\n",
    "    \"T1542.003\" : 0,\n",
    "    \"T1542.002\" : 0,\n",
    "    \"T1542.004\" : 0,\n",
    "    \"T1542.001\" : 0,\n",
    "    \"T1542.005\" : 0,\n",
    "    \"T1057\" : 0,\n",
    "    \"T1055\" : 0,\n",
    "    \"T1055.004\" : 0,\n",
    "    \"T1055.001\" : 0,\n",
    "    \"T1055.011\" : 0,\n",
    "    \"T1055.015\" : 0,\n",
    "    \"T1055.002\" : 0,\n",
    "    \"T1055.009\" : 0,\n",
    "    \"T1055.013\" : 0,\n",
    "    \"T1055.012\" : 0,\n",
    "    \"T1055.008\" : 0,\n",
    "    \"T1055.003\" : 0,\n",
    "    \"T1055.005\" : 0,\n",
    "    \"T1055.014\" : 0,\n",
    "    \"T1572\" : 0,\n",
    "    \"T1090\" : 0,\n",
    "    \"T1090.004\" : 0,\n",
    "    \"T1090.002\" : 0,\n",
    "    \"T1090.001\" : 0,\n",
    "    \"T1090.003\" : 0,\n",
    "    \"T1012\" : 0,\n",
    "    \"T1620\" : 0,\n",
    "    \"T1219\" : 0,\n",
    "    \"T1563\" : 0,\n",
    "    \"T1563.002\" : 0,\n",
    "    \"T1563.001\" : 0,\n",
    "    \"T1021\" : 0,\n",
    "    \"T1021.007\" : 0,\n",
    "    \"T1021.003\" : 0,\n",
    "    \"T1021.001\" : 0,\n",
    "    \"T1021.002\" : 0,\n",
    "    \"T1021.004\" : 0,\n",
    "    \"T1021.005\" : 0,\n",
    "    \"T1021.006\" : 0,\n",
    "    \"T1018\" : 0,\n",
    "    \"T1091\" : 0,\n",
    "    \"T1496\" : 0,\n",
    "    \"T1207\" : 0,\n",
    "    \"T1014\" : 0,\n",
    "    \"T1053\" : 0,\n",
    "    \"T1053.002\" : 0,\n",
    "    \"T1053.007\" : 0,\n",
    "    \"T1053.003\" : 0,\n",
    "    \"T1053.005\" : 0,\n",
    "    \"T1053.006\" : 0,\n",
    "    \"T1029\" : 0,\n",
    "    \"T1113\" : 0,\n",
    "    \"T1597\" : 0,\n",
    "    \"T1597.002\" : 0,\n",
    "    \"T1597.001\" : 0,\n",
    "    \"T1596\" : 0,\n",
    "    \"T1596.004\" : 0,\n",
    "    \"T1596.001\" : 0,\n",
    "    \"T1596.003\" : 0,\n",
    "    \"T1596.005\" : 0,\n",
    "    \"T1596.002\" : 0,\n",
    "    \"T1593\" : 0,\n",
    "    \"T1593.003\" : 0,\n",
    "    \"T1593.002\" : 0,\n",
    "    \"T1593.001\" : 0,\n",
    "    \"T1594\" : 0,\n",
    "    \"T1505\" : 0,\n",
    "    \"T1505.004\" : 0,\n",
    "    \"T1505.001\" : 0,\n",
    "    \"T1505.005\" : 0,\n",
    "    \"T1505.002\" : 0,\n",
    "    \"T1505.003\" : 0,\n",
    "    \"T1648\" : 0,\n",
    "    \"T1489\" : 0,\n",
    "    \"T1129\" : 0,\n",
    "    \"T1072\" : 0,\n",
    "    \"T1518\" : 0,\n",
    "    \"T1518.001\" : 0,\n",
    "    \"T1608\" : 0,\n",
    "    \"T1608.004\" : 0,\n",
    "    \"T1608.003\" : 0,\n",
    "    \"T1608.005\" : 0,\n",
    "    \"T1608.006\" : 0,\n",
    "    \"T1608.001\" : 0,\n",
    "    \"T1608.002\" : 0,\n",
    "    \"T1528\" : 0,\n",
    "    \"T1539\" : 0,\n",
    "    \"T1649\" : 0,\n",
    "    \"T1558\" : 0,\n",
    "    \"T1558.004\" : 0,\n",
    "    \"T1558.001\" : 0,\n",
    "    \"T1558.003\" : 0,\n",
    "    \"T1558.002\" : 0,\n",
    "    \"T1553\" : 0,\n",
    "    \"T1553.002\" : 0,\n",
    "    \"T1553.006\" : 0,\n",
    "    \"T1553.001\" : 0,\n",
    "    \"T1553.004\" : 0,\n",
    "    \"T1553.005\" : 0,\n",
    "    \"T1553.003\" : 0,\n",
    "    \"T1195\" : 0,\n",
    "    \"T1195.003\" : 0,\n",
    "    \"T1195.001\" : 0,\n",
    "    \"T1195.002\" : 0,\n",
    "    \"T1218\" : 0,\n",
    "    \"T1218.003\" : 0,\n",
    "    \"T1218.001\" : 0,\n",
    "    \"T1218.002\" : 0,\n",
    "    \"T1218.004\" : 0,\n",
    "    \"T1218.014\" : 0,\n",
    "    \"T1218.013\" : 0,\n",
    "    \"T1218.005\" : 0,\n",
    "    \"T1218.007\" : 0,\n",
    "    \"T1218.008\" : 0,\n",
    "    \"T1218.009\" : 0,\n",
    "    \"T1218.010\" : 0,\n",
    "    \"T1218.011\" : 0,\n",
    "    \"T1218.012\" : 0,\n",
    "    \"T1082\" : 0,\n",
    "    \"T1614\" : 0,\n",
    "    \"T1614.001\" : 0,\n",
    "    \"T1016\" : 0,\n",
    "    \"T1016.001\" : 0,\n",
    "    \"T1049\" : 0,\n",
    "    \"T1033\" : 0,\n",
    "    \"T1216\" : 0,\n",
    "    \"T1216.001\" : 0,\n",
    "    \"T1007\" : 0,\n",
    "    \"T1569\" : 0,\n",
    "    \"T1569.001\" : 0,\n",
    "    \"T1569.002\" : 0,\n",
    "    \"T1529\" : 0,\n",
    "    \"T1124\" : 0,\n",
    "    \"T1080\" : 0,\n",
    "    \"T1221\" : 0,\n",
    "    \"T1205\" : 0,\n",
    "    \"T1205.001\" : 0,\n",
    "    \"T1205.002\" : 0,\n",
    "    \"T1537\" : 0,\n",
    "    \"T1127\" : 0,\n",
    "    \"T1127.001\" : 0,\n",
    "    \"T1199\" : 0,\n",
    "    \"T1552\" : 0,\n",
    "    \"T1552.003\" : 0,\n",
    "    \"T1552.008\" : 0,\n",
    "    \"T1552.005\" : 0,\n",
    "    \"T1552.007\" : 0,\n",
    "    \"T1552.001\" : 0,\n",
    "    \"T1552.002\" : 0,\n",
    "    \"T1552.006\" : 0,\n",
    "    \"T1552.004\" : 0,\n",
    "    \"T1535\" : 0,\n",
    "    \"T1550\" : 0,\n",
    "    \"T1550.001\" : 0,\n",
    "    \"T1550.002\" : 0,\n",
    "    \"T1550.003\" : 0,\n",
    "    \"T1550.004\" : 0,\n",
    "    \"T1204\" : 0,\n",
    "    \"T1204.002\" : 0,\n",
    "    \"T1204.003\" : 0,\n",
    "    \"T1204.001\" : 0,\n",
    "    \"T1078\" : 0,\n",
    "    \"T1078.004\" : 0,\n",
    "    \"T1078.001\" : 0,\n",
    "    \"T1078.002\" : 0,\n",
    "    \"T1078.003\" : 0,\n",
    "    \"T1125\" : 0,\n",
    "    \"T1497\" : 0,\n",
    "    \"T1497.001\" : 0,\n",
    "    \"T1497.003\" : 0,\n",
    "    \"T1497.002\" : 0,\n",
    "    \"T1600\" : 0,\n",
    "    \"T1600.002\" : 0,\n",
    "    \"T1600.001\" : 0,\n",
    "    \"T1102\" : 0,\n",
    "    \"T1102.002\" : 0,\n",
    "    \"T1102.001\" : 0,\n",
    "    \"T1102.003\" : 0,\n",
    "    \"T1047\" : 0,\n",
    "    \"T1220\" : 0,\n",
    "    }\n",
    "\n",
    "# loop through all events and increase count of a TTP in dictionary if an event has that TTP\n",
    "for i in all:\n",
    "    galaxies = i['Event']['Galaxy']\n",
    "    for j in galaxies:\n",
    "        if j['type'] == 'mitre-attack-pattern':\n",
    "            for k in j['GalaxyCluster']:\n",
    "                ttp = k['meta']['external_id'][0]\n",
    "                if ttp in ttps:\n",
    "                    ttps[ttp] += 1\n",
    "\n",
    "# plotting data\n",
    "ttps_data = pd.Series(data=ttps, index=list(ttps.keys()))\n",
    "\n",
    "(ttps_data\n",
    "    [lambda s: s>9]\n",
    "    .plot.barh()\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Finding Most Common TTPS Based on Tag\n",
    "- change the `TAG` variable to a MISP tag used by your MISP instance to get stats about a specific set of Events\n",
    "- For instance, you can create a tag for `threat-actor-research`, `past-incident`, `malware-research`, etc."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# finding most common TTPs across events with a certain tag\n",
    "TAG = \"software-research\"\n",
    "# get all events in MISP instance\n",
    "all = misp.search(controller=\"events\")\n",
    "# create dictionary containing MITRE ATT&CK TTPs mapped to a count\n",
    "ttps = {\n",
    "    \"T1548\" : 0,\n",
    "    \"T1548.002\" : 0,\n",
    "    \"T1548.004\" : 0,\n",
    "    \"T1548.001\" : 0,\n",
    "    \"T1548.003\" : 0,\n",
    "    \"T1134\" : 0,\n",
    "    \"T1134.002\" : 0,\n",
    "    \"T1134.003\" : 0,\n",
    "    \"T1134.004\" : 0,\n",
    "    \"T1134.005\" : 0,\n",
    "    \"T1134.001\" : 0,\n",
    "    \"T1531\" : 0,\n",
    "    \"T1087\" : 0,\n",
    "    \"T1087.004\" : 0,\n",
    "    \"T1087.002\" : 0,\n",
    "    \"T1087.003\" : 0,\n",
    "    \"T1087.001\" : 0,\n",
    "    \"T1098\" : 0,\n",
    "    \"T1098.001\" : 0,\n",
    "    \"T1098.003\" : 0,\n",
    "    \"T1098.002\" : 0,\n",
    "    \"T1098.005\" : 0,\n",
    "    \"T1098.004\" : 0,\n",
    "    \"T1650\" : 0,\n",
    "    \"T1583\" : 0,\n",
    "    \"T1583.005\" : 0,\n",
    "    \"T1583.002\" : 0,\n",
    "    \"T1583.001\" : 0,\n",
    "    \"T1583.008\" : 0,\n",
    "    \"T1583.004\" : 0,\n",
    "    \"T1583.007\" : 0,\n",
    "    \"T1583.003\" : 0,\n",
    "    \"T1583.006\" : 0,\n",
    "    \"T1595\" : 0,\n",
    "    \"T1595.001\" : 0,\n",
    "    \"T1595.002\" : 0,\n",
    "    \"T1595.003\" : 0,\n",
    "    \"T1557\" : 0,\n",
    "    \"T1557.002\" : 0,\n",
    "    \"T1557.003\" : 0,\n",
    "    \"T1557.001\" : 0,\n",
    "    \"T1071\" : 0,\n",
    "    \"T1071.004\" : 0,\n",
    "    \"T1071.002\" : 0,\n",
    "    \"T1071.003\" : 0,\n",
    "    \"T1071.001\" : 0,\n",
    "    \"T1010\" : 0,\n",
    "    \"T1560\" : 0,\n",
    "    \"T1560.003\" : 0,\n",
    "    \"T1560.002\" : 0,\n",
    "    \"T1560.001\" : 0,\n",
    "    \"T1123\" : 0,\n",
    "    \"T1119\" : 0,\n",
    "    \"T1020\" : 0,\n",
    "    \"T1020.001\" : 0,\n",
    "    \"T1197\" : 0,\n",
    "    \"T1547\" : 0,\n",
    "    \"T1547.014\" : 0,\n",
    "    \"T1547.002\" : 0,\n",
    "    \"T1547.006\" : 0,\n",
    "    \"T1547.008\" : 0,\n",
    "    \"T1547.015\" : 0,\n",
    "    \"T1547.010\" : 0,\n",
    "    \"T1547.012\" : 0,\n",
    "    \"T1547.007\" : 0,\n",
    "    \"T1547.001\" : 0,\n",
    "    \"T1547.005\" : 0,\n",
    "    \"T1547.009\" : 0,\n",
    "    \"T1547.003\" : 0,\n",
    "    \"T1547.004\" : 0,\n",
    "    \"T1547.013\" : 0,\n",
    "    \"T1037\" : 0,\n",
    "    \"T1037.002\" : 0,\n",
    "    \"T1037.001\" : 0,\n",
    "    \"T1037.003\" : 0,\n",
    "    \"T1037.004\" : 0,\n",
    "    \"T1037.005\" : 0,\n",
    "    \"T1176\" : 0,\n",
    "    \"T1217\" : 0,\n",
    "    \"T1185\" : 0,\n",
    "    \"T1110\" : 0,\n",
    "    \"T1110.004\" : 0,\n",
    "    \"T1110.002\" : 0,\n",
    "    \"T1110.001\" : 0,\n",
    "    \"T1110.003\" : 0,\n",
    "    \"T1612\" : 0,\n",
    "    \"T1115\" : 0,\n",
    "    \"T1651\" : 0,\n",
    "    \"T1580\" : 0,\n",
    "    \"T1538\" : 0,\n",
    "    \"T1526\" : 0,\n",
    "    \"T1619\" : 0,\n",
    "    \"T1059\" : 0,\n",
    "    \"T1059.002\" : 0,\n",
    "    \"T1059.009\" : 0,\n",
    "    \"T1059.007\" : 0,\n",
    "    \"T1059.008\" : 0,\n",
    "    \"T1059.001\" : 0,\n",
    "    \"T1059.006\" : 0,\n",
    "    \"T1059.004\" : 0,\n",
    "    \"T1059.005\" : 0,\n",
    "    \"T1059.003\" : 0,\n",
    "    \"T1092\" : 0,\n",
    "    \"T1586\" : 0,\n",
    "    \"T1586.003\" : 0,\n",
    "    \"T1586.002\" : 0,\n",
    "    \"T1586.001\" : 0,\n",
    "    \"T1554\" : 0,\n",
    "    \"T1584\" : 0,\n",
    "    \"T1584.005\" : 0,\n",
    "    \"T1584.002\" : 0,\n",
    "    \"T1584.001\" : 0,\n",
    "    \"T1584.004\" : 0,\n",
    "    \"T1584.007\" : 0,\n",
    "    \"T1584.003\" : 0,\n",
    "    \"T1584.006\" : 0,\n",
    "    \"T1609\" : 0,\n",
    "    \"T1613\" : 0,\n",
    "    \"T1136\" : 0,\n",
    "    \"T1136.003\" : 0,\n",
    "    \"T1136.002\" : 0,\n",
    "    \"T1136.001\" : 0,\n",
    "    \"T1543\" : 0,\n",
    "    \"T1543.001\" : 0,\n",
    "    \"T1543.004\" : 0,\n",
    "    \"T1543.002\" : 0,\n",
    "    \"T1543.003\" : 0,\n",
    "    \"T1555\" : 0,\n",
    "    \"T1555.003\" : 0,\n",
    "    \"T1555.001\" : 0,\n",
    "    \"T1555.005\" : 0,\n",
    "    \"T1555.002\" : 0,\n",
    "    \"T1555.004\" : 0,\n",
    "    \"T1485\" : 0,\n",
    "    \"T1132\" : 0,\n",
    "    \"T1132.002\" : 0,\n",
    "    \"T1132.001\" : 0,\n",
    "    \"T1486\" : 0,\n",
    "    \"T1565\" : 0,\n",
    "    \"T1565.003\" : 0,\n",
    "    \"T1565.001\" : 0,\n",
    "    \"T1565.002\" : 0,\n",
    "    \"T1001\" : 0,\n",
    "    \"T1001.001\" : 0,\n",
    "    \"T1001.003\" : 0,\n",
    "    \"T1001.002\" : 0,\n",
    "    \"T1074\" : 0,\n",
    "    \"T1074.001\" : 0,\n",
    "    \"T1074.002\" : 0,\n",
    "    \"T1030\" : 0,\n",
    "    \"T1530\" : 0,\n",
    "    \"T1602\" : 0,\n",
    "    \"T1602.002\" : 0,\n",
    "    \"T1602.001\" : 0,\n",
    "    \"T1213\" : 0,\n",
    "    \"T1213.003\" : 0,\n",
    "    \"T1213.001\" : 0,\n",
    "    \"T1213.002\" : 0,\n",
    "    \"T1005\" : 0,\n",
    "    \"T1039\" : 0,\n",
    "    \"T1025\" : 0,\n",
    "    \"T1622\" : 0,\n",
    "    \"T1491\" : 0,\n",
    "    \"T1491.002\" : 0,\n",
    "    \"T1491.001\" : 0,\n",
    "    \"T1140\" : 0,\n",
    "    \"T1610\" : 0,\n",
    "    \"T1587\" : 0,\n",
    "    \"T1587.002\" : 0,\n",
    "    \"T1587.003\" : 0,\n",
    "    \"T1587.004\" : 0,\n",
    "    \"T1587.001\" : 0,\n",
    "    \"T1652\" : 0,\n",
    "    \"T1006\" : 0,\n",
    "    \"T1561\" : 0,\n",
    "    \"T1561.001\" : 0,\n",
    "    \"T1561.002\" : 0,\n",
    "    \"T1484\" : 0,\n",
    "    \"T1484.002\" : 0,\n",
    "    \"T1484.001\" : 0,\n",
    "    \"T1482\" : 0,\n",
    "    \"T1189\" : 0,\n",
    "    \"T1568\" : 0,\n",
    "    \"T1568.003\" : 0,\n",
    "    \"T1568.002\" : 0,\n",
    "    \"T1568.001\" : 0,\n",
    "    \"T1114\" : 0,\n",
    "    \"T1114.003\" : 0,\n",
    "    \"T1114.001\" : 0,\n",
    "    \"T1114.002\" : 0,\n",
    "    \"T1573\" : 0,\n",
    "    \"T1573.002\" : 0,\n",
    "    \"T1573.001\" : 0,\n",
    "    \"T1499\" : 0,\n",
    "    \"T1499.003\" : 0,\n",
    "    \"T1499.004\" : 0,\n",
    "    \"T1499.001\" : 0,\n",
    "    \"T1499.002\" : 0,\n",
    "    \"T1611\" : 0,\n",
    "    \"T1585\" : 0,\n",
    "    \"T1585.003\" : 0,\n",
    "    \"T1585.002\" : 0,\n",
    "    \"T1585.001\" : 0,\n",
    "    \"T1546\" : 0,\n",
    "    \"T1546.008\" : 0,\n",
    "    \"T1546.009\" : 0,\n",
    "    \"T1546.010\" : 0,\n",
    "    \"T1546.011\" : 0,\n",
    "    \"T1546.001\" : 0,\n",
    "    \"T1546.015\" : 0,\n",
    "    \"T1546.014\" : 0,\n",
    "    \"T1546.012\" : 0,\n",
    "    \"T1546.016\" : 0,\n",
    "    \"T1546.006\" : 0,\n",
    "    \"T1546.007\" : 0,\n",
    "    \"T1546.013\" : 0,\n",
    "    \"T1546.002\" : 0,\n",
    "    \"T1546.005\" : 0,\n",
    "    \"T1546.004\" : 0,\n",
    "    \"T1546.003\" : 0,\n",
    "    \"T1480\" : 0,\n",
    "    \"T1480.001\" : 0,\n",
    "    \"T1048\" : 0,\n",
    "    \"T1048.002\" : 0,\n",
    "    \"T1048.001\" : 0,\n",
    "    \"T1048.003\" : 0,\n",
    "    \"T1041\" : 0,\n",
    "    \"T1011\" : 0,\n",
    "    \"T1011.001\" : 0,\n",
    "    \"T1052\" : 0,\n",
    "    \"T1052.001\" : 0,\n",
    "    \"T1567\" : 0,\n",
    "    \"T1567.002\" : 0,\n",
    "    \"T1567.001\" : 0,\n",
    "    \"T1567.003\" : 0,\n",
    "    \"T1190\" : 0,\n",
    "    \"T1203\" : 0,\n",
    "    \"T1212\" : 0,\n",
    "    \"T1211\" : 0,\n",
    "    \"T1068\" : 0,\n",
    "    \"T1210\" : 0,\n",
    "    \"T1133\" : 0,\n",
    "    \"T1008\" : 0,\n",
    "    \"T1083\" : 0,\n",
    "    \"T1222\" : 0,\n",
    "    \"T1222.002\" : 0,\n",
    "    \"T1222.001\" : 0,\n",
    "    \"T1495\" : 0,\n",
    "    \"T1187\" : 0,\n",
    "    \"T1606\" : 0,\n",
    "    \"T1606.002\" : 0,\n",
    "    \"T1606.001\" : 0,\n",
    "    \"T1592\" : 0,\n",
    "    \"T1592.004\" : 0,\n",
    "    \"T1592.003\" : 0,\n",
    "    \"T1592.001\" : 0,\n",
    "    \"T1592.002\" : 0,\n",
    "    \"T1589\" : 0,\n",
    "    \"T1589.001\" : 0,\n",
    "    \"T1589.002\" : 0,\n",
    "    \"T1589.003\" : 0,\n",
    "    \"T1590\" : 0,\n",
    "    \"T1590.002\" : 0,\n",
    "    \"T1590.001\" : 0,\n",
    "    \"T1590.005\" : 0,\n",
    "    \"T1590.006\" : 0,\n",
    "    \"T1590.004\" : 0,\n",
    "    \"T1590.003\" : 0,\n",
    "    \"T1591\" : 0,\n",
    "    \"T1591.002\" : 0,\n",
    "    \"T1591.001\" : 0,\n",
    "    \"T1591.003\" : 0,\n",
    "    \"T1591.004\" : 0,\n",
    "    \"T1615\" : 0,\n",
    "    \"T1200\" : 0,\n",
    "    \"T1564\" : 0,\n",
    "    \"T1564.008\" : 0,\n",
    "    \"T1564.005\" : 0,\n",
    "    \"T1564.001\" : 0,\n",
    "    \"T1564.002\" : 0,\n",
    "    \"T1564.003\" : 0,\n",
    "    \"T1564.004\" : 0,\n",
    "    \"T1564.010\" : 0,\n",
    "    \"T1564.009\" : 0,\n",
    "    \"T1564.006\" : 0,\n",
    "    \"T1564.007\" : 0,\n",
    "    \"T1574\" : 0,\n",
    "    \"T1574.012\" : 0,\n",
    "    \"T1574.001\" : 0,\n",
    "    \"T1574.002\" : 0,\n",
    "    \"T1574.004\" : 0,\n",
    "    \"T1574.006\" : 0,\n",
    "    \"T1574.005\" : 0,\n",
    "    \"T1574.013\" : 0,\n",
    "    \"T1574.007\" : 0,\n",
    "    \"T1574.008\" : 0,\n",
    "    \"T1574.009\" : 0,\n",
    "    \"T1574.010\" : 0,\n",
    "    \"T1574.011\" : 0,\n",
    "    \"T1562\" : 0,\n",
    "    \"T1562.008\" : 0,\n",
    "    \"T1562.002\" : 0,\n",
    "    \"T1562.007\" : 0,\n",
    "    \"T1562.004\" : 0,\n",
    "    \"T1562.001\" : 0,\n",
    "    \"T1562.010\" : 0,\n",
    "    \"T1562.003\" : 0,\n",
    "    \"T1562.006\" : 0,\n",
    "    \"T1562.009\" : 0,\n",
    "    \"T1562.011\" : 0,\n",
    "    \"T1525\" : 0,\n",
    "    \"T1070\" : 0,\n",
    "    \"T1070.003\" : 0,\n",
    "    \"T1070.002\" : 0,\n",
    "    \"T1070.008\" : 0,\n",
    "    \"T1070.007\" : 0,\n",
    "    \"T1070.009\" : 0,\n",
    "    \"T1070.001\" : 0,\n",
    "    \"T1070.004\" : 0,\n",
    "    \"T1070.005\" : 0,\n",
    "    \"T1070.006\" : 0,\n",
    "    \"T1202\" : 0,\n",
    "    \"T1105\" : 0,\n",
    "    \"T1490\" : 0,\n",
    "    \"T1056\" : 0,\n",
    "    \"T1056.004\" : 0,\n",
    "    \"T1056.002\" : 0,\n",
    "    \"T1056.001\" : 0,\n",
    "    \"T1056.003\" : 0,\n",
    "    \"T1559\" : 0,\n",
    "    \"T1559.001\" : 0,\n",
    "    \"T1559.002\" : 0,\n",
    "    \"T1559.003\" : 0,\n",
    "    \"T1534\" : 0,\n",
    "    \"T1570\" : 0,\n",
    "    \"T1036\" : 0,\n",
    "    \"T1036.007\" : 0,\n",
    "    \"T1036.001\" : 0,\n",
    "    \"T1036.008\" : 0,\n",
    "    \"T1036.004\" : 0,\n",
    "    \"T1036.005\" : 0,\n",
    "    \"T1036.003\" : 0,\n",
    "    \"T1036.002\" : 0,\n",
    "    \"T1036.006\" : 0,\n",
    "    \"T1556\" : 0,\n",
    "    \"T1556.001\" : 0,\n",
    "    \"T1556.007\" : 0,\n",
    "    \"T1556.006\" : 0,\n",
    "    \"T1556.004\" : 0,\n",
    "    \"T1556.008\" : 0,\n",
    "    \"T1556.002\" : 0,\n",
    "    \"T1556.003\" : 0,\n",
    "    \"T1556.005\" : 0,\n",
    "    \"T1578\" : 0,\n",
    "    \"T1578.002\" : 0,\n",
    "    \"T1578.001\" : 0,\n",
    "    \"T1578.003\" : 0,\n",
    "    \"T1578.004\" : 0,\n",
    "    \"T1112\" : 0,\n",
    "    \"T1601\" : 0,\n",
    "    \"T1601.002\" : 0,\n",
    "    \"T1601.001\" : 0,\n",
    "    \"T1111\" : 0,\n",
    "    \"T1621\" : 0,\n",
    "    \"T1104\" : 0,\n",
    "    \"T1106\" : 0,\n",
    "    \"T1599\" : 0,\n",
    "    \"T1599.001\" : 0,\n",
    "    \"T1498\" : 0,\n",
    "    \"T1498.001\" : 0,\n",
    "    \"T1498.002\" : 0,\n",
    "    \"T1046\" : 0,\n",
    "    \"T1135\" : 0,\n",
    "    \"T1040\" : 0,\n",
    "    \"T1095\" : 0,\n",
    "    \"T1571\" : 0,\n",
    "    \"T1003\" : 0,\n",
    "    \"T1003.008\" : 0,\n",
    "    \"T1003.005\" : 0,\n",
    "    \"T1003.006\" : 0,\n",
    "    \"T1003.004\" : 0,\n",
    "    \"T1003.001\" : 0,\n",
    "    \"T1003.003\" : 0,\n",
    "    \"T1003.007\" : 0,\n",
    "    \"T1003.002\" : 0,\n",
    "    \"T1027\" : 0,\n",
    "    \"T1027.001\" : 0,\n",
    "    \"T1027.010\" : 0,\n",
    "    \"T1027.004\" : 0,\n",
    "    \"T1027.007\" : 0,\n",
    "    \"T1027.009\" : 0,\n",
    "    \"T1027.011\" : 0,\n",
    "    \"T1027.006\" : 0,\n",
    "    \"T1027.005\" : 0,\n",
    "    \"T1027.002\" : 0,\n",
    "    \"T1027.003\" : 0,\n",
    "    \"T1027.008\" : 0,\n",
    "    \"T1588\" : 0,\n",
    "    \"T1588.003\" : 0,\n",
    "    \"T1588.004\" : 0,\n",
    "    \"T1588.005\" : 0,\n",
    "    \"T1588.001\" : 0,\n",
    "    \"T1588.002\" : 0,\n",
    "    \"T1588.006\" : 0,\n",
    "    \"T1137\" : 0,\n",
    "    \"T1137.006\" : 0,\n",
    "    \"T1137.001\" : 0,\n",
    "    \"T1137.002\" : 0,\n",
    "    \"T1137.003\" : 0,\n",
    "    \"T1137.004\" : 0,\n",
    "    \"T1137.005\" : 0,\n",
    "    \"T1201\" : 0,\n",
    "    \"T1120\" : 0,\n",
    "    \"T1069\" : 0,\n",
    "    \"T1069.003\" : 0,\n",
    "    \"T1069.002\" : 0,\n",
    "    \"T1069.001\" : 0,\n",
    "    \"T1566\" : 0,\n",
    "    \"T1598\" : 0,\n",
    "    \"T1598.002\" : 0,\n",
    "    \"T1598.003\" : 0,\n",
    "    \"T1598.001\" : 0,\n",
    "    \"T1566.001\" : 0,\n",
    "    \"T1566.002\" : 0,\n",
    "    \"T1566.003\" : 0,\n",
    "    \"T1647\" : 0,\n",
    "    \"T1542\" : 0,\n",
    "    \"T1542.003\" : 0,\n",
    "    \"T1542.002\" : 0,\n",
    "    \"T1542.004\" : 0,\n",
    "    \"T1542.001\" : 0,\n",
    "    \"T1542.005\" : 0,\n",
    "    \"T1057\" : 0,\n",
    "    \"T1055\" : 0,\n",
    "    \"T1055.004\" : 0,\n",
    "    \"T1055.001\" : 0,\n",
    "    \"T1055.011\" : 0,\n",
    "    \"T1055.015\" : 0,\n",
    "    \"T1055.002\" : 0,\n",
    "    \"T1055.009\" : 0,\n",
    "    \"T1055.013\" : 0,\n",
    "    \"T1055.012\" : 0,\n",
    "    \"T1055.008\" : 0,\n",
    "    \"T1055.003\" : 0,\n",
    "    \"T1055.005\" : 0,\n",
    "    \"T1055.014\" : 0,\n",
    "    \"T1572\" : 0,\n",
    "    \"T1090\" : 0,\n",
    "    \"T1090.004\" : 0,\n",
    "    \"T1090.002\" : 0,\n",
    "    \"T1090.001\" : 0,\n",
    "    \"T1090.003\" : 0,\n",
    "    \"T1012\" : 0,\n",
    "    \"T1620\" : 0,\n",
    "    \"T1219\" : 0,\n",
    "    \"T1563\" : 0,\n",
    "    \"T1563.002\" : 0,\n",
    "    \"T1563.001\" : 0,\n",
    "    \"T1021\" : 0,\n",
    "    \"T1021.007\" : 0,\n",
    "    \"T1021.003\" : 0,\n",
    "    \"T1021.001\" : 0,\n",
    "    \"T1021.002\" : 0,\n",
    "    \"T1021.004\" : 0,\n",
    "    \"T1021.005\" : 0,\n",
    "    \"T1021.006\" : 0,\n",
    "    \"T1018\" : 0,\n",
    "    \"T1091\" : 0,\n",
    "    \"T1496\" : 0,\n",
    "    \"T1207\" : 0,\n",
    "    \"T1014\" : 0,\n",
    "    \"T1053\" : 0,\n",
    "    \"T1053.002\" : 0,\n",
    "    \"T1053.007\" : 0,\n",
    "    \"T1053.003\" : 0,\n",
    "    \"T1053.005\" : 0,\n",
    "    \"T1053.006\" : 0,\n",
    "    \"T1029\" : 0,\n",
    "    \"T1113\" : 0,\n",
    "    \"T1597\" : 0,\n",
    "    \"T1597.002\" : 0,\n",
    "    \"T1597.001\" : 0,\n",
    "    \"T1596\" : 0,\n",
    "    \"T1596.004\" : 0,\n",
    "    \"T1596.001\" : 0,\n",
    "    \"T1596.003\" : 0,\n",
    "    \"T1596.005\" : 0,\n",
    "    \"T1596.002\" : 0,\n",
    "    \"T1593\" : 0,\n",
    "    \"T1593.003\" : 0,\n",
    "    \"T1593.002\" : 0,\n",
    "    \"T1593.001\" : 0,\n",
    "    \"T1594\" : 0,\n",
    "    \"T1505\" : 0,\n",
    "    \"T1505.004\" : 0,\n",
    "    \"T1505.001\" : 0,\n",
    "    \"T1505.005\" : 0,\n",
    "    \"T1505.002\" : 0,\n",
    "    \"T1505.003\" : 0,\n",
    "    \"T1648\" : 0,\n",
    "    \"T1489\" : 0,\n",
    "    \"T1129\" : 0,\n",
    "    \"T1072\" : 0,\n",
    "    \"T1518\" : 0,\n",
    "    \"T1518.001\" : 0,\n",
    "    \"T1608\" : 0,\n",
    "    \"T1608.004\" : 0,\n",
    "    \"T1608.003\" : 0,\n",
    "    \"T1608.005\" : 0,\n",
    "    \"T1608.006\" : 0,\n",
    "    \"T1608.001\" : 0,\n",
    "    \"T1608.002\" : 0,\n",
    "    \"T1528\" : 0,\n",
    "    \"T1539\" : 0,\n",
    "    \"T1649\" : 0,\n",
    "    \"T1558\" : 0,\n",
    "    \"T1558.004\" : 0,\n",
    "    \"T1558.001\" : 0,\n",
    "    \"T1558.003\" : 0,\n",
    "    \"T1558.002\" : 0,\n",
    "    \"T1553\" : 0,\n",
    "    \"T1553.002\" : 0,\n",
    "    \"T1553.006\" : 0,\n",
    "    \"T1553.001\" : 0,\n",
    "    \"T1553.004\" : 0,\n",
    "    \"T1553.005\" : 0,\n",
    "    \"T1553.003\" : 0,\n",
    "    \"T1195\" : 0,\n",
    "    \"T1195.003\" : 0,\n",
    "    \"T1195.001\" : 0,\n",
    "    \"T1195.002\" : 0,\n",
    "    \"T1218\" : 0,\n",
    "    \"T1218.003\" : 0,\n",
    "    \"T1218.001\" : 0,\n",
    "    \"T1218.002\" : 0,\n",
    "    \"T1218.004\" : 0,\n",
    "    \"T1218.014\" : 0,\n",
    "    \"T1218.013\" : 0,\n",
    "    \"T1218.005\" : 0,\n",
    "    \"T1218.007\" : 0,\n",
    "    \"T1218.008\" : 0,\n",
    "    \"T1218.009\" : 0,\n",
    "    \"T1218.010\" : 0,\n",
    "    \"T1218.011\" : 0,\n",
    "    \"T1218.012\" : 0,\n",
    "    \"T1082\" : 0,\n",
    "    \"T1614\" : 0,\n",
    "    \"T1614.001\" : 0,\n",
    "    \"T1016\" : 0,\n",
    "    \"T1016.001\" : 0,\n",
    "    \"T1049\" : 0,\n",
    "    \"T1033\" : 0,\n",
    "    \"T1216\" : 0,\n",
    "    \"T1216.001\" : 0,\n",
    "    \"T1007\" : 0,\n",
    "    \"T1569\" : 0,\n",
    "    \"T1569.001\" : 0,\n",
    "    \"T1569.002\" : 0,\n",
    "    \"T1529\" : 0,\n",
    "    \"T1124\" : 0,\n",
    "    \"T1080\" : 0,\n",
    "    \"T1221\" : 0,\n",
    "    \"T1205\" : 0,\n",
    "    \"T1205.001\" : 0,\n",
    "    \"T1205.002\" : 0,\n",
    "    \"T1537\" : 0,\n",
    "    \"T1127\" : 0,\n",
    "    \"T1127.001\" : 0,\n",
    "    \"T1199\" : 0,\n",
    "    \"T1552\" : 0,\n",
    "    \"T1552.003\" : 0,\n",
    "    \"T1552.008\" : 0,\n",
    "    \"T1552.005\" : 0,\n",
    "    \"T1552.007\" : 0,\n",
    "    \"T1552.001\" : 0,\n",
    "    \"T1552.002\" : 0,\n",
    "    \"T1552.006\" : 0,\n",
    "    \"T1552.004\" : 0,\n",
    "    \"T1535\" : 0,\n",
    "    \"T1550\" : 0,\n",
    "    \"T1550.001\" : 0,\n",
    "    \"T1550.002\" : 0,\n",
    "    \"T1550.003\" : 0,\n",
    "    \"T1550.004\" : 0,\n",
    "    \"T1204\" : 0,\n",
    "    \"T1204.002\" : 0,\n",
    "    \"T1204.003\" : 0,\n",
    "    \"T1204.001\" : 0,\n",
    "    \"T1078\" : 0,\n",
    "    \"T1078.004\" : 0,\n",
    "    \"T1078.001\" : 0,\n",
    "    \"T1078.002\" : 0,\n",
    "    \"T1078.003\" : 0,\n",
    "    \"T1125\" : 0,\n",
    "    \"T1497\" : 0,\n",
    "    \"T1497.001\" : 0,\n",
    "    \"T1497.003\" : 0,\n",
    "    \"T1497.002\" : 0,\n",
    "    \"T1600\" : 0,\n",
    "    \"T1600.002\" : 0,\n",
    "    \"T1600.001\" : 0,\n",
    "    \"T1102\" : 0,\n",
    "    \"T1102.002\" : 0,\n",
    "    \"T1102.001\" : 0,\n",
    "    \"T1102.003\" : 0,\n",
    "    \"T1047\" : 0,\n",
    "    \"T1220\" : 0,\n",
    "    }\n",
    "\n",
    "# loop through all events and increase count of a TTP in dictionary if an event has that TTP\n",
    "for i in all:\n",
    "    # check for a specific TAG\n",
    "    for tag in i['Event']['Tag']:\n",
    "        if tag['name'] == TAG:\n",
    "            galaxies = i['Event']['Galaxy']\n",
    "        else:\n",
    "            continue\n",
    "        for j in galaxies:\n",
    "            if j['type'] == 'mitre-attack-pattern':\n",
    "                for k in j['GalaxyCluster']:\n",
    "                    ttp = k['meta']['external_id'][0]\n",
    "                    if ttp in ttps:\n",
    "                        ttps[ttp] += 1\n",
    "\n",
    "# plotting data\n",
    "ttps_data = pd.Series(data=ttps, index=list(ttps.keys()))\n",
    "(ttps_data\n",
    "    [lambda s: s>11]\n",
    "    .plot.barh()\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Get a list of IOCs (attributes) from MISP which can be added to an IDS systems to block/alert\n",
    "\n",
    "- script `iocs-from-misp-to-cs.py` takes MISP attributes and converts them to CrowdStrike Indicators (IP address, SHA256, MD5, and domain)\n",
    "- returns a list of indicators (`inidicators`) that can be saved to a file or uploaded to CrowdStrike. See `misp-to-crowdstrike.py` for the latter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from validators import ip_address\n",
    "\n",
    "def GetMispAttributes(misp_url, misp_key, misp_verifycert):\n",
    "    # authenticate to misp \n",
    "    misp = PyMISP(misp_url, misp_key, misp_verifycert, debug=False)\n",
    "\n",
    "    # get all IOCs with IDS flag set to true and publixhed in last 89 days\n",
    "    attributes = misp.search(controller='attributes', to_ids=1, pythonify=True, publish_timestamp='89d')\n",
    "\n",
    "    # add IOCs to bucket\n",
    "    ipv4 = []\n",
    "    ipv6 = []\n",
    "    domain = []\n",
    "    url = []\n",
    "    hostname = []\n",
    "    sha256 = []\n",
    "    md5 = []\n",
    "    sha1 = []\n",
    "    other = []\n",
    "\n",
    "    for i in attributes:\n",
    "        if (i.type == \"ip-dst\"):\n",
    "            # check if IPv4 or IPv6\n",
    "            if (ip_address.ipv4(i.value)):\n",
    "                ipv4.append(i.value)\n",
    "            elif (ip_address.ipv6(i.value)):\n",
    "                ipv6.append(i.value)\n",
    "            else:\n",
    "                other.append(i.value)\n",
    "        elif (i.type == \"ip-dst|port\"):\n",
    "            addr = ipv4.append(i.value.split('|')[0])\n",
    "            # check if IPv4 or IPv6\n",
    "            if (ip_address.ipv4(addr)):\n",
    "                ipv4.append(addr)\n",
    "            elif (ip_address.ipv6(addr)):\n",
    "                ipv6.append(addr)\n",
    "            else:\n",
    "                other.append(addr)\n",
    "        elif (i.type == \"domain\"):\n",
    "            domain.append(i.value)\n",
    "        elif (i.type == \"domain|ip\"):\n",
    "            # split domain an ip, append to respective lists\n",
    "            domain.append(i.value.split('|')[0])\n",
    "            addr = ipv4.append(i.value.split('|')[1])\n",
    "            # check if IPv4 or IPv6\n",
    "            if (ip_address.ipv4(addr)):\n",
    "                ipv4.append(addr)\n",
    "            elif (ip_address.ipv6(addr)):\n",
    "                ipv6.append(addr)\n",
    "            else:\n",
    "                other.append(addr)\n",
    "        elif (i.type == \"url\"):\n",
    "            url.append(i.value)\n",
    "        elif (i.type == \"hostname\"):\n",
    "            hostname.append(i.value)\n",
    "        elif (i.type == \"hostname|port\"):\n",
    "            # split hostand and port\n",
    "            hostname.append(i.value.split('|')[0])\n",
    "        elif (i.type == \"sha256\"):\n",
    "            sha256.append(i.value)\n",
    "        elif (i.type == \"filename|sha256\"):\n",
    "            # split filename and hash, append hash to sha256 list\n",
    "            sha256.append(i.value.split('|')[1])\n",
    "        elif (i.type == \"md5\"):\n",
    "            md5.append(i.value)\n",
    "        elif (i.type == \"filename|md5\"):\n",
    "            # split filename and hash, append hash to md5 list\n",
    "            md5.append(i.value.split('|')[1])\n",
    "        elif (i.type == \"sha1\"):\n",
    "            sha1.append(i.value)\n",
    "        elif (i.type == \"filename|sha1\"):\n",
    "            # split filename and hash, append hash to sha1 list\n",
    "            sha1.append(i.value.split('|')[1])\n",
    "        else:\n",
    "            other.append(i.value)\n",
    "\n",
    "    ipv4_length = len(ipv4)\n",
    "    ipv6_length = len(ipv6)\n",
    "    domain_length = len(domain)\n",
    "    url_length = len(url)\n",
    "    hostname_length = len(hostname)\n",
    "    sha256_length = len(sha256)\n",
    "    sha1_length = len(sha1)\n",
    "    md5_length = len(md5)\n",
    "\n",
    "\n",
    "    # print totals\n",
    "    print(f\"[+] Total MISP indicators: {ipv4_length + ipv6_length + domain_length + url_length + hostname_length + sha256_length + sha1_length + md5_length}\")\n",
    "    print(f\"+++ Network Indicators +++ \")\n",
    "    print(f\"- IPv4 addresses: {ipv4_length}\")\n",
    "    print(f\"- IPv6 addresses: {ipv6_length}\")\n",
    "    print(f\"- Domains: {domain_length}\")\n",
    "    print(f\"- URLs: {url_length}\")\n",
    "    print(f\"- Hostnames: {hostname_length}\")\n",
    "    print(f\"+++ Endpoint Indicators +++\")\n",
    "    print(f\"- SHA256 hashes: {sha256_length}\")\n",
    "    print(f\"- SHA1 hashes: {sha1_length}\")\n",
    "    print(f\"- MD5 hashes: {md5_length}\")\n",
    "    print(f\"[+] Total \\\"other\\\" IOCs: {len(other)}\")\n",
    "    print(f\"[+] Total indicators to upload to CrowdStrike: {ipv4_length + ipv6_length + sha256_length + md5_length + domain_length}\")\n",
    "\n",
    "    # return indicators dictionary of IOC type and list\n",
    "    cs_indicators = {\n",
    "        \"ipv4\": ipv4,\n",
    "        \"ipv6\": ipv6,\n",
    "        \"domain\": domain,\n",
    "        \"sha256\": sha256,\n",
    "        \"md5\": md5,\n",
    "    }\n",
    "    return cs_indicators\n",
    "\n",
    "\n",
    "indicators = GetMispAttributes(MISP_URL, MISP_KEY, MISP_VERIFYCERT)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.3"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}