Skip to content

v0.2 - IOC Enrichment

Choose a tag to compare

View all tags
@HalfTimeOfLife HalfTimeOfLife released this 15 Jul 13:42
· 48 commits to main since this release
v0.2
cefc4fc

Second release of mispSK.

Added

  • ioc_enrich.py: enrich MISP hash attributes (md5, sha1, sha256) via VirusTotal and IP attributes (ip-src, ip-dst) via AbuseIPDB
  • mispsk/enrichers.py: reusable VTEnricher and AbuseIPDBEnricher API wrappers
  • Enrichment classification, MISP tags, and attribute comments generation
  • --dry-run mode to preview changes without modifying MISP
  • --max-age-days option to control AbuseIPDB lookup freshness
  • Tree-style terminal output for enrichment results
  • Unit tests covering enrichment logic, API interactions, caching, error handling, and MISP client lookups

Changed

  • MISP event lookup methods moved into MispClient for reuse across scripts
  • Enrichment logic extracted from CLI scripts into reusable package modules
  • Added VirusTotal rate limiting configuration through VT_RATE_LIMIT_DELAY

Fixed

  • Removed duplicated MISP lookup logic from scripts
  • Improved enrichment reliability with IOC lookup caching

See CHANGELOG.md for full details and ROADMAP.md.

Assets 2
Loading