dnMisp 1.0.2.1

dnMisp

dnMisp is a simple, MISP Rest API consumer .Net Standard 2.0 library.

Setup

Package manager

Install-Package dnMisp

.Net CLI

dotnet add package dnMisp

Available features

The beta version is very focused on the management of IOCs, and the management & administration of organisations and users has not yet been integrated.

Here is a more detailed description of what has and has not been integrated.

Supported

• Events: Get, Add, Update, Remove, Push to ZMQ

• Attributes: Get, Add, Update, Remove

• Tag: Add, Remove a tag

• Proposal: Add

• Add, Remove:

  • malware sample
  • hashes
  • detection link
  • detection name
  • attachments
  • reg keys
  • patterns
  • pipes
  • mutex
  • yara rules
  • threat actor
  • network activity:
    • ip dest, src
    • hostname
    • domain, domain IP
    • URIs
    • user Agents
    • traffic pattern
    • snort rules
    • ASNs
    • 'other' network activities
  • email attributes (source, destination, subject, attachment, header)
  • targeting data (email, user, machine, organization, location, external)
  • internal reference (links, comments, text, others)
  • others (comments, counters, texts)

  Not yet supported:

  • galaxies & galaxy clusters
  • proposals
  • users
  • organisations
  • servers
  • feeds
  • sightings
  • warning lists
  • notice lists

  Feels free to contribute to add new or missing features !

General features

How to create a new Misp consumer instance:

MispConsumer _mispClient = MispConsumer.Create<MispConsumer>(
    YourConfig.MispUri,
    YourConfig.MispAuthKey);

Getting an event by its identifier:

/* Get event by event ID */
MispEvent mispEvent = await _mispClient.GetEvent(mispEventId);

Download a malware sample by its hash:

/* Download a malware by hash */
MalwareSampleList results = (await _mispClient.DownloadMalware(md5))?.Results;

if (results == null)
	return;

foreach (var item in results)
{
    string mispEventId = item.EventId;
    string base64data = item.Base64;

    // Do stuff there
}

Using search API:

/* Search events */
RestSearchQuery query = new RestSearchQuery()
{
    Tags = new RestSearchOperator<string>
    {
        Or = {
            "ATT&CK:T1064:Scripting",
            "VT:attachment",
            "YARA:File_Is_Office_Open_XML"
        },
        Not =
        {
            "YARA:File_Is_Office_Doc"
        }
    },
    Limit = 10,
    Page = 1,
    Last = "5d"
};

List<MispEvent> events = await _mispClient.SearchEvent(query);
foreach (var @event in events)
{
    // Do stuff there
}

Credits

• This project is under copyright of the Airbus CERT and distributed under the Apache 2.0 license