MISP-to-EIQ is a simple Python script that will connect to your MISP instance, download the given MISP Event ID and send it to an EclecticIQ instance as a valid EclecticIQ JSON entity of the given type.
We consider the code to be stable enough to use in production. While it is not possible to test for every combination of MISP objects & attributes, MISP-to-EIQ has been running in our production environment for longer periods without any significant problems/issues/crashes.
For configuration options, refer to the README.md in the config/ directory.
- Python 3 (uses 'requests', 'urllib3', 'datetime')
- EIQlib module from Sebastiaan Groot (eiqjson.py and eiqcalls.py)
- A MISP account with a valid API token
- An EclecticIQ account (user+pass) and EIQ 'Source' token
- Clone the repository
- Create a 'settings.py' file in the config/ directory (refer to the README.md)
- Run ./misp-to-eiq.py [-v] <#> (-v for verbose, # should be a valid MISP Event ID)
Running ./misp-to-eiq.py without command-line options or -h
will display help:
-v
/ --verbose
will display progress/error info
-c
/ --confidence
lets you set the confidence level for the EclecticIQ entity
-i
/ --impact
lets you set the (likely) impact for the EclecticIQ entity
-t
/ --type
lets you choose what to ingest the MISP event as: [i]ndicator or [s]ighting
-s
/ --simulate
do not actually ingest anything into EclecticIQ, just pretend (useful with -v
)
-n
/ --name
override the default TITLETAG setting from the configuration file
-d
/ --duplicate
do not update the existing entity in EclecticIQ, but create duplicates (default: disabled)
(c) 2018 Arnim Eijkhoudt and Sebastiaan Groot (for his great EIQ lib / submodule)
This software is GPLv3 licensed, except where otherwise indicated.