forked from MISP/PyMISP
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGELOG.txt
3388 lines (2784 loc) · 110 KB
/
CHANGELOG.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Changelog
=========
v2.4.133 (2020-10-16)
---------------------
New
~~~
- [attribute type] telfhash added. [Alexandre Dulaunoy]
- [add_gitlab_user] new gitlab user fetch script to MISP object.
[Alexandre Dulaunoy]
usage: add_gitlab_user.py [-h] -e EVENT [-f] -u USERNAME [-l LINK]
Fetch GitLab user details and add it in object in MISP
optional arguments:
-h, --help show this help message and exit
-e EVENT, --event EVENT
Event ID to update
-f, --force-template-update
-u USERNAME, --username USERNAME
GitLab username to add
-l LINK, --link LINK Url to access the GitLab instance, Default is
www.gitlab.com.
- [example] add_github_user example - WiP. [Alexandre Dulaunoy]
usage: add_github_user.py [-h] -e EVENT [-f] -u USERNAME
Fetch GitHub user details and add it in object in MISP
optional arguments:
-h, --help show this help message and exit
-e EVENT, --event EVENT
Event ID to update
-f, --force-template-update
-u USERNAME, --username USERNAME
GitHub username to add
- Method to get the new version of the templates. [Raphaël Vinot]
- Delete tags via update_attribute, search by sharing group. [Tom King]
Changes
~~~~~~~
- Bump object templates. [Raphaël Vinot]
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump test cases. [Raphaël Vinot]
- [type] updated. [Alexandre Dulaunoy]
- Bump file obj version in tests. [Raphaël Vinot]
- [data] misp-objects updated. [Alexandre Dulaunoy]
- Bump build system to poetry 1.1. [Raphaël Vinot]
- [type] new type added. [Alexandre Dulaunoy]
- [add_github_user] add ssh keys of the user in the MISP object.
[Alexandre Dulaunoy]
- [add_github_user] more fields added from the GitHub API. [Alexandre
Dulaunoy]
- Bump deps, objects. [Raphaël Vinot]
- Add test for delete=True in get_event. [Raphaël Vinot]
- [add_github_user] add following to the MISP object. [Alexandre
Dulaunoy]
- Bump dependencies. [Raphaël Vinot]
- Pass a list to add_attributes. [Raphaël Vinot]
- Use MISPObject instead of GenericObjectGenerator. [Raphaël Vinot]
- [doc] add a reference to the license. [Alexandre Dulaunoy]
- Add docstrings and extend conf.py for RTD. [Lott, Christopher
(cl778h)]
Add minimal docstrings to public methods so ReadTheDocs will display them.
Add autodoc mock import for lief so RTD can generate HTML for tools.
This fixes issue #626
- Remove PyMISPExpanded from the docs. [Raphaël Vinot]
- Add comments to ELF, PE, and MachO object generators. [Raphaël Vinot]
- Improve error message, add comments, rename whitelist->allowedlist.
[Raphaël Vinot]
- Remove SG search for search() func as this doesn't support SG
searching, but the index does. [Tom King]
Fix
~~~
- Test on macosx. [Raphaël Vinot]
Fix #630
- Do not modify default_attributes_parameters in MISPObject. [Raphaël
Vinot]
- Wrong call to pymisp.search_index. [Raphaël Vinot]
- Few outdated calls in the tutorial. [Raphaël Vinot]
- Make flake8 happy. [Raphaël Vinot]
- Merge SG params to allow search. [Tom King]
Other
~~~~~
- Fix PyMISP repo URL. [garanews]
MISP/PyMISP vs CIRCL/PyMISP
- Fix typo. [garanews]
fix typo
- Attempt to decode utf-8-sig encoded emails. [seamus tuohy]
eml files downloaded from Windows Online security on some Windows 11
systems are automatically encoded in UTF with a byte order mark (BOM)
at the front of the file. This will cause the email parser to fail.
This is a somewhat isolated problem. It only will affects a small
subset of Windows users who download and re-upload eml files. But,
this small subset of users is the target user-base for the MISP
email module: low expertiese users who wish to quickly share
high-value indicators on an ad-hoc basis.
While this fix could be tacked onto the MISP email module instead of
here, I beleive that this fix is more appropriate in the PyMISP object
code. As the "email" object parser this object should be built to
parse all manner of emails that it may encounter. This includes common
malformations such as this one and, even horrors such as, the .msg
format. This commit adds a generically named "attempt_decoding"
function which can be expanded to address all manner of sins that
are encountered in the future.
v2.4.131 (2020-09-08)
---------------------
New
~~~
- [test] Validate tag removal. [Raphaël Vinot]
- [describeTypes] sha3 added. [Alexandre Dulaunoy]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- [describeTypes] updated. [Alexandre Dulaunoy]
- [describeTypes] updated. [Alexandre Dulaunoy]
- Bump objects. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Bump file template version. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- Rename blacklist -> blocklist. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
v2.4.130 (2020-08-20)
---------------------
New
~~~
- Blacklist methods. [Raphaël Vinot]
- Add list of missing calls. [Raphaël Vinot]
- Add test_obj_references_export. [louis]
- Add MISPObject.standalone property. [louis]
Setting MISPObject.standalone updates MISPObject._standalone and
add/removes "ObjectReference" from AbstractMISP.__not_jsonable using
update_not_jsonable/_remove_from_not_jsonable.
- Add AbstractMISP._remove_from_not_jsonable. [louis]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- Bump types. [Raphaël Vinot]
- [testlive_comprehensive] Updated generic tagging method to match
changes in MISP. [mokaddem]
- Cleanup blocklist methods. [Raphaël Vinot]
- Remove outdated example. [Raphaël Vinot]
Fix #611
- New test_get_non_exists_event. [Jakub Onderka]
- Bump dependencies. [Raphaël Vinot]
- Enable more tests. [Raphaël Vinot]
- Make get_object return a not standalone object. [louis]
- Remove standalone default value from MISPObject children c'tor.
[louis]
MISPObject.__init__ sets standalone=True by default, so there is no
need to do it in its child classes.
- Make MISPObject standalone by default. [louis]
standalone defaults to True in MISPObject.__init__, and is set to False
when the object is added to an event.
- Add MISPObject._standalone type. [louis]
Fix
~~~
- Bump file template version. [Raphaël Vinot]
- Test_get_non_exists_event. [Jakub Onderka]
- IP removed from the public DNS list. [Raphaël Vinot]
- Example using deprecated calls. [Raphaël Vinot]
fix #602
- Add STIX XML output for the search. [Raphaël Vinot]
Use stix-xml as return_format.
Fix #600 https://github.com/MISP/MISP/issues/5618
- Dummy event example. [Raphaël Vinot]
Fix #598
Other
~~~~~
- Exclude section correlation .rsrc and zero-filled. [deku]
- Linting/Add missing whitespace. [Paal Braathen]
- Remove explicit loglevel checking. [Paal Braathen]
- Remove explicit traceback printing. [Paal Braathen]
- Master branch has been renamed to main. [Arcuri Davide]
- Update README.md. [Raphaël Vinot]
fix: #599
v2.4.128 (2020-06-22)
---------------------
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Add a few test cases. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
v2.4.127.1 (2020-06-19)
-----------------------
New
~~~
- Optionally include deleted attributes/objects in feed. [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Add test case for get event deleted. [Raphaël Vinot]
- Add test case for search deleted. [Raphaël Vinot]
- Update comments for search. [Raphaël Vinot]
Fix
~~~
- Keep deleted key in MISPObject and MISPObjectAttribute. [Raphaël
Vinot]
v2.4.127 (2020-06-16)
---------------------
New
~~~
- Add helper and test case for GitVulnFinderObject. [Raphaël Vinot]
- Add git-commit-id type. [Raphaël Vinot]
- Add deleted in field export. [Raphaël Vinot]
Fix #586
- Timeout for connection/request, fixes #584. [Christophe Vandeplas]
Changes
~~~~~~~
- Bump Changelog. [Raphaël Vinot]
- Rename master -> main. [Raphaël Vinot]
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Rename branches master -> main. [Raphaël Vinot]
- Remove extra parameter in change_user_password. [Raphaël Vinot]
Fix
~~~
- Do not fail if the attribute value is not a string. [Raphaël Vinot]
- Properly strip value in MISPObject.add_attribute, take 2. [Raphaël
Vinot]
Fix #546
- Properly strip value in MISPObject.add_attribute. [Raphaël Vinot]
Fix #546
- Deleted is not always required in the feed export. [Raphaël Vinot]
- Make mypy happy. [Raphaël Vinot]
- Fixes bug in timeout change. [Christophe Vandeplas]
- Fixes bug in timeout change. [Christophe Vandeplas]
- Fixes bug in timeout change. [Christophe Vandeplas]
- Fixes bug in timeout change. [Christophe Vandeplas]
- Fixes bug in timeout change. [Christophe Vandeplas]
hail to Rafiot
- Fixes bug in timeout change. [Christophe Vandeplas]
- Fixes bug in timeout change. [Christophe Vandeplas]
Other
~~~~~
- Previously file object was reporting the libmagic description of a
file instead of the mimetype. According to [MISP
DataModels](https://www.misp-project.org/datamodels/#types) ``` mime-
type: A media type (also MIME type and content type) is a two-part
identifier for file formats and format contents transmitted on the
Internet ``` more precisely defined in
[RFC2045](https://tools.ietf.org/html/rfc2045) and others. [Troy Ross]
The description returned by libmagic is more useful than the generic mime-type,
but I did not find a place to put the description in the current data model.
- Fix end of line encoding of examples/cytomic_orion.py. [Sebastian
Wagner]
v2.4.126 (2020-05-18)
---------------------
New
~~~
- Test search with timestamp. [Raphaël Vinot]
- Add testcase for updating partial event. [Raphaël Vinot]
- Add pyfaup as optional dependency. [Raphaël Vinot]
- [dev] add microblog object tool. [VVX7]
- Very simple test case for rest search on objects. [Raphaël Vinot]
- Self registration, object level search (initial) [Raphaël Vinot]
- [dev] add flag to get extended misp event. [VVX7]
- [dev] add flag to get extended misp event. [VVX7]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-object. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Add test for feed partial update. [Raphaël Vinot]
- Strip empty parameters in build_complex_query. [Raphaël Vinot]
Fix #577
- Simplify delete_attribute. [Raphaël Vinot]
- Bump travis install. [Raphaël Vinot]
- Add comment in microblog object. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- [dev] clean up how keys are accessed in self._parameters. [VVX7]
- [dev] use isinstance() type check. [VVX7]
- [dev] fix abstract generator import. add logger. [VVX7]
- [dev] change type() == list. [VVX7]
- Bump misp-objects. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- [dev] remove duplicate line. [VVX7]
- [dev] add extend_event() test. chg typo in get_event() [VVX7]
- Re-Bump CHANGELOG. [Raphaël Vinot]
Fix
~~~
- Settings is not required in MISPFeed. [Raphaël Vinot]
- Properly skip timestamp in __iter__ when needed. [Raphaël Vinot]
- Catch exception when liblua-5.3 is not present. [Raphaël Vinot]
- Make flake8 happy. [Raphaël Vinot]
- Properly load feeds, fix undefined variable. [Raphaël Vinot]
- Make flake8 happy. [Raphaël Vinot]
- Remove extra print. [Raphaël Vinot]
- Typo, add test for extended event. [Raphaël Vinot]
Other
~~~~~
- Update docstring in api.py. [Bernhard E. Reiter]
* remove typo in ssl parameter docstring.
* Add hint that other certs (which are not in the default CAs, but also are not self signed in a strict sense) can also use the CA_BUNDLE function of the ssl parameter.
v2.4.125 (2020-04-30)
---------------------
New
~~~
- Extended option on get event. [Raphaël Vinot]
Related to #567
Changes
~~~~~~~
- Bump version in pyproject. [Raphaël Vinot]
- Bump CHANGELOG. [Raphaël Vinot]
- Bump objects, deps. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Remove old suricata script, keep reference to old code. [Raphaël
Vinot]
Fix
~~~
- Enable autoalert on admin user. [Raphaël Vinot]
- [abstract] Forces file to be read with utf8 encoding. [mokaddem]
- Properly handle timezone in tests. [Raphaël Vinot]
Other
~~~~~
- Update up.py. [Raphaël Vinot]
Fix #563
- Fixed __query_virustotal return type. [DocArmoryTech]
__query_virustotal returned a Response object and not the json expected; modified so that report_json is returned instead of report.
v2.4.124 (2020-03-30)
---------------------
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Add option to aggregare by country. [Raphaël Vinot]
- [CSSE COVID] Publish the event immediately. [Raphaël Vinot]
- Add changelog and readme in the package. [Raphaël Vinot]
- Bump version in pyproject. [Raphaël Vinot]
Fix
~~~
- Strip every string in AbstractMISP. [Raphaël Vinot]
fix #546
- Incorrect expectation of attribute value to be a str - take 2.
[Raphaël Vinot]
Related #553
- Incorrect expectation of attribute value to be a str. [Raphaël Vinot]
Fix #553
Other
~~~~~
- Dos2unix examples/stats_report.py. [Sebastian Wagner]
- Cytomic Orion API access. [Koen Van Impe]
- Add organisations from CSV. [Koen Van Impe]
- Minor updates to vmray_automation for travis. [Koen Van Impe]
- VMRay Automation with ExpandedPyMISP. [Koen Van Impe]
v2.4.123 (2020-03-10)
---------------------
New
~~~
- Add import script for dxy data. [Raphaël Vinot]
- Csse covid19 daily report importer. [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump changelog. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- JSON files are UTF8. [Raphaël Vinot]
Bump dev deps, update comment
- Add tag, set distribution, add file and source (CSSE importer)
[Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
v2.4.122 (2020-02-26)
---------------------
New
~~~
- Add uuid by default in MISPEvent, add F/L seen in feed output.
[Raphaël Vinot]
- Admin script to setup a sync server. [Raphaël Vinot]
- Add feed generation example in notebook. [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Comments were still referencing pipenv. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Bump dep. [Raphaël Vinot]
- Fix typo in readme. [Raphaël Vinot]
- Use bionic on travis. [Raphaël Vinot]
- Add poetry support. [Raphaël Vinot]
Fix
~~~
- Test cases & template version. [Raphaël Vinot]
- Mypy, more typing. [Raphaël Vinot]
- Do not skip data in add_attribute methods. [Raphaël Vinot]
- Remove references to the old API. [Raphaël Vinot]
Other
~~~~~
- Use poetry everywhere, fix readme. [Raphaël Vinot]
v2.4.121.1 (2020-02-07)
-----------------------
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
Fix
~~~
- Make lief optional again. [Raphaël Vinot]
fix #538
v2.4.121 (2020-02-06)
---------------------
New
~~~
- Add includeDecayScore to rest search. [VVX7]
- Support for first_seen/last_seen. [Raphaël Vinot]
Cleaner import of datetime
- [attributes] chrome-extension-id added. [Alexandre Dulaunoy]
Changes
~~~~~~~
- Bump version. [Raphaël Vinot]
- Do not install neo by default. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- More flexible when an event is in a weird state. [Raphaël Vinot]
- Str to int, properly load SharingGroup. [Raphaël Vinot]
Fix #535
- Bump deps, add pep8 test. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- Support dict in tag/untag. [Raphaël Vinot]
- Test update last seen. [Raphaël Vinot]
- Add test cases in feed. [Raphaël Vinot]
- Add test cases. [Raphaël Vinot]
- Normalize to_datetime conversion. [Raphaël Vinot]
- Trustar example uses objects. [Raphaël Vinot]
- Add lief in the generic requirements. [Raphaël Vinot]
- Refactorize typing, validate. [Raphaël Vinot]
Fix
~~~
- Bump objects. [Raphaël Vinot]
- Issue with readme. [Raphaël Vinot]
- Remove debugging. [Raphaël Vinot]
- [*-seen] Consider that `-` can also be in the date component while
parsing. [mokaddem]
- First seen was after last seen, trigerring the exception. [Raphaël
Vinot]
- Tests failing if local tz was not CET. [Raphaël Vinot]
- Syntax and typos. [Raphaël Vinot]
- Bugs introduced by last commit. [Raphaël Vinot]
Other
~~~~~
- Doc: fix Search-FullOverview.ipynb code example. [Bernhard E. Reiter]
- Chore: delete old examples. [Manabu Niseki]
Delete examples which use deprecated/deleted methods
- Scrape trustar intel platform reports and create misp events.
[th3jiv3r]
- Configuration for trustar integration. [th3jiv3r]
- Fixed trailing lines. [turtlefac3]
- Fixed trailing lines. [turtlefac3]
- Custom integration written in python to scrape Proofpoint VAP API for
metrics of top Very Attacked Persons and create MISP events.
[turtlefac3]
- Fix typos on FullOverview.ipynb. [Bernhard E. Reiter]
v2.4.120 (2020-01-17)
---------------------
New
~~~
- [attribute type] kusto-query attribute type. [Alexandre Dulaunoy]
Kusto query is the query language for the Kusto services in Azure used
to search large dataset. It's used in Windows Defender ATP Hunting-Queries
and also Azure Sentinel (Cloud-native SIEM).
- Remove python < 3.6 support. [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump Changelog. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump dependencies, add debug. [Raphaël Vinot]
- Upate dummy events creator. [Raphaël Vinot]
- Add tests on more version of Python. [Raphaël Vinot]
- Search with the STIX output returns a json STIX. [Raphaël Vinot]
Was XML before.
- Bump dependencies. [Raphaël Vinot]
- Add more typing information. [Raphaël Vinot]
- Add typing markup. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Bump Dependencies. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
Fix
~~~
- Bump template_version in test cases. [Raphaël Vinot]
- Add missing variable in dummy creator. [Raphaël Vinot]
- Et2misp was python2 only. [Raphaël Vinot]
- Feed generator was broken. [Raphaël Vinot]
Fix #506
- Event without hashable attribute. [Raphaël Vinot]
Related #506
Other
~~~~~
- Update api.py. [AaronK]
minor typo, can;t help it noticing those. sorry,
- Fixed TODO, added quarantineFolder/quarantineRule from
messagesBlocked, added some error handling to prevent empty attributes
from trying to be added. [th3jiv3r]
- Scrape proofpoint tap api for messages blocked/delivered & clicks
blocked/permitted and create misp events. [th3jiv3r]
- Add variable for proofpoint tap api auth. [th3jiv3r]
- Update README.md. [AaronK]
minor typo
- Define the number of entries to output. [AndreC10002]
Allow for defining in the settings.py file the number of entries to output
- Update generate.py. [AndreC10002]
- Cleanup of code and 'quick-n-dirty' sanitizing of tags. [Koen Van
Impe]
- Sync. [Koen Van Impe]
- Update README.md. [Raphaël Vinot]
v2.4.119.1 (2019-12-17)
-----------------------
New
~~~
- URLObject (requires pyfaup) [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Version bump. [Raphaël Vinot]
- Bump test files. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Debug travis error message. [Raphaël Vinot]
- [types] eppn type added. [Alexandre Dulaunoy]
- Fix typo. [Raphaël Vinot]
- Move scrippsco2 feed generator to a sub directory. [Raphaël Vinot]
- Update documentation. [Raphaël Vinot]
Fix #396
- Bump objects. [Raphaël Vinot]
Fix
~~~
- Properly test custom objects. [Raphaël Vinot]
- Adding a sighting takes a little bit of time. [Raphaël Vinot]
- Test case on reference. [Raphaël Vinot]
- Add missing fields to event & attribute for the feed output. [Raphaël
Vinot]
- Make sure the publish timestamp is bumped on update. [Raphaël Vinot]
v2.4.119 (2019-12-02)
---------------------
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
Fix
~~~
- Bump lief to 0.10.1. [Raphaël Vinot]
- Update tests. [Raphaël Vinot]
- Raise PyMISPError instead of Exception. [Raphaël Vinot]
- Rename feed_meta_generator so it clearly fails with python<3.6.
[Raphaël Vinot]
v2.4.117.3 (2019-11-25)
-----------------------
New
~~~
- Script to generate the metadata of a feed out of a directory. [Raphaël
Vinot]
- Add to_feed export to MISPEvent. [Raphaël Vinot]
- Validate object templates. [Raphaël Vinot]
fix https://github.com/MISP/misp-objects/issues/199
- Test cases for restricted tags. [Raphaël Vinot]
Fix #483
- Get Database Schema Diagnostic. [Raphaël Vinot]
Fix #492
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- Require stable version of lief again. [Raphaël Vinot]
- Few more improvements on the feed export. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Make the feed generator more generic. [Raphaël Vinot]
- Use New version of PyMISP in the feed generator. [Raphaël Vinot]
- Bump misp-object. [Raphaël Vinot]
- Allow to sort and indent the json output for objects. [Raphaël Vinot]
- Bump objects. [Raphaël Vinot]
- Bump dependencies. [Raphaël Vinot]
- [test] feed test updated as botvrij is now TLS by default. [Alexandre
Dulaunoy]
Fix
~~~
- Improve stability of feed output. [Raphaël Vinot]
- Do not unitialize the uuid in MISPEvent. [Raphaël Vinot]
- Bump url template version in test cases. [Raphaël Vinot]
- Python 2.7 tests. [Raphaël Vinot]
- Print the full json blob in debug mode. [Raphaël Vinot]
Related https://github.com/MISP/PyMISP/issues/462
Other
~~~~~
- Cch: Bump misp-objects. [Raphaël Vinot]
v2.4.117.2 (2019-10-30)
-----------------------
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
Fix
~~~
- Avoid exception on legacy MISP. [Raphaël Vinot]
v2.4.117.1 (2019-10-30)
-----------------------
New
~~~
- Add support for UserSettings. [Raphaël Vinot]
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Use default category from template. [Raphaël Vinot]
Fix #477
- Skip usersettings tests when emails are disabled. [Raphaël Vinot]
Fix
~~~
- [examples] typo uuid. [Jean-Louis Huynen]
give me a hoodie.
- Prevents exception when lief is not installed. [Christophe Vandeplas]
- Python <3.4 should work again.... [Raphaël Vinot]
Fix #482
- Remote_describe_types response was invalid. [Raphaël Vinot]
- Missing file in last commit. [Raphaël Vinot]
- Remove overwrite of remote_describe_types. [Raphaël Vinot]
Other
~~~~~
- Added example for checking sync servers. [wotschel]
- Corrected docstring. [Shortfinga]
- Include to_ids and replace newlines in title. [Koen Van Impe]
- Update aping.py. [ater49]
Just fixing a typo
- Remove unused MISPFileCache from PyMISP class. [Marc Hoersken]
v2.4.117 (2019-10-10)
---------------------
New
~~~
- Better handling of delete(d) attributes. [Raphaël Vinot]
* Hard delete on attribute
* Get the deleted attributes within an event
Changes
~~~~~~~
- Bump changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Test if json exists in cached method. [Raphaël Vinot]
- Decode datetime without dateutils if possible. [Raphaël Vinot]
- Add support for rapidjson, refactoring and code cleanup. [Raphaël
Vinot]
- Cleanups. [Raphaël Vinot]
- Cleanups and improvements. [Raphaël Vinot]
- [types] updated to the latest version. [Christophe Vandeplas]
now using the gen_misp_types_categories using jq
- [describeTypes] updated to the latest version. [Alexandre Dulaunoy]
- Bump dependencies. [Raphaël Vinot]
- Add missing return formats in restsearch, bump objects. [Raphaël
Vinot]
- [misp-objects] updated to the latest version. [Alexandre Dulaunoy]
- Update search examples. [Raphaël Vinot]
- Update main notebook. [Raphaël Vinot]
- [test] remove attribute field which was not foreseen in 2.4 branch.
[Alexandre Dulaunoy]
- Fix travis tests due to sighting_timestamp. [Raphaël Vinot]
- Use default for warnings. [Raphaël Vinot]
fix: #453
- Dump dependencies, update tests. [Raphaël Vinot]
- Bump readme. [Raphaël Vinot]
- Update upload malware/attachment example script. [Raphaël Vinot]
Fix #447
Make data at attibute level more generic with getter/setter methods
Fix
~~~
- [Python2] Use LRU cache decorator, fix call to describe_types in
PyMISP. [Raphaël Vinot]
- Python2 SyntaxError... [Raphaël Vinot]
- Objects helpers were broken, do not overwrite describe_types. [Raphaël
Vinot]
- Support for legacy python versions. [Raphaël Vinot]
90 days and counting, folks.
- Cache object templates at AbstractMISP level. [Raphaël Vinot]
Related #468 and #471
- Cache describeTypes at AbstractMISP level. [Raphaël Vinot]
- Big speed improvment when loading MISPEvent. [Raphaël Vinot]
1. `properties` is a list comprehension
2. Massively reduce the amount of calls to `properties`
- Python 2.7 support. [Raphaël Vinot]
I want a cookie.
Other
~~~~~
- Use classmethod instead of staticmethod and avoid hard-coded
reference. [Marc Hoersken]
- Cache JSON definitions in memory LFU cache provided by cachetools.
[Marc Hoersken]
- Path and modified time of JSON file are used as the cache key
- Global state is hidden away inside a root-class for re-use
- Maximum size is 150 considering the number of JSON definitions
During my tests the memory usage of the test suites was halved.
- Fix mixed whitespace in the travis helper script files. [Marc
Hoersken]
- Remove explicit clonce as the viper-test-files are now a Git
submodule. [Marc Hoersken]
- Add viper-test-files repository as Git submodule. [Marc Hoersken]
- Update .gitignore to exclude files produced during tests. [Marc
Hoersken]
- Code cleanup. [Koen Van Impe]
- Update type and code cleanup. [Koen Van Impe]
- List all the sightings - show_sightings.py. [Koen Van Impe]
- Disable to_ids based on false positive sightings reporting. [Koen Van
Impe]
- Adds support to add local tags. [Antoine Cailliau]
Requires https://github.com/MISP/MISP/pull/5215 to be merged first.
- Minor grammar errors. [Miroslav Stampar]
- Make client_certs out of the box friendly. [Campbell McKenzie]
v2.4.114 (2019-08-30)
---------------------
New
~~~
- [Community] Request access. [Raphaël Vinot]
- Initial support for communities. [Raphaël Vinot]
- Contact event reporter. [Raphaël Vinot]
- Delegate Event. [Raphaël Vinot]
And more test cases
Changes
~~~~~~~
- Bump Changelog. [Raphaël Vinot]
- Bump Changelog. [Raphaël Vinot]
- Temp disable tests for request_community_access. [Raphaël Vinot]
- Disable test for now. [Raphaël Vinot]
- Bump Changelog. [Raphaël Vinot]
- Bump Dependencies. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Bump misp-objects. [Raphaël Vinot]
- Re-enable a few test cases. [Raphaël Vinot]
- Make sure delegation is enabled while testing. [Raphaël Vinot]
- [tests] Check the type of the response. [Raphaël Vinot]
- New local key in Org/Orgc. [Raphaël Vinot]
- [tests] Do not run in fast mode by default. [Raphaël Vinot]
- Better handling of sightings. [Raphaël Vinot]
- [Travis] Add more debug. [Raphaël Vinot]
- Add test related to travis. [Raphaël Vinot]
Fix
~~~
- Event delegation was incorrect. [Raphaël Vinot]
- Automatically skip empty string in add_attribute at object level.
[Raphaël Vinot]
Fix #439
Re-enable test cases.
- [Travis] User cannot create tag, Travis was right. [Raphaël Vinot]
- Invalid tests in last commit. [Raphaël Vinot]
- [Travis] Slight changes to help debug on Travis. [Raphaël Vinot]
Other
~~~~~
- Bump Changelog. [Raphaël Vinot]
v2.4.113 (2019-08-16)
---------------------
New
~~~
- Helpers & testcases for syncing. [Raphaël Vinot]
- Preliminaty setup for testing syncing. [Raphaël Vinot]
- Add few tests for admin tasks. [Raphaël Vinot]
- Update MISP, test sync server. [Raphaël Vinot]
- Properly support attribute/add of multiple attributes (2.4.113+)
[Raphaël Vinot]
Changes
~~~~~~~
- Bump Changelog. [Raphaël Vinot]
- Bump version. [Raphaël Vinot]
- Improve test cases. [Raphaël Vinot]
- Update and improve live testing. [Raphaël Vinot]
- Add tests cases for sync, bump describeTypes. [Raphaël Vinot]
- Return empty list instead of None. [Pierre-Jean Grenier]
In all cases but one, the 3rd returned object is a (potentially empty) list.
- Some more code cleanup. [Raphaël Vinot]
- Code cleanup. [Raphaël Vinot]
- Enable more tests. [Raphaël Vinot]
- #4891 was fixed. [Raphaël Vinot]
- Bump describeTypes. [Raphaël Vinot]
Fix
~~~
- Fallback to propose attribute update. [Raphaël Vinot]
- Properly __repr__ MISPUser. [Raphaël Vinot]
- Move __not_jsonable *inside* the __init__ [Raphaël Vinot]
Turns out, if you modify a variable defined outside the __init__,
every instances (and inherited classes) of that class will be impacted by it.
- Exception when posting multiple attributes on attributes/add. [Raphaël
Vinot]
Fix #433
Few cleanups in code.
Other
~~~~~
- Include date_from & date_to in subject and report content. [Koen Van
Impe]
- Allow statistics date_from date_to. [Koen Van Impe]
- date_from + date_to
- move misp object creation after argument parser
- Allow to supply mail options as arguments on command line. [Koen Van
Impe]
- Fix stats_report example to use ExpandedPyMISP. [Maxime Thiebaut]
The stats_report example relied on deprecated functions making it crash.
This has been fixed by upgrading to ExpandedPyMISP. Further checks have
been introduced to ensure used dictionnary keys do exist as the example
also crashed on clean MISP instances due to empty responses.