misp-client 0.2.0

A Rust client library for MISP threat intelligence platform
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

# MISP Client

Rust client for the MISP threat intelligence platform API.

## Usage

```rust
use misp_client::MispClientFactory;

let misp = MispClientFactory::builder()
    .base_url("https://misp.local")
    .api_key("your-api-key")
    .verify_ssl(false)
    .build();

// search attributes
let attrs = misp.attributes().search_by_value("8.8.8.8").await?;

// get event details
let event = misp.events().get("123").await?;

// check warninglists
let on_list = misp.warninglists().is_whitelisted("8.8.8.8").await?;
```

## Clients

`MispClientFactory` provides access to:

* `events()` for event queries
* `attributes()` for IOC searches
* `galaxies()` for threat actors, MITRE ATT&CK, malware
* `sightings()` for observation tracking
* `warninglists()` for false positive checks

## Example

IOC enrichment with context lookup, sighting history, and warninglist check:

```rust
use misp_client::MispClientFactory;
use std::env;

#[tokio::main]
async fn main() -> misp_client::Result<()> {
    let misp = MispClientFactory::builder()
        .base_url(env::var("MISP_URL").expect("MISP_URL required"))
        .api_key(env::var("MISP_API_KEY").expect("MISP_API_KEY required"))
        .verify_ssl(false)
        .build();

    let info = misp.test_connection().await?;
    println!("MISP {}\n", info.version);

    let ioc = "192.168.1.100";
    println!("Lookup: {}", ioc);

    let results = misp.attributes().search_by_value(ioc).await?;

    if results.is_empty() {
        println!("  no matches");
    } else {
        println!("  {} matches:", results.len());
        for attr in &results {
            println!("  Event #{}: {} ({})", attr.event_id, attr.value, attr.attr_type);
        }
    }

    let count = misp.sightings().count_for_value(ioc).await?;
    println!("\nSightings: {} total ({} pos, {} neg)",
        count.total, count.positive, count.negative);

    if misp.warninglists().is_whitelisted(ioc).await? {
        println!("\nOn warninglist");
    } else {
        println!("\nNot on any warninglist");
    }

    Ok(())
}
```

Run with:

```
MISP_URL=https://misp.local MISP_API_KEY=xxx cargo run --example enrichment
```

See `examples/` for more.

## License

MIT