Usage

To use OTX to MISP from the command line:

$ otx-misp --help

otx-misp

Downloads OTX pulses and add them to MISP.

usage: otx-misp [-h] [-o OTX] [-s SERVER] [-m MISP] [-t TIMESTAMP] [-c CONFIG]
                [-w] [-a] [-u] [-n] [-d] [-v] [--no-tlp] [--discover-tags]
                [--to-ids] [--distribution DISTRIBUTION]
                [--threat-level THREAT_LEVEL] [--analysis ANALYSIS]
                [--author-tag] [--bulk-tag BULK_TAG] [--dedup-titles]
                [--stop-on-error]

-h, --help

show this help message and exit

-o <otx>, --otx <otx>

Alienvault OTX API key

-s <server>, --server <server>

MISP server URL

-m <misp>, --misp <misp>

MISP API key

-t <timestamp>, --timestamp <timestamp>

Last import as Date/Time ISO format or UNIX timestamp

-c <config>, --config-file <config>

-w, --write-config

Write the configuration file

-a, --author

Add the Pulse author name in the MISP Info field

-u, --update-timestamp

Updates the timestamp in the configuaration file

-n, --no-publish

Don’t publish the MISP event

-d, --dry-run

Fetch the pulses but don’t create MISP events. Use -v[v] to see details.

-v, --verbose

Verbosity, repeat to increase the verbosity level.

--no-tlp

No Traffic Light Protocol tag

--discover-tags

Discover tags to add to MISP events

--to-ids

Mark IOCs as exportable to IDS

--distribution <distribution>

MISP distribution of events (organisation,community,connected,all), default: organisation

--threat-level <threat_level>

MISP threat level of events (high,medium,low,undefined), default: undefined

--analysis <analysis>

MISP analysis state of events (initial,ongoing,completed), default: completed

--author-tag

Add the pulse author as an event tag

--bulk-tag <bulk_tag>

Add a custom tag that will be added to all events (e.g. OTX)

--dedup-titles

Search MISP for an existing event title and update it, rather than create a new one

--stop-on-error

Stop import when an exception is raised

To use OTX to MISP in a project:

import otx_misp