MISP Client for Rust

A Rust client library for interacting with MISP (Malware Information Sharing Platform) instances via their REST API.

What is MISP?

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform that facilitates the collection, storage, and sharing of Indicators of Compromise (IoCs) and threat intelligence. It enables organizations to share, store, and correlate information about cyber security incidents, threats, and malware.

Key features of MISP include:

• Sharing of IoCs and threat intelligence between organizations
• Automatic correlation of attributes to identify relationships between events
• Flexible data model with support for various attribute types
• Integration with other security tools and platforms
• Support for taxonomies, galaxies, and other classification systems
• Collaborative analysis of threats

About This Client

This Rust client library provides a comprehensive API to interact with MISP instances. It was generated using OpenAPI Generator from a fine-tuned OpenAPI specification that accurately describes the MISP REST API.

The client supports all major MISP API endpoints, including:

• Events management
• Attributes handling
• Objects manipulation
• Galaxies and taxonomies
• Users and organizations administration
• Sharing groups
• And much more

Installation

Add the package to your Cargo.toml:

```toml
[dependencies]
misp-client-rs = "0.1.0" # Or the version you intend to publish

Usage Examples

Example 1: Authenticating and Retrieving Events

use misp_client_rs::apis::{configuration::Configuration, events_api};
use std::error::Error;

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    // Configure API key authorization
    let mut config = Configuration::new();
    config.base_path = "https://your-misp-instance.com".to_string();
    config.api_key = Some(misp_client_rs::apis::configuration::ApiKey {
        prefix: None,
        key: "YOUR_API_KEY".to_string(),
    });

    // Retrieve all events
    let events = events_api::get_events(&config).await?;
    
    // Print event information
    for event in events {
        println!("Event ID: {}", event.id);
        println!("Event Info: {}", event.info);
        println!("Event Date: {}", event.date);
        println!("Organization: {}", event.org_id);
        println!("Attributes count: {}", event.attribute_count);
        println!("----------------------------");
    }

    Ok(())
}

Example 2: Searching for Specific Attributes

use misp_client_rs::apis::{configuration::Configuration, attributes_api};
use misp_client_rs::models::AttributeRestSearchFilter; // Removed unused AttributesRestSearchReturnFormat
use std::error::Error;

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    // Configure API key authorization
    let mut config = Configuration::new();
    config.base_path = "https://your-misp-instance.com".to_string();
    config.api_key = Some(misp_client_rs::apis::configuration::ApiKey {
        prefix: None,
        key: "YOUR_API_KEY".to_string(),
    });

    // Create search filter
    let filter = AttributeRestSearchFilter {
        value: Some("malicious.com".to_string()),
        type_: Some("domain".to_string().into()), // Assuming "domain" is a valid AttributeType variant
        category: None,
        org: None,
        tags: None,
        from: None,
        to: None,
        last: None,
        // event_id: None, // Removed redundant event_id, using eventid as per model comment
        event_info: None,
        threat_level_id: None,
        distribution: None,
        analysis: None,
        org_c: None,
        timestamp: None,
        published: None,
        enforceWarninglist: None,
        to_ids: None,
        deleted: None,
        include_event_uuid: None,
        include_event_tags: None,
        event_timestamp: None,
        sg_reference_only: None,
        eventid: None, // Use this for event ID filtering
        uuid: None,
        publish_timestamp: None,
        sharinggroup: None,
        ..Default::default() // Initialize other fields to None
    };

    // Search for attributes
    let result = attributes_api::rest_search_attributes(
        &config,
        filter,
    ).await?;

    // Process results
    if let Some(attributes_container) = result.response {
        if let Some(attributes) = attributes_container.attribute {
            println!("Found {} attributes", attributes.len());
            for attribute_item in attributes {
                println!("Attribute ID: {}", attribute_item.id.as_deref().unwrap_or("N/A"));
                println!("Value: {}", attribute_item.value.as_deref().unwrap_or("N/A"));
                println!("Type: {}", attribute_item.r#type.as_ref().map_or("N/A".to_string(), |t| t.to_string()));
                println!("Event ID: {}", attribute_item.event_id.as_deref().unwrap_or("N/A"));
                println!("----------------------------");
            }
        } else {
            println!("No attributes found in the response.");
        }
    } else {
        println!("No response field in the result.");
    }

    Ok(())
}

Example 3: Creating an Event and Adding an Attribute

use misp_client_rs::apis::{configuration::Configuration, events_api, attributes_api};
use misp_client_rs::models::{
    EventNoId, AttributeNoId, AttributeType, AttributeCategory, DistributionLevelId, 
    AnalysisLevelId, ThreatLevelId
};
use std::error::Error;

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    // Configure API key authorization
    let mut config = Configuration::new();
    config.base_path = "https://your-misp-instance.com".to_string();
    config.api_key = Some(misp_client_rs::apis::configuration::ApiKey {
        prefix: None,
        key: "YOUR_API_KEY".to_string(),
    });

    // 1. Create a new event
    let new_event_data = EventNoId {
        info: Some("New Event Created via API Client - Ransomware Campaign X".to_string()),
        distribution: Some(DistributionLevelId::Variant0), // Your organization only
        analysis: Some(AnalysisLevelId::Variant0), // Initial
        threat_level_id: Some(ThreatLevelId::Variant1), // High
        date: Some("2024-05-17".to_string()), // Set to the appropriate date
        ..Default::default()
    };

    let created_event_response = events_api::add_event(&config, new_event_data).await?;
    
    let event_id = if let Some(event_details_boxed) = created_event_response.event {
        if let Some(event_id_str) = event_details_boxed.id {
            event_id_str
        } else {
            return Err("Event ID not found in response after creation".into());
        }
    } else {
        return Err("Event details not found in response after creation".into());
    };
    println!("Successfully created event with ID: {}", event_id);

    // 2. Add an attribute to the new event
    let new_attribute_data = AttributeNoId {
        event_id: Some(event_id.clone()), // Link to the newly created event
        r#type: Some(AttributeType::Domain),
        value: Some("example-malicious-domain.com".to_string()),
        category: Some(AttributeCategory::NetworkActivity),
        to_ids: Some(false),
        comment: Some("C2 domain associated with Ransomware Campaign X".to_string()),
        distribution: Some(DistributionLevelId::Variant0),
        ..Default::default()
    };

    let added_attribute_response = attributes_api::add_attribute(&config, &event_id, new_attribute_data).await?;
    
    if let Some(attribute_details_boxed) = added_attribute_response.attribute {
        println!("Successfully added attribute with ID: {} and value: '{}' to event ID: {}",
            attribute_details_boxed.id.as_deref().unwrap_or("N/A"),
            attribute_details_boxed.value.as_deref().unwrap_or("N/A"),
            event_id
        );
    } else {
        println!("Attribute added, but details not found in response.");
    }

    Ok(())
}

All URIs are relative to https://misp.local

Documentation For Models

See the docs directory for detailed documentation of all models.

License

This project is licensed under the terms specified in the Cargo.toml file.

Author

This client was generated using OpenAPI Generator from a fine-tuned OpenAPI specification of the MISP API.