MISP to STIX and back again

Or at least that's the idea

This is the open-sourced version of BAE Systems' internal sync script. It's a bit limited, and it isn't perfect, nor is it bug-free.

But it works™

Installation

If you don't wanna use git,

sudo pip3 install misp_stix_converter

should have you covered. This relies on me actually updating PyPI every time I update the project, so I'd use the git repo wherever possible.

sudo python3 setup.py install

This should install everything it needs!

Useful, huh?

The config file

Copy over the example config to a live version

The default location of this config file is at ~/.misptostix, but this can be overridden with the -c FILE flag when running the scripts.

cp /path/to/config/misp.login.example /path/to/config/misp.login

Then open it and change the variables. This is YAML format, so make sure you don't do a silly and format it wrong!

Usage

For MISP to STIX:

To get all usage information:

misp-to-stix.py -h

So to convert a MISP JSON file to stix json, use

misp-to-stix.py -f INFILE.json --format JSON -o OUTFILE.json (the --format flag is used to specify output format, just for reference)

And to pull a specific event from the MISP instance

misp-to-stix.py -i EVENT_ID...

Alternatively, if you want to pull every event of a certain tag, you can run

misp-to-stix.py -t tlp:white -o out.{}.xml

Which will write all "tlp:white" tagged events to a file formatted by the event's ID, e.g out.29.xml

For STIX to MISP

This only works if you have a live MISP instance to connect the API to.

./stix-to-misp.py INFILE.json

This will convert the file to MISP format and push it. Quite a few bits and bobs get converted, not all of them (I for one blame CyBoX for being weird and layered worse than an onion).

Feel free to add more to the stix-to-misp.py file.