documentation/MISP playbook.ipynb

{
 "cells": [
  {
   "attachments": {
    "playbook-structure-graphical-workflow.drawio.png": {
     "image/png": "iVBORw0KGgoAAAANSUhEUgAAAZIAAABICAYAAADcUHMHAAAAAXNSR0IArs4c6QAABOl0RVh0bXhmaWxlACUzQ214ZmlsZSUyMGhvc3QlM0QlMjJFbGVjdHJvbiUyMiUyMG1vZGlmaWVkJTNEJTIyMjAyMy0wMi0xNVQxMCUzQTIwJTNBMjEuNTc5WiUyMiUyMGFnZW50JTNEJTIyNS4wJTIwKE1hY2ludG9zaCUzQiUyMEludGVsJTIwTWFjJTIwT1MlMjBYJTIwMTBfMTVfNyklMjBBcHBsZVdlYktpdCUyRjUzNy4zNiUyMChLSFRNTCUyQyUyMGxpa2UlMjBHZWNrbyklMjBkcmF3LmlvJTJGMTcuNC4yJTIwQ2hyb21lJTJGMTAwLjAuNDg5Ni42MCUyMEVsZWN0cm9uJTJGMTguMC4xJTIwU2FmYXJpJTJGNTM3LjM2JTIyJTIwZXRhZyUzRCUyMkFhSGNmUWFaSkd4Y1NfbVJaUU8wJTIyJTIwdmVyc2lvbiUzRCUyMjE3LjQuMiUyMiUyMHR5cGUlM0QlMjJkZXZpY2UlMjIlM0UlM0NkaWFncmFtJTIwaWQlM0QlMjJXcXRLS2hUWmVaemNJVFZieUpzUCUyMiUyMG5hbWUlM0QlMjJHcmFwaGljYWwlMjB3b3JrZmxvdyUyMiUzRTFWWk5qNXN3RVAwMU9XNUVJSkRtMkUzWXJkUldhcFZEdDZmS2hWbHcxekRJREFINjYydUQlMkJWcVVLRnRsMWU0RiUyQlQyUHg1NDNIMkxoN0pMcVhySXMlMkZvd2hpSVZ0aGRYQzJTOXNlJTJCdDY2cXVKdWlWY2E5TVNrZVJoUzYwRzRzQiUyRmd5RXR3eFk4aEh4aVNJaUNlRFlsQTB4VENHakNNU214bkpvOW9wamVtckVJWnNRaFlHTE9mdU1oeFMzN3p0NE0lMkZBZmdVZHpkdlBLMjdVN0NPbU1UU1I2ekVNc1I1ZmdMWnljUnFWMGwxUTZFMXE3VHBUMTNkMkszZjVpRWxDNDVjRnZkZUp2eUtZdkU2dXZlNHR0NyUyRjJOOXN6WnZvN29MR0VJVnY0RW9LY1lJVXliOGdiMlZXS1FoYUslMkJXUW9QTko4Uk1rU3RGJTJGZ0tpMmlTVEZZU0tpaWtSWmhjcVRnJTJCajlYZnRhdWthdEslMkJNNXdiVUklMkZBRkpFJTJCQVFIWmNTckolMkJHSU9SSncwSFZ3M3FmTFV4NjBCUFNtbW9IQXNad0JuOXVwSmtNZ0k2WSUyQmYwQ1ZlTkFxaWlrTFU2SjBFdzRzZnBPNWdwMmFpM0c3S3FGaWF4TDBpeThYdGtvakEzSGRTRGFaYjZuQ1ElMkI5V1Z1VDVPbXlqZlRka2tWNlVaZlBnb3NnMWk1V2ViYTJROXRVOGFjNEpDeFJySlNtZlZpSDBFU1ZPZmxuc3ZURFJIVFFXYUVPQnVEeTZFaFY1Ymg0bEV6ZXRZckNXclBCUFhUOEZweXF2cE9lTW9JNWVzcDZ2eDNrcnB2WmhEOTVkQnAwUE1KZHNWSjVGdzRpZXglMkZPWW1jV2VQc3NRbE91WTk1R3MyS1lFanhxZmt5U2lmN21hTW9DTjdMd0tTOFlRZTAxbzAzNjhvcjlKTzlmdFpQbm50WlAyMWUzazhLRGo4TnpkN296OHZ4JTJGd0ElM0QlM0MlMkZkaWFncmFtJTNFJTNDJTJGbXhmaWxlJTNFczFxkgAAHC9JREFUeF7tnQm8TdUXx/fTYAplKkOpEE1USBNpFM0llSaVpEmhUKmQpIkSDYZSGlFpIqUUUqJJJBmiZAoVmRq8/+e7fPb9n3fd+9x737nn7rPPXp/P+xjevefss9Y+67fXnJefn5+vHDkOBMSBSZMmqW+//Vb9+eefAd0xercpV66cOuyww1SzZs2i9/DuiXPCgTwHJDnhe+Ru+uijj6r+/furX375JXLPnqsH3meffVTnzp3VzTffnKsluPtGhAMOSCIi6Fw95r///qtatWql3nzzTVnCoYceqpo2baoqVaqUqyVZf99Vq1apyZMnq9mzZ8uznnPOOWrMmDFqp512sv7Z3QPmhgMOSHLD98jc9eyzz1ZvvfWWqlKliho4cKCAiqNgODB69GjVsWNHtWLFCgGTN954I5gbu7tEjgMOSCIn8uAeGHdWp06dVNWqVdVHH32k6tSpE9zN3Z2EA3PnzlUnnniigAnycG4utzGywYHQAAkukmXLlinM9tWrV6vff/9drV+/Xm3YsEFt2bJF/fPPP2rr1q2qWLFiapdddlHFixdXpUuXVmXKlFF77LGHqlixoqpcubIotZ133jkbvHTXjOMAPnpiIrhVzj//fMefHHEAy6R169aqRo0aavHixTlaRfhui35Zvnx5gR/+z0/yM9eJJAssf/2z1157if4LgowDkkWLFqnvvvtOTlLz5s1TCxYsUD/99JP69ddffeNHtWrV1H777adq1aolp+QDDzxQfPf777+/b/eI+oWwQE466SRVr149ydJylFsOsL+JmZA157K5Esti5syZaty4cerdd99VP/zwg1q3bl1uhebD3cuWLSv6rWXLlvLTsGFDH666/SVyCiSbN29WU6ZMUZ9++qmaPn26mjFjhlqzZk3CByVQiDWBVYF1gZUBk7A6sD6wQrBGsEqwTrBSsFbYDFgvWDFYM1g1//33X8J7VKhQQTVq1Eg1btxYHXvssapJkyaqRIkSWWG87RcdMGCAZAzdcMMNatCgQbY/rvHPd/3116snn3zSubfiJDV+/PgYeHBg9VKpUqXkdI/e0ad89I6phJ7TFhR6jr9v3LixwHI5LGtQadGihW+PEjiQzJo1SyG8Dz74QH344YfbPcjee+8t1sHBBx8s1kLt2rXFeuD//SLcLWya+fPni9UzZ84csYISpaZyqj7llFMUTOd07Sg1DvTs2VP16tVLfu6+++7UvuQ+lTUOaHnw5z333JO1+4Tlws8884zq16+f6ABNuGJRsqeffro67rjj1O677x6Wx0m6zj/++EMO61ha/Pz888+xz6Jbu3fvrq666qoiP2cgQPLNN9+o1157Tb3++uvq+++/L7BoBMbPUUcdpY488khB/lwRCP7FF1+ozz//XE2dOlV+vHTQQQep8847T/z9FHw5Ss4BByRm7Q4HJNvkQbwOAPnyyy/l3w0aNBDgAEDwRNhO6DYNKpoHuLu6detWpIzKrAEJJtVzzz2nRo4cqT777LOYfPbdd1853Tdv3lydfPLJ4poylXCNTZw4UU2YMEGsKG+g8uijj1aXXXaZuuKKKxQmsKOCHHBAYtaOiDqQvP/+++qBBx6Q7EEIbwen8bZt25olqABX8+yzzwqo/vjjj3JXsvvgCR6YdMl3IGFR+GKHDBkS888R3CZrhJM8sYewErEcLKtRo0bFgv+ASPv27dV1112nDjjggLA+mu/rdkDiO0uLdMEoA8mDDz4oJ24Ijwd/d2nQ/99Ojz32mAAKKeIQ/LrtttvS2m++AQkxBgKsoJwmitE4sZ977rlpLSoMH6a4C4tLV2yz5iuvvFLqJojxRJ0ckJi1A6IKJO3atVPDhw8XYRAbuuOOO9Suu+5qlnAMWM3ff/+t7rvvPtW7d29ZDXwbOnRoyisrMpCQlssCsEIgsqvI1OGEXrdu3ZQXEtYPkibIsw8ePDiWDcaz33nnnQpLLKrkgMQsyUcNSEim4RBLoJm6MQ59bdq0MUsoBq7mxRdfFHcfdXu0MhoxYoQkO+2IigQkmEB33XWXAs3y8vLEHOrSpYuk6EaNSC1+5JFH1EMPPaQoMuLUc++996quXbtGjRXyvA5IzBJ7lICEWpmLL75YrVy5UpEgA4hkq37CLCn7sxrKMAATEqMoanz55Zd3WHuUEZAQK7j11lsluwm65pprVI8ePRTpc1En0uv69OkTMwvJRnv44YdDHRvKRKYOSDLhWva+ExUgoaCZ+i/qKOgvBohQb+YoPQ4w5gEwGTt2rHhWaAJaWMF22kDSt29fcdtAZC7df//96vjjj09vlRH49CeffKJuv/32WMYa7j/8s1EhByRmSToKQKLdMWSJnnXWWQXil2ZJIzyr0U1X0fW4CZN1kE4ZSChsoXBFdxAlKINby1HhHMC9pQvySDqgEMqGQqcdyd0ByY44FOzvowAkF110kXr11Velxgult9tuuwXLZAvvRm8xLDzaHMFf3FyJKCUgoaDwkksuEZ8ZKa5PP/30Dn1mFvI040f6+OOP1bXXXiv52vhsCWjZXtDogCTj7ZKVL9oOJKT0ErOlhQkgQmcMR/5wgB5tgAnGBHwmVTiedggkFPBQ/8FFMBfxOUbhRO2PCP5/FfhHFgmzOeAf9SgUANlKDkjMkqzNQIKXhI4TEA0XqVJ35C8H4OsZZ5whF4XfxJ+8VCiQ0A+L9gE0QezQoUMsxdffJUbraqQGP/XUU9JkEuFkUkUaBo45IDFLSjYDCRlZtPsgqYWsUUfZ4QBZqSRZwW8yu1ICkmnTpkkLk02bNsmXSWt15A8HSJNm05csWVJasBxzzDH+XNigqzggMUgYnnRs25o2UsNFZ2Napcf38TNLAnasBj7r2jmMC00JLRJSWGmkSDdcWgkwWc2Rvxy45ZZbFK0J6GpMc0jbUqcdkPi7X4p6NRstEjwlFMtRFP3CCy9IHNdRdjlAfPfSSy9V1atXlw7qekhgQiDBEqHFe2FR+uwuNxpXp2jqlVdekQFQWCY2kQMSs6RpI5DoZzrhhBNizRjN4rqdq4HfJBB5rdvtgITCQmoeyCqipTq+fEfZ4QAnKlrnkxVHbQ6FjLaQAxKzJGkbkDDEqVKlStKWiEMYhzFHwXAAIwNjA2vkt99+k+ShAkBCXER35+XvFKE4yi4HKJ7SMRI6BtgSL7FNcWV3F2T/6rbJg/EUl19+uSSr0CLeUbAcgO8A+PPPPy/jNAoAiXZpUUDHZDtHwXCArqQUeNrk4rJNcQWzE7J3F9vkwViK0aNHq4EDB6qbbrope4xzV07IAfhO/PyCCy6QsRoxIGF6IfUi9FNZuHChY1/AHKhZs6aiTxD1JTonPuAl+Ho72xSXr8zJwcVskgetUMqUKaM2b94sAV+G5TkKlgPwHawg85Tq9xiQ6ADKE088IS3gHQXLAZ3G2KxZM0X30rCTTYor7LJg/TbJQxcg4nrHBe8oNxyA/zTuxQgRIJk5c6Zq1KiRtH+n9bKj3HBgzz33VLSjp9gn7G2vbVJcudkN/t7VJnnQ848BejSQpTGqo9xwQDfwRR4CJMzpZZ4x0/369++fm1UVcleKIteuXWv9oKjOnTvLlMlk/WyME0whC7JJcRWF72TmmZD5aJM8qL1aunSpYirrIYccUhTxGP9d3Hi6VsO0xcL/evXqSQ2cAEn9+vXVrFmzFK3PmYplClEQCci99NJLsiQaRoJ+ev4yJi4PQnwhHcr0e+ncI5PP0vOflvw8E902w0yZKi4sMiwzL2Etc8ih7sZ02rJlizTlpAYLKl26tMS+4qfMkfFCAV1QHoBM5WEiv2llvnXrVgWvTRybSzE3GZjxdOONN6rHH388ZZbSLJGx3QzKM5Hgf4kSJaS1fN6qVavycWnRcpmgiUnUvn17xYAVMgRY8Ntvvy2pZuPHj1ennXaaAgCpeyFzIB3K9Hvp3CPTzxJE/Ouvv8TFRZ68yYT1ylAz1hxPmSouFCtT2chV57SJEqZRKP3JcGcwbMdkwnKuUKGCVFuTX58MSKiDmDdvnmLwWRCUqTyCWFv8PQrbV8uXL1dVq1Y12g0PkHAg593wEgO22BupkulAwnOAHdSS5E2cODGftF8eHIvEJOJkyvx3Pc+DtZEMQLEkYEIBH6X6KBiegSFbtErAHKTZpO4PRlCIBAL6WxHM5hre75n0zFgkWCZhKLIiY4OTIS45hnZ5ASVTxaWBhCJNAF8Ts2+YH42VShEasmacAWOeOdlTRMt6vISyZh10D6hYsaK0vz7zzDOTfp9x0bwHXI+5MTwPe4/9RRdsujXz/9xnxYoVkv5IhS/rxDV8+OGHK520glXJwadGjRqyBlIkyTLiOQBD4pL4mAlU8hwAD5kw1EQ0aNBAwJODxJw5c1THjh3lfrSm+Prrr2WkM+6ddChTeaRzD78+W9i+ojkj8UN0ALwwkQASMi95L+KJPcAeY6wEgMm/ifO0a9dOPjpmzBjZ25zy2W/sK1MtEtaLHPCe5A0dOjQf5MRlNHz4cKPkgkUydOhQ1aZNG9W8eXPp/6XHPXKao100rdlp2sZJBTAZMmSIzCTASuEUi+LAR41SoPkk37nwwgtj30PBmERXX321KCueW28uk9bnXQs92HgJABOUMC8O/4bXmSquZECCIqfOBguV4UV0eeWFw/RH8aOcGSLmJQ4OADIg895774n1yotLEVWi77N2LAhmxrB+DhwABe8HBxNaZwNK1DA0btxYLI6uXbuK9QRIAVx0g2CvAhCACnsRlyxrJRtv0KBBsgZmZmjXlq4jonaLe3N40gcoQOqII46QEQ7M2yBLZu7cuapu3bppbYtM5ZHWTXz6cGH7CnCGF7zHdM82kdBTAD3r9NKpp54qhxD2GHsCNxcHDPQucWD2PqnMHBw4TNDcFc+EyUCCHDjU5/Xt2zef0ySxCDa7ScQLB5N5KVEkEBWVTOnCRPS6qHi5eJF5wQnEASS8/LQeAUi8bhGTXVsoM5RSWDJSkAPuHAh/NYBCPIM/2U/pdptNBiScPlGo/J65CChrDRzDhg2TAlqsFS+hjFG8nO4ZdITfmmtglSb6PocTXnJtDerq6XXr1gk4ohhoadOiRQs5FesaBl503HEAD+AR79piHAOHHEAQ8GGvske9QALIYIlCvI9LliyR0yjAsnr1auEtIMX+th1I4EGyfVWlShWxBDlkcdgykQCS+fPni9fDSxxgiJWxx9Bn7BXCCbi8kCldLgBRHR/l0EGxpclAghzQ0Xk9e/bM52VP94XPtgBxX/ACc6KDNm7cKDOYMQk5IWLeewEBJQJo8PJrFwunTg0ktJimBTJkMpCgEJEFhDIOA8VvdIC7Vq1a8nKku6+SAQmyx0Ll97x4yJl50pDu/RO/DpQ1QW8ABEsWgCPgmez7GzZskJccJcD6qZxm/biXICwRAAnlzt/jiVog/j8eSPT12NNk4OC2w6/sBRI6bnPYgQCQ6dOnK0Yzo1hw50C4bOFtUYAkLHuK5y1sX2HF6ffEtHekMNcWesy7x/R7zp7AguagoQPy7AFiaCYDibamjbVIOB1ivlNlr91ZMB0ExNxj0qAXEFASnD5xPeCX1i+9BhLvy2cykITNIsE1uGbNGnmXvRYJ/8ay8gtIkCfxkLFjx8pJrlWrVuL+gVDgAA3uKy8RrOQEyPr4PS4DDhS4QhN9H8vXGxxPBiTE3LBoiFvoQwvXZd/h204WbC8MSIiRYFl5gQQXLIcmLG2uqwPNRQGSdOWRKyWdbF9h+TGCAb7gxjaRUgESbyYf4A6QsLexvPkT0i3bTQYS5MC+zRsyZEg+Jz3TYiTk32Ma4hJAUXCK5GUl5kGzNpAQPyJrx0rB3YHSAM2/+uorcV+w4QiWxp/ivN8zbSPqGAkvSXzWh2lrZZ4KwIeC5GWA37hlkFWmPnltkaDUOfmTwcZGJd7FyRzXFPflJePQoPcIwU3u7yViGgS9CXDjQkDBszdwISX6PnspFSABwAiEk8wBOOG6Yv8BXNWqVRMrWoOY93rpAgkxkdq1a0swHlCB17wLtgNJYfsqLDESXKDxGYa8F2Q5xWfyaSBB5xFg59BD7I/YMHvLZCAhfDBu3Dizs7awMDD/QW998qMfGEqlePHiorTwwxOwKleunJwyIV5ygkD4GFE+AAdTverUqSO/934v3dThbCvzsGVtoRx11hYviqZMgSRRHQmbFeVNbALCEsAioPYJos7knXfekZfUS8QdeDH13sGqAZSSfZ8U+B0BCSnJHE4I+OtaEe7pjWnpOoIFCxaIi0yfPjWQ4APnOb2urXiLhO4GZPAAluxxnpX1s9e5brq1U5nKI9v7PdH1CUgn21dhydpKVEeC7iJOkghI2BPsLWRMvz0I1y2gYjKQxLK2Vq5cmU+arYl1JDATv/DixYul+IgYR7FixQrsPQK9gAimP59ZtmyZZD6A8vihy5cvL7+LJ+/3cvGyJLunriPhZB6vGE1aJ2shToXV5AWQogJJqs+IoiHYjTuNDJlkvn/ibOwfFC8vsKZUv1/YeoipsAZthXg/iztKx/dSfab4z3ENgrJYVqyXPUEVMSfXdKudwwQkhe2rMNSRZCpv/T32K3VzuPFMp1gdCZXtmP+Uu5tW2W46E/1en65sx6zVp22/7xHU9cKkuILiSbr34RBFcB83CXOCSAtnb2SSpm+TPHRlOzEzE9rPpCtXWz4P//EMSWV7GHpt2cL4HT2H67W1Iw5F7/ecTokL4M6i4JGixHStEbhmE5BEqdeWyTte99oSj4C3+y8uLvzHjnLDAUxZ3Beu+29u+G/zXW0CEtf914ydSuyOeHOs+y/LcvNIciscN48kt/y3/e42AYmbR2LGbmUsOEWUyCM22IpMAbKe3ITE3AhJT0gkU4fsjrCTTYor7LKwzbVF7IjkIJJrcP1Rv+MoWA7Ad8otSAogRb/AzHZ6GZElYnLVaLDsCuZuWumSqkqVtg3kgMQsKdomD9L2OXRRN0a3AkfBcgC+U0O13cx2lkHuMznwECZLUC2ug2WBWXejVoZKaWjq1KmSnWMD2aa4wi4T2+RBPQYNW+m9R8dkR8FygAaUFEsiB0Z7FLBIWAotRSiuIkOEJnGZZIgE+0jhvRsmOqmdtEUgaEWXWlvINsUVdrnYJg9qbCg8pr4GKx5r3lEwHNC97cAGavXoD7YdkLAU2pLwYSbS6emEwSwxWnehBQKdjHEp0nHWJrJNcYVdNjbKQzcMJFFIdwcPu5zCsH6dmOUNgSQEEjqR4uKioy4tm+lA6shfDtAXip5C5GDj0qJi2SayUXGFWT42yoMKfwK+tJehdxoHM0fZ5YBuJEk3B7o66ILQhEDCUqZNmyYnZWaCMBBKTxvM7jKjcXUG1tAymowHLD/S6GwjGxVXmGVkqzx02jztk2jq6ii7HIDP9C2E7x06dIjdLCmQ8AmCWDTMw5fPqFoG9zgqGgdoYY4Q8C8y4Y2glY1kq+IKq6xslgdNWenqTI+uRONtwyoz09YNfzEq4Dejor1UKJDwQXyPtOhmuhvdKJk2R5NER+lxAP6RZUI3T/hHm3SbA4Q2K670JG/Gp22Why5QhNO0NNddos3gvB2rgK8YFRD8ppFoWkDChxm6gv+ROQi0Ymc+Au3OHaXGAZphMjOFYV2YhiQw0H7ZZrJZcYVRbrbLo1u3bjLTno7LU6ZMkWaXjvzhABNCmzRpIgPWunbtKhM842mHFon+Ahdh6BJoBPXu3VsGBjkqnAPMFWd+BcToVDq3FrW9eBh4brviCoMMvGuMgjyYD8OcGA5pgAnV746KxgGq1km8Yl4K/CXLNBGlDCT6y9Q69OjRQ/5JkJiaE2edbM9arBBqQ0hagPr06SM1OlGhKCiuMMkyCvIglsvJmSJf3PB6ZG2Y5GTaWuEjY80pmgacE812Ys1pAwlfogK+S5cuiuH0ECNKARdSWaNOpEwDGnqedOPGjSUIaEvFeqryjYLiSpUXJnwuKvJYuHChgAkDsPAAENPVEzJNkENY1sBAOGK6gHHVqlUFROjDmIwyAhJ9MXySuLcYcMLkQtJaARgqTqNGVHgCGKRJb926VSb34dbCpxhFioriCotsoyQPEoSI6TKSgVgJYEKmkaPUOEBGFiBCOjWjRXBnUYRYGBUJSLjw0qVLpbUHc9Qh0lqZr026sJ6Rntryw/kpAuik8w4ePFjSpCHyq3FjVa9ePZwP5cOqo6S4fGBX1i8RNXksWrRItW3bVk7SFM0BJnTqcFQ4B0gEgm8Ue2LZjRgxolBLRF+tyECiL8S0rP79+8uNNZEiBrLFp4rZIExMPjan1w+LAMhjZxxq1Clqist0eUdVHiQIMaIYggfELd143u13K8CBQdCrVy/5JXwbNmxYytvaNyDRd9QndGIEmzZtkv/mZN66dWupRwlzrIDYEPUfo0aNEksMKlmypMSIomKBpbqzoqq4UuVP0J+LsjxIV+3evbuwHH8/qcK0QHe0jQMDBw5U/fr1k7gSBL/Sdcn7DiRaOBs2bJAT+8iRIyWLQhO9cSgYat68uTSHLFWqlLHy3LhxozRTnDBhgho/frz0ltFEi33aJ2NxlS5d2thnyNXCoqy4csXzwu4bdXnwDqMgJ02aJGyqW7euAApehKgS3iMAhMM/RBwEwM2k20bWgMQrHNqkM4GR0zxFjV7CD0eeMoqZlurMLc8VMa+e1vkAH40U8a96iWJCrComGNJm31FyDkRdcZm2N5w8tklk9OjRojxpqQI1bNhQtWzZUqq20T+2E5m2VKnzo9uckIgAgDAhN1MKBEi8i6OwhdM9Q1EStX6mCy4xBrItCNbXrl1bOnz6GbjGLYV1MX/+fEFjKjeJ8dD1OJ5oY8LwHKyo+vXrZ8rnyH3PKS6zRO7kUVAeFAYDKAsWLIj9gpG9gAo/HHBtaAVFayYOxBo8lixZEnveWrVqCYAQDykqBQ4k3gUTQ+EhiT2AlDNmzFBr165N+Exkg+HfrFy5sqpYsaJUh5ctW1bcSsWLF5cAGinIpN4SOGKeM+418qGpyl+9erVatWqVWrZsWSy7Kv5G5cuXV40aNVLUfhDLYTMRA3GUPgcGDBggiQdk8A0aNCj9C7hv+MoB3SyUkRCMhnC0jQNawdJAlTnkXkK3VKlSpcCPyV0p0HPEObw/6EAvcSjXYMmfflFOgSTRQ1BQhHWACwxrgRMD1gMA4BcBSDAURMbqwWWFFVSzZk2/bhH562BtMoagXr160l7BUW45wP6ePXu2xAiaNWuW28UYencOshpY0D/r1683dKWpL4tiTPSbBg8Oytkg44Ak2UNiZQAmWBVYF6AvggZxsT74fX5+vsrLyxPrBCuFEwWM5BSBFYM1A4i49L9sbKXtr4mbkkr/MWPGSFzJUW44QFyArElcN/Gn7tysKBx3xZvhPd0TQ8VVlCmhm7JJ6Lp4CwqvTRAUGiAJghnuHv5yADdKp06dBLyxUKJQoOovB4t+NU7WxPlQgs6tVXR+uisk5oADErczssoB3fSNkxL56kXJDMnqQi28OJYI9RKACEXBunO3hY/qHinHHHBAkmMB2H572sYAHgz0gvDVN23aNJL92IKSNe7fyZMnS0wEAkRwLybr3BrUutx97OWAAxJ7ZWvUk+FWoYUOMRNHwXCAGBWZcy5LKxh+R/ku/wO44rlvtZjOlQAAAABJRU5ErkJggg=="
    }
   },
   "cell_type": "markdown",
   "id": "ca1fbfb5",
   "metadata": {},
   "source": [
    "# MISP playbook title\n",
    "\n",
    "- UUID: **42fdc8d0-eab6-4497-8a42-c051316cc211**\n",
    "- State: **Draft**\n",
    "- Purpose: **This notebook is used to demonstrate the general structure of a MISP playbook.**\n",
    "- External resources: **Hashlookup**, **CVE**\n",
    "- Graphical workflow ![playbook-structure-graphical-workflow.drawio.png](attachment:playbook-structure-graphical-workflow.drawio.png)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "a512a2c1",
   "metadata": {},
   "source": [
    "# Playbook <a name=\"top\"></a>\n",
    "\n",
    "- IN:1 Initialise environment\n",
    "- SR:1 Search for MISP events\n",
    "- MP:1 Manipulate MISP events\n",
    "- EN:1 Send a report via chat\n",
    "- Result\n",
    "- External references\n",
    "- Technical details"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "8dc24913",
   "metadata": {},
   "source": [
    "## IN:1 Initialise environment\n",
    "This section initialises our environment and loads the required Python libraries."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "5f94c336",
   "metadata": {},
   "outputs": [],
   "source": [
    "import json"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "d4f135da",
   "metadata": {},
   "source": [
    "## SR:1 Search for MISP events\n",
    "\n",
    "In this **start** step we search for MISP events. You need to supply the **list of organisations** and / or **tags** that you are interested in. We will then use this result in our next execution steps."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "75e45517",
   "metadata": {},
   "outputs": [],
   "source": [
    "required_orgs = [ \"MyCSIRT\", \"MySOC\"]\n",
    "required_tags = [ \"workflow:state=\\\"draft\\\"\", \"PAP:GREEN\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "a0587ac0",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Do Python things\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "fb59cb1f",
   "metadata": {},
   "source": [
    "## MP:1: Manipulate MISP events\n",
    "\n",
    "In this steps we use the result from searching for MISP events and manipulate the events. We can change the workflow state and publish the event."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "3a3d28c3",
   "metadata": {},
   "outputs": [],
   "source": [
    "change_workflow: True\n",
    "publish_event: True"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "81ac5cb4",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Do Python things\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "70dea5ca",
   "metadata": {},
   "source": [
    "## EN:1 Send a report via chat\n",
    "\n",
    "In this **end** step we send the result of our actions to a chat channel. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "ca49f33e",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Do Python things\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "c1347592",
   "metadata": {},
   "source": [
    "## Result\n",
    "\n",
    "In the closure of our playbook we print the **result** of our actions. This can also just be a \"success\" / \"failure\" status."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "4c03bb30",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[92m Success\n"
     ]
    }
   ],
   "source": [
    "print(\"\\033[92m Success\")\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "b17af9f2",
   "metadata": {},
   "source": [
    "## External references \n",
    "\n",
    "- [The MISP Project](https://www.misp-project.org/)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e1c813f6",
   "metadata": {},
   "source": [
    "## Technical details <a name=\"techdetails\"></a>\n",
    "\n",
    "- Requires PyMISP\n",
    "- Requires network access to your MISP server via HTTPS (tcp/443)\n",
    "- Requires a MISP API key with write permissions"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}