misp-playbooks/pb_provision_users_organisations-with_output.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "ca1fbfb5",
   "metadata": {
    "tags": [
     "playbook-introduction"
    ]
   },
   "source": [
    "# Provision users and organisations\n",
    "\n",
    "## Introduction\n",
    "\n",
    "- UUID: **078ac11a-d0d9-4beb-aec7-067735ce6bed**\n",
    "- Started from [issue 43](https://github.com/MISP/misp-playbooks/issues/43)\n",
    "- State: **Published** : demo version with **output**\n",
    "- Purpose: This playbook **creates users** and organisations with PyMISP. It also shows how to reset a password and delete or disable users. It includes an example how to get the user logs and how to create large number of users at once. For this playbook your MISP API key needs to be associated with a user that is a **site admin**.\n",
    "- Tags: [ \"users\", \"organisations\", \"training\", \"provisioning\" ]\n",
    "- External resources: **Mattermost**\n",
    "- Target audience: **CTI**\n",
    "- Graphical workflow \n",
    "\n",
    "![helpers/playbook-provision_users_organisations.png](helpers/playbook-provision_users_organisations.png)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a512a2c1",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true,
    "tags": []
   },
   "source": [
    "# Playbook\n",
    "\n",
    "- **Playbook title**\n",
    "- - Introduction\n",
    "- **Preparation**\n",
    "- - PR:1 Initialise environment\n",
    "- - PR:2 Load helper variables\n",
    "- **Organisations**\n",
    "- - OR:1 List the MISP organisations\n",
    "- - OR:2 Add a new MISP organisation\n",
    "- - OR:3 Delete a MISP organisation\n",
    "- - OR:4 Edit a MISP organisation\n",
    "- **Roles**\n",
    "- - RO:1 List MISP user roles\n",
    "- **Users**\n",
    "- - US:1 List MISP users\n",
    "- - US:2 Add MISP users\n",
    "- - US:3 Delete a MISP user\n",
    "- - US:4 Reset password of a user\n",
    "- - US:5 Disable a user\n",
    "- - US:6 Search for a user by IP\n",
    "- - US:7 Dump user logs\n",
    "- **Users for training instances**\n",
    "- - TR:1 Create training users\n",
    "- - TR:2 Delete training users\n",
    "- **Summary**\n",
    "- - EN:1 Create the summary of the playbook\n",
    "- - EN:2 Send a summary to Mattermost\n",
    "- - EN:3 End of the playbook\n",
    "- External references\n",
    "- Technical details"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8dc24913",
   "metadata": {
    "tags": []
   },
   "source": [
    "# Preparation\n",
    "\n",
    "## PR:1 Initialise environment\n",
    "\n",
    "This section **initialises the playbook environment** and loads the required Python libraries. \n",
    "\n",
    "The credentials for MISP (**API key**) are loaded from the file `keys.py` in the directory **vault**. For this playbook your MISP API key needs to be associated with a user that is a **site admin**.\n",
    "\n",
    "A [PyMISP](https://github.com/MISP/PyMISP) object is created to interact with MISP and the active MISP server is displayed. By printing out the server name you know that it's possible to connect to MISP. In case of a problem PyMISP will indicate the error with `PyMISPError: Unable to connect to MISP`.\n",
    "\n",
    "The contents of the `keys.py` file should contain at least :\n",
    "\n",
    "```\n",
    "misp_url=\"<MISP URL>\"                  # The URL to our MISP server\n",
    "misp_key=\"<MISP API KEY>\"              # The MISP API key\n",
    "misp_verifycert=<True or False>        # Indicate if PyMISP should attempt to verify the certificate or ignore errors\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "5f94c336",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "The version of PyMISP recommended by the MISP instance (2.4.176) is newer than the one you're using now (2.4.173). Please upgrade PyMISP.\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "The \u001b[92mPython libraries\u001b[90m are loaded and the \u001b[92mcredentials\u001b[90m are read from the keys file.\n",
      "I will use the MISP server \u001b[92mhttps://misp.demo.cudeso.be/\u001b[90m for this playbook.\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "# Initialise Python environment\n",
    "import urllib3\n",
    "import sys\n",
    "import json\n",
    "from pyfaup.faup import Faup\n",
    "from prettytable import PrettyTable, MARKDOWN\n",
    "from IPython.display import Image, display, display_markdown, HTML\n",
    "from datetime import date\n",
    "import requests\n",
    "import uuid\n",
    "from uuid import uuid4\n",
    "from pymisp import *\n",
    "from pymisp.tools import GenericObjectGenerator\n",
    "\n",
    "import csv\n",
    "from io import StringIO\n",
    "import secrets, string\n",
    "\n",
    "# Load the credentials\n",
    "sys.path.insert(0, \"../vault/\")\n",
    "from keys import *\n",
    "if misp_verifycert is False:\n",
    "    import urllib3\n",
    "    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n",
    "print(\"The \\033[92mPython libraries\\033[90m are loaded and the \\033[92mcredentials\\033[90m are read from the keys file.\")\n",
    "\n",
    "# Create the PyMISP object\n",
    "misp = PyMISP(misp_url, misp_key, misp_verifycert)\n",
    "print(\"I will use the MISP server \\033[92m{}\\033[90m for this playbook.\\n\\n\".format(misp_url))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f3b1ebc8-0905-4afc-939c-8dde8776d5a1",
   "metadata": {},
   "source": [
    "## PR:2 Set helper variables\n",
    "\n",
    "This cell contains **helper variables** that are used in this playbook."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "1143509b-2092-4775-afce-a4890bc1bd31",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "# MISP roles\n",
    "misp_roles = {}\n",
    "\n",
    "# List of created users\n",
    "add_users = []\n",
    "\n",
    "# Char list for generating the password\n",
    "charlist = string.ascii_letters + string.digits + string.punctuation\n",
    "charlist = charlist.replace('|', '')   # Remove the pipe\n",
    "\n",
    "# Password length when generating passwords\n",
    "password_length = 16\n",
    "\n",
    "# Organisation ID\n",
    "org_id = False\n",
    "\n",
    "# Summary\n",
    "summary_org = \"\"\n",
    "summary_users = \"\"\n",
    "summary_users_training = \"\""
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5979d5c2-337b-4e44-81f5-3ab553c63c5e",
   "metadata": {},
   "source": [
    "# Organisations\n",
    "\n",
    "In MISP, users belongs to an [organisation](https://www.circl.lu/doc/misp/administration/#organisations).\n",
    "\n",
    "As a reminder, **local** organisations are those local on your MISP server, **remote** organisations are automatically created when you sync with external servers. You can change an organisation from remote to local by editing its properties."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5216d338-12b0-4125-baab-8755e19400fe",
   "metadata": {},
   "source": [
    "## OR:1 List the MISP organisations\n",
    "\n",
    "The next cell queries MISP for all **local** (set with `scope`) organisations and prints out their ID (`org_id`) and UUID."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "01d88e23-d48c-4554-b0f4-d5722df08077",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+----+--------------+--------------------------------------+\n",
      "| ID | Organisation |                 UUID                 |\n",
      "+----+--------------+--------------------------------------+\n",
      "|  1 | DEMO         | 5c1eb4f8-bae5-45f5-a772-06d4a3f64c3e |\n",
      "|  5 | LEA demo     | bc081572-a389-49c7-bd2a-5e405834b181 |\n",
      "+----+--------------+--------------------------------------+\n"
     ]
    }
   ],
   "source": [
    "organisation_list = misp.organisations(scope=\"local\", pythonify=True)\n",
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Organisation\", \"UUID\"]\n",
    "table.align[\"ID\"] = \"r\"\n",
    "table.align[\"Organisation\"] = \"l\"\n",
    "\n",
    "for org in organisation_list:\n",
    "    table.add_row([org.id, org.name, org.uuid])\n",
    "print(table.get_string(sortby=\"Organisation\"))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a784c1b1-03ea-4e6a-898d-12026de510bf",
   "metadata": {},
   "source": [
    "## OR:2 Add a new MISP organisation\n",
    "\n",
    "You can add a **new MISP organisation** in the next cells. Later on, when you add users you can add them to this newly created organisation or you can use an existing organisation from the list above. When you create an organisation you can specify its UUID. If you don't provide one, then MISP will generate it for you."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "b4606bdf-bcd4-4cb9-86b9-a3ed6870f749",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Organisation \u001b[92mTraining botvrij.eu\u001b[90m created.\n",
      "Use org_id \u001b[92m112\u001b[90m or \u001b[92mdcd381ca-8f5d-4c71-a50b-182b3e0509cd\u001b[90m to add users.\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "# Organisation details\n",
    "organisation = MISPOrganisation()\n",
    "\n",
    "organisation.name = \"Training botvrij.eu\"\n",
    "# organisation.uuid = \"\"\n",
    "organisation.type = \"MISP Organisation - Training\"\n",
    "organisation.nationality = \"Belgium\"\n",
    "organisation.sector = \"IT\"\n",
    "organisation.local = 1\n",
    "\n",
    "# Only execute if you want to create a new organisation\n",
    "org = misp.add_organisation(organisation, pythonify=True)\n",
    "if not \"errors\" in org:\n",
    "    print(\"Organisation \\033[92m{}\\033[90m created.\\nUse org_id \\033[92m{}\\033[90m or \\033[92m{}\\033[90m to add users.\\n\\n\".format(org.name, org.id, org.uuid))\n",
    "    org_id = org.id\n",
    "    summary_org += \"### New MISP organisation\\n\"\n",
    "    summary_org += \"\\n - Name: **{}**\".format(organisation.name)\n",
    "    summary_org += \"\\n - ID: {}\".format(org.id)\n",
    "    summary_org += \"\\n - UUID: {}\".format(org.uuid)\n",
    "    summary_org += \"\\n\"\n",
    "else:\n",
    "    print(\"Unable to create organisation \\033[91m{}\\033[90m \\n{}\\n\\n\".format(org_name, org))\n",
    "    org_id = False"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "81684507-acec-4b03-955e-2dc82d0334d2",
   "metadata": {},
   "source": [
    "## OR:3 Delete a MISP organisation\n",
    "\n",
    "The playbook also allows you to delete an existing organisation. The code in the next cell is set to `raw`, so it's not automatically executed. Generally organisations should never be deleted. If you are certain you would like to remove an organisation and are aware of the impact, make sure that there are no users or events tied to the organisation before deleting it."
   ]
  },
  {
   "cell_type": "raw",
   "id": "906a7053-1a78-4bf9-a705-56f713ff9f7c",
   "metadata": {
    "tags": []
   },
   "source": [
    "delete_org_id = \"-1\"\n",
    "\n",
    "result = misp.delete_organisation(delete_org_id)   # Delete org can only by ID\n",
    "if not \"errors\" in result:\n",
    "    print(\"Organisation \\033[92m{}\\033[90m deleted.\\n\\n\".format(delete_org_id))\n",
    "else:\n",
    "    print(\"Organisation \\033[91m{}\\033[90m not deleted.\\n\\n\".format(delete_org_id))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9b6bbe7f-b38f-4671-9638-fd30c2c9ee22",
   "metadata": {},
   "source": [
    "## OR:4 Edit a MISP organisation\n",
    "\n",
    "Next to adding or deleting organisations, you can edit existing organisations. One of the common actions is moving a local organisation to a remote organisation. In the next cell we query for the organisation you created earlier and change it to a remote organisation, afterwards we switch it back to its original state."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "bc4ffada-c544-4594-a1c2-62e6bc7dce6c",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Setting organisation Training botvrij.eu to \u001b[92mremote\u001b[90m.\n",
      "{'Organisation': {'id': '112', 'name': 'Training botvrij.eu', 'date_created': '2023-10-18 15:56:28', 'date_modified': '2023-10-18 15:56:32', 'description': None, 'type': 'MISP Organisation - Training', 'nationality': 'Belgium', 'sector': 'IT', 'created_by': '1', 'uuid': 'dcd381ca-8f5d-4c71-a50b-182b3e0509cd', 'contacts': None, 'local': False, 'restricted_to_domain': [], 'landingpage': None}} \n",
      "\n",
      "\n",
      "Setting organisation Training botvrij.eu to \u001b[92moriginal state\u001b[90m.\n",
      "{'Organisation': {'id': '112', 'name': 'Training botvrij.eu', 'date_created': '2023-10-18 15:56:28', 'date_modified': '2023-10-18 15:56:32', 'description': None, 'type': 'MISP Organisation - Training', 'nationality': 'Belgium', 'sector': 'IT', 'created_by': '1', 'uuid': 'dcd381ca-8f5d-4c71-a50b-182b3e0509cd', 'contacts': None, 'local': True, 'restricted_to_domain': [], 'landingpage': None}}\n"
     ]
    }
   ],
   "source": [
    "org = misp.get_organisation(org_id, pythonify=True)\n",
    "if not \"errors\" in org:\n",
    "    current_state = org.local\n",
    "    org.local = False\n",
    "    print(\"Setting organisation {} to \\033[92mremote\\033[90m.\".format(org.name))\n",
    "    print(misp.update_organisation(org), \"\\n\\n\")\n",
    "    org.local = current_state\n",
    "    print(\"Setting organisation {} to \\033[92moriginal state\\033[90m.\".format(org.name))\n",
    "    print(misp.update_organisation(org))\n",
    "else:\n",
    "    print(\"Organisation not found \\033[91m{}\\033[90m.\\n\\n\".format(org))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58768890-62ed-4144-a4a6-3193693d24d0",
   "metadata": {},
   "source": [
    "# Roles\n",
    "\n",
    "Privileges are assigned to users by assigning them to [role groups](https://www.circl.lu/doc/misp/administration/#roles). Role groups use one of four options (Read Only, Manage My Own Events, Manage Organisation Events, Manage & Publish Organisation Events) determining what users can do with events as well as four additional privilege elevation settings.\n",
    "\n",
    "## RO:1 List MISP user roles\n",
    "\n",
    "MISP has a build-in list of user roles but you can also add your own roles. When you add a new user you have to **specify its role** (with `role_id`). If you do not specify a role in this playbook the newly created users are assigned the role of **User**."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "45b18eeb-b838-4733-b0d2-8291eb349831",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+----+-------------+\n",
      "| ID | Role name   |\n",
      "+----+-------------+\n",
      "|  1 | admin       |\n",
      "|  2 | Org Admin   |\n",
      "|  3 | User        |\n",
      "|  4 | Publisher   |\n",
      "|  5 | Sync user   |\n",
      "|  6 | Read Only   |\n",
      "|  7 | BigCruncher |\n",
      "+----+-------------+\n"
     ]
    }
   ],
   "source": [
    "roles = misp.roles(pythonify=True)\n",
    "\n",
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Role name\"]\n",
    "table.align[\"ID\"] = \"r\"\n",
    "table.align[\"Role name\"] = \"l\"\n",
    "for role in roles:\n",
    "    misp_roles[role.id] = role.name\n",
    "    table.add_row([role.id, role.name])\n",
    "print(table.get_string(sortby=\"ID\"))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1759ff7b-8dd8-438f-8169-68a7fe1d5fae",
   "metadata": {},
   "source": [
    "# Users\n",
    "\n",
    "## US:1 List MISP users\n",
    "\n",
    "When you list the [users](https://www.circl.lu/doc/misp/administration/#users) on your MISP platform you can list them all, or specify an organisation ID."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "3052239c-f74d-466c-95fa-f0e4589e3e1c",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+-----+------------------+--------+---------+\n",
      "|  ID | Username         | org_id | role_id |\n",
      "+-----+------------------+--------+---------+\n",
      "|   1 | admin@admin.test |   1    |    1    |\n",
      "| 199 | sync@admin.test  |   1    |    5    |\n",
      "+-----+------------------+--------+---------+\n"
     ]
    }
   ],
   "source": [
    "# Set this to an organisation ID if you want to see users from a specific organisation\n",
    "\n",
    "filter_organisation = False\n",
    "users_list = misp.users(organisation=filter_organisation, pythonify=True)\n",
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Username\", \"org_id\", \"role_id\"]\n",
    "table.align[\"ID\"] = \"r\"\n",
    "table.align[\"Username\"] = \"l\"\n",
    "\n",
    "for user in users_list:\n",
    "    table.add_row([user.id, user.email, user.org_id, user.role_id])\n",
    "print(table.get_string(sortby=\"Username\"))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0f30d8fc-a7d1-4581-aa0b-9603182242e6",
   "metadata": {},
   "source": [
    "## US:2 Add MISP users\n",
    "\n",
    "The playbook adds users from a CSV that you can paste in the next cell. There is only one mandatory field: **username**. The other fields are optional. The format of the CSV is: `username,role_id,password,org_id`\n",
    "\n",
    "- If **role_id** is empty then the **user** (`default_role_id`) role is used;\n",
    "- If **password** is empty then a **random generated** password is used;\n",
    "- If **org_id** is empty the organisation specified earlier via `org_id` is used.\n",
    "\n",
    "After the creation of the user the playbook prints a summary. Set `summary_print_password` to True to print the newly generated password if you have emailing disabled in MISP. There are additional settings of importance, such as requiring a user to change the password after first login (`change_pw`)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "cdc80de7-ac5f-4fe1-8cdc-06511e467d22",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Default organisation (if none is provided in the CSV): \u001b[92m112\u001b[90m\n",
      "Default role (if none is provided in the CSV): \u001b[92m3\u001b[90m\n",
      "\n",
      "\n",
      "Continue with the next cell to create the users.\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "# CSV data\n",
    "csv_data = \"\"\"username,role_id,password,org_id\n",
    "user1@training.botvrij.eu,,,\n",
    "orgadmin1@training.botvrij.eu,2,,\n",
    "admin1@training.botvrij.eu,1,,\n",
    "\"\"\"\n",
    "\n",
    "# Password change required\n",
    "change_pw = 1\n",
    "\n",
    "# Disable autoalert and contactalert\n",
    "autoalert = 0\n",
    "contactalert = 0\n",
    "\n",
    "# Is the user initially disabled?\n",
    "disabled = 0\n",
    "\n",
    "# Default use role\n",
    "default_role_id = 3  # User\n",
    "\n",
    "# Print the password after creation\n",
    "summary_print_password = True\n",
    "\n",
    "print(\"Default organisation (if none is provided in the CSV): \\033[92m{}\\033[90m\".format(org_id))\n",
    "print(\"Default role (if none is provided in the CSV): \\033[92m{}\\033[90m\".format(default_role_id))\n",
    "print(\"\\n\\nContinue with the next cell to create the users.\\n\\n\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "91dbff23-b84d-4ba7-b09c-73e103700c8e",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Start creating users ...\n",
      " New user \u001b[92muser1@training.botvrij.eu\u001b[90m created with ID 241.\n",
      " New user \u001b[92morgadmin1@training.botvrij.eu\u001b[90m created with ID 242.\n",
      " New user \u001b[92madmin1@training.botvrij.eu\u001b[90m created with ID 243.\n",
      "Created \u001b[92m3\u001b[90m users.\n"
     ]
    }
   ],
   "source": [
    "csv_file = StringIO(csv_data)\n",
    "csv_reader = csv.reader(csv_file)\n",
    "next(csv_reader)  # Skip headers\n",
    "count_user = 0\n",
    "print(\"Start creating users ...\")\n",
    "for row in csv_reader:\n",
    "    username, role_id, password, user_org_id = row\n",
    "\n",
    "    # Generate a random password\n",
    "    if len(password.strip()) < 1:\n",
    "        password = \"\"\n",
    "        for i in range(password_length):\n",
    "            password += \"\".join(secrets.choice(charlist))\n",
    "\n",
    "    # Use the default organisation\n",
    "    if len(user_org_id.strip()) < 1:\n",
    "        user_org_id = org_id\n",
    "\n",
    "    organisation = misp.get_organisation(user_org_id, pythonify=True)\n",
    "    if \"errors\" in organisation:\n",
    "        user_org_id = 0\n",
    "    else:\n",
    "        organisation_name = organisation.name\n",
    "\n",
    "    # Use the default user role\n",
    "    if len(role_id.strip()) < 1:\n",
    "        role_id = default_role_id\n",
    "\n",
    "    # Create the user\n",
    "    user = MISPUser()\n",
    "    user.email = username\n",
    "    user.password = password\n",
    "    user.change_pw = change_pw\n",
    "    user.org_id = org_id\n",
    "    user.role_id = role_id\n",
    "    user.user_invited_by = \"MISP playbook\"\n",
    "    user.autoalert = autoalert\n",
    "    user.contactalert = contactalert\n",
    "    user.disabled = disabled\n",
    "\n",
    "    new_user = misp.add_user(user, pythonify=True)\n",
    "    if not \"errors\" in new_user:\n",
    "        user.id = new_user.id\n",
    "        user.authkey = new_user.authkey\n",
    "        user.custom_delete = False\n",
    "        user.custom_disabled = False\n",
    "        user[\"custom_organisation_name\"] = organisation_name\n",
    "        add_users.append(user)\n",
    "        count_user += 1\n",
    "        print(\" New user \\033[92m{}\\033[90m created with ID {}.\".format(new_user.email, new_user.id))\n",
    "    else:\n",
    "        print(\" Unable to add \\033[91m{}\\033[90m.{}.\".format(user.email, new_user))\n",
    "\n",
    "print(\"Created \\033[92m{}\\033[90m users.\".format(count_user))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "76acad68-2b31-4a54-9bf6-b0d9b60beb55",
   "metadata": {},
   "source": [
    "### Summary\n",
    "\n",
    "The next cell prints out the list of users created. Be warned that depending on the setting of `summary_print_password` it can print out passwords. At the end of this playbook the summary is sent to Mattermost."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "c9683b80-cf18-4884-8f14-5801b5297d63",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+-----+-------------------------------+---------------------------+---------------+------------------+\n",
      "|  ID | Username                      | Organisation              | Role          | Password         |\n",
      "+-----+-------------------------------+---------------------------+---------------+------------------+\n",
      "| 243 | admin1@training.botvrij.eu    | 112 - Training botvrij.eu | 1 - admin     | la>4wI`&\\j!'ICBq |\n",
      "| 242 | orgadmin1@training.botvrij.eu | 112 - Training botvrij.eu | 2 - Org Admin | ]ebqZv=4'wq6Rx4- |\n",
      "| 241 | user1@training.botvrij.eu     | 112 - Training botvrij.eu | 3 - User      | x$4qC,eY}.\\jj;zF |\n",
      "+-----+-------------------------------+---------------------------+---------------+------------------+\n"
     ]
    }
   ],
   "source": [
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Username\", \"Organisation\", \"Role\", \"Password\"]\n",
    "table.align[\"ID\"] = \"r\"\n",
    "table.align[\"Username\"] = \"l\"\n",
    "table.align[\"Organisation\"] = \"l\"\n",
    "table.align[\"Role\"] = \"l\"\n",
    "table.align[\"Password\"] = \"l\"\n",
    "\n",
    "for user in add_users:\n",
    "    password = user.password if summary_print_password else \"******\"\n",
    "    table.add_row([user.id, user.email, \"{} - {}\".format(user.org_id, user.custom_organisation_name), \"{} - {}\".format(user.role_id, misp_roles[str(user.role_id)]), password])\n",
    "print(table.get_string(sortby=\"Username\"))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2243ae8b-cb77-4835-a0cd-2738ee8c9bec",
   "metadata": {},
   "source": [
    "## US:3 Delete a MISP user\n",
    "\n",
    "Just as easy it is to create a user, it's also possible to delete them. Note that the `delete_user` function of PyMISP expects a user ID, not a user email. In the cell below we loop through all users until there is a match with the searched for email."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "72256ce0-6b87-4976-9861-f4ce4aa785ef",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "User \u001b[92morgadmin1@training.botvrij.eu\u001b[90m. deleted.\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "delete_user = \"orgadmin1@training.botvrij.eu\"\n",
    "\n",
    "users_list = misp.users(pythonify=True)\n",
    "result = False\n",
    "for user in users_list:\n",
    "    if delete_user.strip() == user.email:\n",
    "        result = misp.delete_user(user.id)   # Delete user can only by ID\n",
    "        if not \"errors\" in result:\n",
    "            print(\"User \\033[92m{}\\033[90m. deleted.\\n\\n\".format(delete_user))\n",
    "            for el in add_users:\n",
    "                if int(el.id) == int(user.id):\n",
    "                    el.custom_delete = True\n",
    "        else:\n",
    "            print(\"Unable to delete user \\033[91m{}\\033[90m {}.\\n\\n\".format(delete_user, result))\n",
    "if not result:\n",
    "    print(\"User \\033[91m{}\\033[90m not found and/or not deleted.\\n\\n\".format(delete_user))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "babe4a33-1f24-48c7-8cea-8a8de8639f56",
   "metadata": {},
   "source": [
    "## US:4 Reset password of a user\n",
    "\n",
    "MISP allows you to reset the password of a user (via a POST request to https://misp/users/initiatePasswordReset/{$user_id}). This relies on MISP being able to send out emails. In some environments **emailing has been disabled**. In these cases you have to manually set a temporary password and request the user to change the password on first login. \n",
    "\n",
    "Note that the reset relies on the **user ID**. Previous cells have shown how to match the ID with an e-mail address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "54a8c8f3-1105-4a95-967e-537691438d6c",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Attempt to reset the password for user \u001b[92madmin1@training.botvrij.eu\u001b[90m with \u001b[92m'18-d27z_`iY7s-W\u001b[90m\n",
      "\n",
      "\n",
      "{\"User\":{\"id\":\"243\",\"password\":\"******\",\"org_id\":\"112\",\"server_id\":\"0\",\"email\":\"admin1@training.botvrij.eu\",\"autoalert\":false,\"invited_by\":\"1\",\"gpgkey\":\"\",\"certif_public\":\"\",\"nids_sid\":\"9238533\",\"termsaccepted\":false,\"newsread\":\"0\",\"role_id\":\"1\",\"change_pw\":true,\"contactalert\":false,\"disabled\":false,\"expiration\":null,\"current_login\":\"0\",\"last_login\":\"0\",\"force_logout\":false,\"date_created\":\"1697644601\",\"date_modified\":\"1697644629\",\"sub\":null,\"external_auth_required\":false,\"external_auth_key\":\"\",\"last_api_access\":\"0\",\"notification_daily\":false,\"notification_weekly\":false,\"notification_monthly\":false,\"totp\":null,\"hotp_counter\":null}}\n"
     ]
    }
   ],
   "source": [
    "user_id = 243\n",
    "\n",
    "user = misp.get_user(user_id, expanded=False, pythonify=True)\n",
    "if not \"errors\" in user:\n",
    "    password = \"\"\n",
    "    for i in range(password_length):\n",
    "        password += \"\".join(secrets.choice(charlist))\n",
    "    data = {\"enable_password\": 1, \"change_pw\": 1, \"password\": password}\n",
    "    request = misp._prepare_request(\"POST\", \"{}/admin/users/edit/{}\".format(misp_url, user_id), data=data)\n",
    "    print(\"Attempt to reset the password for user \\033[92m{}\\033[90m with \\033[92m{}\\033[90m\\n\\n\".format(user.email, password))\n",
    "    for el in add_users:\n",
    "        if int(el.id) == int(user.id):\n",
    "            el.password = password\n",
    "    print(request.text)\n",
    "else:\n",
    "    print(\"User \\033[91m{}\\033[90m not found.\\n\\n\".format(user_id))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f0aeb460-f10e-4aa2-923d-9ce3e9d4e8e8",
   "metadata": {},
   "source": [
    "## US:5 Disable a user\n",
    "\n",
    "You can use the same approach to disable a user."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "9f35d6f1-179b-4bfd-801b-72de38ecc5f4",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Attempt to disable user \u001b[92muser1@training.botvrij.eu\u001b[90m.\n",
      "\n",
      "\n",
      "{\"User\":{\"id\":\"241\",\"password\":\"******\",\"org_id\":\"112\",\"server_id\":\"0\",\"email\":\"user1@training.botvrij.eu\",\"autoalert\":false,\"invited_by\":\"1\",\"gpgkey\":\"\",\"certif_public\":\"\",\"nids_sid\":\"9816788\",\"termsaccepted\":false,\"newsread\":\"0\",\"role_id\":\"3\",\"change_pw\":true,\"contactalert\":false,\"disabled\":true,\"expiration\":null,\"current_login\":\"0\",\"last_login\":\"0\",\"force_logout\":false,\"date_created\":\"1697644601\",\"date_modified\":\"1697644640\",\"sub\":null,\"external_auth_required\":false,\"external_auth_key\":\"\",\"last_api_access\":\"0\",\"notification_daily\":false,\"notification_weekly\":false,\"notification_monthly\":false,\"totp\":null,\"hotp_counter\":null}}\n"
     ]
    }
   ],
   "source": [
    "user_id = 241\n",
    "\n",
    "user = misp.get_user(user_id, expanded=False, pythonify=True)\n",
    "if not \"errors\" in user:\n",
    "    data = {\"disabled\": 1}\n",
    "    request = misp._prepare_request(\"POST\", \"{}/admin/users/edit/{}\".format(misp_url, user_id), data=data)\n",
    "    print(\"Attempt to disable user \\033[92m{}\\033[90m.\\n\\n\".format(user.email))\n",
    "    for el in add_users:\n",
    "        if int(el.id) == int(user.id):\n",
    "            el.custom_disabled = True\n",
    "    print(request.text)\n",
    "else:\n",
    "    print(\"User \\033[91m{}\\033[90m not found.\\n\\n\".format(user_id))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "201bfdc5-fb9c-4419-b88a-67dd1a2072ef",
   "metadata": {},
   "source": [
    "## US:6 Search for a user by IP\n",
    "\n",
    "MISP allows you to search for the user account that accessed MISP from a specific IP. Note that if multiple users use the same IP, only the last user ID will be returned.\n",
    "\n",
    "Note that it's also possible to list the IPs used by a specific user account, but this feature is only accessible via the console interface with `cake user user_ips <userid>`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "8fa8ddef-550d-4611-80b9-5c6553c159bd",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"127.0.0.1\":{\"id\":\"1\",\"email\":\"admin@admin.test\"}}\n"
     ]
    }
   ],
   "source": [
    "search_ip = \"127.0.0.1\"\n",
    "\n",
    "data = {\"ip\": search_ip}\n",
    "request = misp._prepare_request(\"POST\", \"{}/servers/ipUser\".format(misp_url), data=data)\n",
    "print(request.text)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "87ca6007-f34b-4dd2-95c8-cf731557e853",
   "metadata": {},
   "source": [
    "## US:7 Dump user logs\n",
    "\n",
    "And finally, you can also get the last log entries for a specific user. This can be used to alert on specific activity."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "efa77ce1-eea6-465d-9afc-364c6a384f41",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "user_id = 1\n",
    "\n",
    "request = misp._prepare_request(\"GET\", \"{}/admin/audit_logs/index/user:{}\".format(misp_url, user_id))\n",
    "request_json = json.loads(request.text)\n",
    "\n",
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Created\", \"Action\", \"Model\", \"Event ID\", \"Change\"]\n",
    "table.align[\"Change\"] = \"l\"\n",
    "table._max_width = {\"Change\": 30}\n",
    "for row in request_json:\n",
    "    if \"AuditLog\" in row:\n",
    "        auditlog = row[\"AuditLog\"]\n",
    "        table.add_row([auditlog[\"id\"], auditlog[\"created\"], auditlog[\"action\"], auditlog[\"model\"], auditlog[\"event_id\"], auditlog[\"change\"]])\n",
    "print(table.get_string(sortby=\"Created\", reversesort=True))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3d37990d-7978-4789-8ea7-f701e6146f76",
   "metadata": {},
   "source": [
    "# Users for training instances\n",
    "\n",
    "In specific cases, such as when you setup a training environment, it's useful to automatically create a large number of users, with default credentials and then afterwards delete these users.\n",
    "\n",
    "## TR:1 Create training users\n",
    "\n",
    "The next cell creates a number (`max_user`) of user accounts (both a regular user and a site admin user) and links these users to an organisation (`org_id`)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "ad3de488-8526-4602-96b5-b0a5505018e7",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "# How many users (Site Admin and User) do you want to add?\n",
    "max_users = 5\n",
    "\n",
    "# What's the organisation ID?\n",
    "training_org_id = 1\n",
    "if 'org_id' in vars() and org_id is not None:\n",
    "    training_org_id = org_id\n",
    "\n",
    "# Naming and credentials for the training accounts\n",
    "default_password = \"Password-User-{user}\"\n",
    "default_siteadmin = \"training-admin-{user}@training.botvrij.eu\"\n",
    "default_user = \"training-user-{user}@training.botvrij.eu\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "14ff23fd-110f-4991-a674-bb67a48059b6",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Creating training users ...\n",
      " Add Site Admin training-admin-1@training.botvrij.eu\n",
      " Add User training-user-1@training.botvrij.eu\n",
      " Add Site Admin training-admin-2@training.botvrij.eu\n",
      " Add User training-user-2@training.botvrij.eu\n",
      " Add Site Admin training-admin-3@training.botvrij.eu\n",
      " Add User training-user-3@training.botvrij.eu\n",
      " Add Site Admin training-admin-4@training.botvrij.eu\n",
      " Add User training-user-4@training.botvrij.eu\n",
      " Add Site Admin training-admin-5@training.botvrij.eu\n",
      " Add User training-user-5@training.botvrij.eu\n",
      "Finished.\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "current_user = 1\n",
    "print(\"Creating training users ...\")\n",
    "summary_users_training += \"### Training users\\n\\n\"\n",
    "summary_users_training += \"| User  | Role          | Password         |\\n\"\n",
    "summary_users_training += \"|:------|:--------------|:-----------------|\\n\"\n",
    "while current_user <= max_users:\n",
    "    user = MISPUser()\n",
    "    user.email = default_siteadmin.format(user=current_user)\n",
    "    user.password = default_password.format(user=current_user)\n",
    "    user.change_pw = 0\n",
    "    user.org_id = training_org_id\n",
    "    user.role_id = 1  # Site admin\n",
    "    add_user = misp.add_user(user, pythonify=True)\n",
    "    print(\" Add Site Admin %s\" % user.email)\n",
    "    summary_users_training += \"| %s | %s | %s |\\n\" % (user.email, \"admin\", user.password)\n",
    "    user = MISPUser()\n",
    "    user.email = default_user.format(user=current_user)\n",
    "    user.password = default_password.format(user=current_user)\n",
    "    user.change_pw = 0\n",
    "    user.org_id = training_org_id\n",
    "    user.role_id = 3  # User\n",
    "    add_user = misp.add_user(user, pythonify=True)\n",
    "    print(\" Add User %s\" % user.email)\n",
    "    summary_users_training += \"| %s | %s | %s |\\n\" % (user.email, \"user\", user.password)    \n",
    "\n",
    "    current_user += 1\n",
    "\n",
    "print(\"Finished.\\n\\n\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "acd68f85-4c38-4bfb-8cbe-9d50c546cb46",
   "metadata": {},
   "source": [
    "## TR:2 Delete training users\n",
    "\n",
    "After the training, this snippet can be used to remove these training users.\n",
    "\n",
    "If you execute this step, then it's worth setting `summary_users_training` to blank, otherwise the message to Mattermost contains wrong information."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "793a7c69-d835-42cf-b059-9db878091a67",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/244', 'id': '244'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/245', 'id': '245'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/246', 'id': '246'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/247', 'id': '247'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/248', 'id': '248'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/249', 'id': '249'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/250', 'id': '250'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/251', 'id': '251'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/252', 'id': '252'}\n",
      "{'saved': True, 'success': True, 'name': 'User deleted.', 'message': 'User deleted.', 'url': '/admin/users/delete/253', 'id': '253'}\n"
     ]
    }
   ],
   "source": [
    "users_list = misp.users(pythonify=True)\n",
    "for user in users_list:\n",
    "    if (\"training-user-\" in user.email) or (\"training-admin-\" in user.email):\n",
    "        print(misp.delete_user(user.id))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "70dea5ca",
   "metadata": {},
   "source": [
    "# Closure\n",
    "\n",
    "In this **closure** or end step we create a **summary** of the actions that were performed by the playbook. The summary is printed in the playbook and can also be send to a chat channel. "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e26c83d7-a975-448b-a7a2-862a18bda023",
   "metadata": {},
   "source": [
    "## EN:1 Create the summary of the playbook \n",
    "\n",
    "The next section creates a summary and stores the output in the variable `summary` in Markdown format. It also stores an intro text in the variable `intro`. These variables can later be used when sending information to Mattermost or TheHive."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "482cbfd0-56f4-4c10-87ef-4dee8f3ca34d",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "# Create a new user table, we might have deleted, disabled or changed passwords\n",
    "table = PrettyTable()\n",
    "table.field_names = [\"ID\", \"Username\", \"Organisation\", \"Role\", \"Password\", \"Deleted\", \"Disabled\"]\n",
    "table.align[\"ID\"] = \"r\"\n",
    "table.align[\"Username\"] = \"l\"\n",
    "table.align[\"Organisation\"] = \"l\"\n",
    "table.align[\"Role\"] = \"l\"\n",
    "table.align[\"Password\"] = \"l\"\n",
    "\n",
    "for user in add_users:\n",
    "    password = user.password if summary_print_password else \"******\"\n",
    "    table.add_row([user.id, user.email, \"{} - {}\".format(user.org_id, user.custom_organisation_name), \"{} - {}\".format(user.role_id, misp_roles[str(user.role_id)]), password, user.custom_delete, user.custom_disabled])\n",
    "summary_users = \"### Add users\\n\"\n",
    "table.set_style(MARKDOWN)\n",
    "summary_users += table.get_string()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "490423d7-901f-478c-95b1-d86b2b989e07",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "The \u001b[92msummary\u001b[90m of the playbook is available.\n",
      "\n"
     ]
    }
   ],
   "source": [
    "summary = \"## MISP Playbook summary\\nProvision users and organisations. \\n\\n\"\n",
    "\n",
    "intro = summary\n",
    "\n",
    "summary += summary_org\n",
    "summary += \"\\n\\n\"\n",
    "summary += summary_users \n",
    "summary += \"\\n\\n\"\n",
    "summary += summary_users_training\n",
    "summary += \"\\n\\n\"\n",
    "\n",
    "print(\"The \\033[92msummary\\033[90m of the playbook is available.\\n\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eba96062-deaa-4fb9-8302-7b3ef829201e",
   "metadata": {},
   "source": [
    "## EN:2 Send a summary to Mattermost\n",
    "\n",
    "Now you can send the summary to Mattermost. You can send the summary in two ways by selecting one of the options for the variable `send_to_mattermost_option` in the next cell.\n",
    "\n",
    "- The default option where the entire summary is in the **chat**, or\n",
    "- a short intro and the summary in a **card**\n",
    "\n",
    "For this playbook we rely on a webhook in Mattermost. You can add a webhook by choosing the gear icon in Mattermost, then choose Integrations and then **Incoming Webhooks**. Set a channel for the webhook and lock the webhook to this channel with *\"Lock to this channel\"*."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "8c455bc3-35cc-436d-8237-95c81b57208f",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "send_to_mattermost_option = \"via a chat message\"\n",
    "#send_to_mattermost_option = \"via a chat message with card\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "ca49f33e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Summary is \u001b[92msent to Mattermost.\n",
      "\n"
     ]
    }
   ],
   "source": [
    "message = False\n",
    "if send_to_mattermost_option == \"via a chat message\":\n",
    "    message = {\"username\": mattermost_playbook_user, \"text\": summary}\n",
    "elif send_to_mattermost_option == \"via a chat message with card\":\n",
    "    message = {\"username\": mattermost_playbook_user, \"text\": intro, \"props\": {\"card\": summary}}\n",
    "\n",
    "if message:\n",
    "    r = requests.post(mattermost_hook, data=json.dumps(message))\n",
    "    r.raise_for_status()\n",
    "if message and r.status_code == 200:\n",
    "    print(\"Summary is \\033[92msent to Mattermost.\\n\")\n",
    "else:\n",
    "    print(\"\\033[91mFailed to sent summary\\033[90m to Mattermost.\\n\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "498b8eff-7d1b-47b7-90c4-e13cc738b36c",
   "metadata": {},
   "source": [
    "## EN:3 End of the playbook "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "4c03bb30",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[92m End of the playbook\n"
     ]
    }
   ],
   "source": [
    "print(\"\\033[92m End of the playbook\")\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b17af9f2",
   "metadata": {},
   "source": [
    "## External references <a name=\"extreferences\"></a>\n",
    "\n",
    "- [misp_control](https://github.com/rommelfs/misp_control/tree/main)\n",
    "- [The MISP Project](https://www.misp-project.org/)\n",
    "- [Mattermost](https://mattermost.com/)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e1c813f6",
   "metadata": {},
   "source": [
    "## Technical details \n",
    "\n",
    "### Documentation\n",
    "\n",
    "This playbook requires these Python **libraries** to exist in the environment where the playbook is executed. You can install them with `pip install <library>`.\n",
    "\n",
    "```\n",
    "pyfaup\n",
    "chardet\n",
    "PrettyTable\n",
    "ipywidgets\n",
    "```\n",
    "\n",
    "You need to have **network access** to \n",
    "- your MISP server (HTTP or HTTPS)\n",
    "\n",
    "You need\n",
    "- an **API key with MISP**\n",
    "- - Under Global Actions, My Profile. Add an extra authentication key.\n",
    "- - Add the API key (`misp_key`) and the MISP URL (`misp_url`) to `keys.py`\n",
    "- - If you use a self-signed certificate set `misp_verifycert` to False\n",
    "\n",
    "### Helper functions\n",
    "\n",
    "### Colour codes\n",
    "\n",
    "The output from Python displays some text in different colours. These are the colour codes\n",
    "\n",
    "```\n",
    "Red = '\\033[91m'\n",
    "Green = '\\033[92m'\n",
    "Blue = '\\033[94m'\n",
    "Cyan = '\\033[96m'\n",
    "White = '\\033[97m'\n",
    "Yellow = '\\033[93m'\n",
    "Magenta = '\\033[95m'\n",
    "Grey = '\\033[90m'\n",
    "Black = '\\033[90m'\n",
    "Default = '\\033[99m'\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "14dce812-e432-4c18-8358-f8b66e5b94a5",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "celltoolbar": "Attachments",
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  },
  "toc-showcode": false,
  "toc-showmarkdowntxt": false
 },
 "nbformat": 4,
 "nbformat_minor": 5
}