Playbook "Create a custom MISP warninglist"

Fixes #7

README.md

@@ -19,6 +19,15 @@ This repository contains the documentation to get started with MISP playbooks.
 
 The repository contains these playbooks
 
+**Create a custom MISP warninglist**
+
+- [MISP Playbook](misp-playbooks/pb_create_custom_MISP_warninglist.ipynb) started from [issue 7](https://github.com/MISP/misp-playbooks/issues/7)
+- - Use the [MISP Playbook with output](misp-playbooks/pb_create_custom_MISP_warninglist-with_output.ipynb) to view the output of the notebook (with additional images)
+-  This playbook creates a custom MISP warninglist with a set of entries provided by the analyst as input. A check is done if the warninglist already exists. If the warninglist already exists then the entries are added to the existing warninglist. When the warninglist is created the MISP events are queried for matches ('retro-search').
+- - The playbook also queries Shodan and VirusTotal for matches with entries in the warninglist. The result of the creation of the warninglist as well as the matches is summarised at the end of the playbook and sent to Mattermost or Slack or added as an alert in TheHive.
+- Target audience: **SOC, CSIRT, CTI**
+![assets/../documentation/assets/playbook-create_custom_MISP_warninglist.png](assets/../documentation/assets/playbook-create_custom_MISP_warninglist.png)
+
 **Create MISP objects and relationships**
 
 - [MISP Playbook](misp-playbooks/pb_create_MISP_objects_and_relationship.ipynb) started from [issue 11](https://github.com/MISP/misp-playbooks/issues/11)

documentation/assets/playbook-create_custom_MISP_warninglist.drawio

@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2023-04-26T08:14:18.614Z" agent="5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/17.4.2 Chrome/100.0.4896.60 Electron/18.0.1 Safari/537.36" etag="ka5MtPeQrSF2p0G8RxS8" version="17.4.2" type="device"><diagram id="nKIzAm7tzG-mqr7zlI_Q" name="Page-1">7V1bc5u8Fv01mfnOQzrcL49J7LSZr+mkdSe9vJxRbNmmwcgHcBz31x8JIwySwNiYixPamdgIAYK19tJma0u+UG8Wrx99sJzfowl0LxRp8nqhDi4URZZtFX+Qkk1cYstxycx3JnHZrmDk/IVxoRSXrpwJDDIVQ4Tc0FlmC8fI8+A4zJQB30frbLUpcrNXXYIZ5ApGY+DypT+cSTjfllqKuSv/BJ3ZnF5ZNuztngWgleM7CeZggtapInV4od74CIXbb4vXG+iSp0efy/a425y9ScN86IVlDvgXzae/Z9P/PgTDn+rD/fXj56/fLlXZ2p7nBbir+JYvFMPFZ7yeInxi3O5wEz8M438rRHdcBhFUV7iCbCxfdzvxtxn5fHDB5gmh56iOARZLXOY9BeTjxocghAQgAtwqCNECf7m/Gz3gjzXwPcebuU4Q0obge9q2ZXvm+HEmzVKCtbNwgYe3rufhwsWFMv46njvu5DPYoBV5PEEIxs9069qHpPkP9NnJTNE9IASWyPmQ7/zF1wZuXIDP44cxTZVsjRG5RFxt6rjuDXKRH7VQNTTTsMzocB89w9QeVdZUXYsfaqp8Gv0jR8Q3d5s94418MxiYydNI0yBmxgv0Q/iaKopp8RGiBQz9Da5C92oxRWMjvbTtuGC9o7wsGXHhPMV3jdYEsZ3NkrPvqIi/xGw8iJk2x8wHH+IbBaGDvJIkKICrKaQG9tC8VYRI7THJ0gAqIrg0AVxWbWjRJqTR+oZtHzdcuvOc0AHYoonNQ+/F8ZG3gF5i309+IhrkEHKaR+g7081OFRZosnJxPyA4Qt2q0AiG0c26S+hH7fAd8BQdwhDFRytvAicxQdZzJ4SjJRiTvWvciWX5w7BDfgIyVETskCRjeHVbwI7S6NsHo8+YryzzbDBFtmvURAbN0Ct3KraoT/mMwATve4ab4MNyw5MBc2C1xBUeNlvalOs+8GMOWdVIo+uhSFXSVIiLMKdnHt504ZScgUDmYNfhKi4O0TKHYTsORn0K9QzIxswFQUB3PMNwPKdClSWWJZH/tRJLU/YTS6Qyql6dWLO7T3/cu7vQ+X73+PhRH4HfX8NLWdI59OAE+2vxJvLDOZohD7jDXel11uB3dT4jgk9U+AeG4SbuJsAqRFk6wFcn/Jn6/osg8kGPtwbUV4g2NnTDwzf8M72ROops7g6Ltuhx2/sjN5Xr5hXDG6CVP4YFNU1Jif1o4M9g4TlTfmqGHz50cSf8km3iyWUkaWhKRkakPz+ppJuGIVlAJOmaqgx0sxVJtxnD0zjDs0WCXl/vzvtid94LDEJnFnnynfPF6ve1NlmPaq/rhV2EfHTiq33Db7AAv/vA3MvJhuh6kuh6zOWAG0Lfw2hdE2MJOE4kd1pBnpU21XmnyL/SgrxHnXeC/Iuerw51VsqqM6Y2r87ip92mNifNTCnCj/Sbu3Q3OKlMQx27GpJIC64VSZIEDtLBWqAcLNO6zPhHFm+cishBqk2oqU+fguULqmSVUkWrPMZnki8O8plc8ATdazB+nkXNZpz0Q+FnrLuChcWHPiAneuehXrWVlXSODVvLj4+qpNLiG9V5022DIZ3DhelqFY15jdlqd424aD0uAlxMuW1ceE3tceFxUSWpLlzE/o/ae5tVvU3Nss/B20yamettemDBv4a+OX9Tps+hMw6nZvMxGjbUS8d0aTRX5gO7A2dMBnVAdLNrB98LMxAoTWAIHDcg9+BN6PUE4wF90LcixywjK+uXBk8x6qk0EvSt2Nu+5ZhvaZ3XZYPX+Rv7h/H65+9vf3HrPCL7bh3++ntptanzSTPTccYvF+oVLpaGHhnPI/cwJ39F6QIn1P8GYo9HxBuYYKDJ26YiigWeIjCczxYeLhOXPTpwnYCV1XLHS/B764glTnERZHKTkCkl3jJx37SMZHEckme1D4hjO7ZYfG2hlzUwYy8ri/JUAqoEeCwlKfbK6sNSMVgs+fFQkfPFRuJPNxyq9T3jAT1j/ntNifefpvrFokayMisLu0GBUxzVJmfYJsnkd6Dxe5T0DzYrEsL/T7cUmrPV8lQoG8OnxEnbtCFwdzWtJqz5LvVL1JFGiGCjCkKM1oV6yyMzR4unVXCIXMsFT7wgwyknJ6o+jFRzL0iWQHhPke0mtsc+DaWy8JYOPDUVeSpqJWeNnX3tqEUiFcb8dM78aos6CVEx2jS/4yK/h5kf4x0XR4HqtFKrpJXmEKgh98js5biyHyydhR7TZqYEeUh9oneuymbbqtyqFWZVWa7FCs9OleWm8nfFgXupTUIcJ8vZAVppDyEakOXS2YCtBijoic/J9s8B6qJRkqoJHVe+DzapCkuSqBGkzszke1jsNCODmW/K1JfZ0Ypsffxl24LTJoXkhMrUvIBXMq4sjJlpeYflDT9HR+GOWErmuEZxm9Vyst06j7GrOtwVkwZNknQhzl1JxrfS7oqu1OVK8pG2GJcfNeEC1bGVk1Mi2boop4QZ1agDF4tJRxXmlIiAqS+nxCiRcNcPUQkThJhAqc1jWdcIVU7upMlBeYP8bUfVT+IumlikyrxAimcW1TcF3zivjGRKttozxc0sVJr+QcKMk+3or2UxJ6w7P9nkYyI9Sqk570nH1jJMSg+TACZV6RhMveaV0bzWYeIdix4mRTFasyZxXKgfmdnHiBK5u2WHyhW1IqcqJu/yg+VDugTQ1xX0d8v5dCnWUR6p4+cF8+kq4gV56sr5VN9JeLY8lnvz4OlaBrW7P6aa4YrBcOB0Ai1mRocm0Z0LM9R2mCFTD6cparyT7OJTUkNrhhq6zFDDrE01xI5GqwlYZ+fWFThrZbw6rSGvrrCZrFOnpJy6R8dfBd8RCcd2yrU7arhkC2B+lJZ9D27QtyugBw+QmgJoNEcTwEfb3xw4mm12CxzBKklHzI4ehcjHMMUT5yapudLvevZzHQxichZ0QU6daLaeUt+Klz2DzotBbAfRAQqJBh56CnWXQjozaZgut9AEhcQZGYpgGN9Fwcp/12t/alLrQ/SaIvr9hs6OgyREanrwV211tEpTz2qIvjGU2LHftlGqBsoZBEOLV8rMSu0ETsHKDdunzaGJyhqzMN2+POXC6tk05b3X0msLxOVQ9qyyFRoTFoXxoOxiYal5xVVNPasVJJuTf71bKFm9/L9B+aeTIMvqP1P/wA4gOVtTPYDWu5ZlegBZZ8SlLm0RDgxSkN76gFl5/PenPWlllyykvevpKFUtD0qwBv+QLteUTAvbTgQLVovFdtFTNE0Kl/SXE5mfTeQo1O28qV3QqHR8hV1gjQ+d1rZWnvAWDJuPrgzpvMBhtA6tELdT4iQBWxbipAxM4xTrEB+BEzcVVBDjFi3IVFuCm9ZqglvX9bVQNffLq9WWvBa2mzVJUjaCkU2CjLJi1BTpHoQh9BeoazNt67BOlZlp26SMiiET5epXHICiv+/5zoefGuiFRQOYokWG61sAvNX38i5nmx2g9oIlY4pcntbUPcfhUlPqTswfuNAPqbh/n8NPpGVvXtl1NvmsbWWX9f2/9FtC2u+B/4yl0OvFvHbKCNQ8Wcu2GTXnZwn1jGky+yQmUYH7aHaMMa2uttvpxaVoCsve/r9s9x9P4ms8Zq+wiwPtW1vKKKpfz9pSaqtB3LPjYWG2+n4ialUXOauYNNmhNYbPAOyi349v4NfljhIdVcuKjlmsOYqkFlQ/VHLwpo+IS7Orjp2E+T2aQFLj/w==</diagram></mxfile>

documentation/assets/playbook-documentation.drawio

@@ -1 +1 @@
-<mxfile host="Electron" modified="2023-03-14T08:56:29.712Z" agent="5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/17.4.2 Chrome/100.0.4896.60 Electron/18.0.1 Safari/537.36" etag="IC6d0B_ri0owPebuPUp2" version="17.4.2" type="device"><diagram id="qoV5RRVPhCf4OfzaRsKY" name="techdoc-components">7Vpbc6M2FP41eTQjEDc/5uZtZ3anyaTtXl4yAmTQBhAF4Ut/fY9AwmBw4nTj3WzazDiWji6I833n081n+DLbvCtJkXzgEU3PLBRtzvDVmWWZc4zhS1q2rcVHTmuISxapSjvDHfubKiNS1ppFtBpUFJynghVDY8jznIZiYCNlydfDakueDp9akJiODHchScfWjywSiXoLy9vZf6EsTvSTTXfelmREV1ZvUiUk4uueCV+f4cuSc9Gmss0lTaXztF/adosDpd3ASpqLYxps0O2XW2dD2B9/frktbt/RhG1nbtvLiqS1emE1WLHVHoBxFzLJssZVFytaCgYOek8Cmt7wignGcygPuBA8gwqpLLgg4UNc8jqPLnnKSyiP6JLUqej1cJ6yWLYUvAArqYoWwCXbUBjzRfPAc21F2gLpRAgJ/7l8WWuxXq+NjFXFrCj5V6hs8DIGM6kqKipINK2aRMjhf1bNIJHPsIk28DGKPIaux95UDpaDpZueSXn3HeUZFeUWqqhS21ZIK6qbuot1jziqStLjjLYRRdW463mHphx3C+gzwLXcEZg0AnarLC9FwmOek/R6Z71oMJP+bzy+q/OeS5SuTDB+pUJsVaiSWnAwJSJLVSndMPGpl/4suzIclbvaqJ6bzFZlKkFKcS7DFQxhCtCxUJsXLNVdV6LkD10c4sdgq3hdhvQR52iBgUfEVDwdItJzj7KgpCkRbDXUjZfH1PtZMAVEyu2nfqZtZTk6v2vX5H4GMljOq2ID/qERjp7BhiXPherQtF45yHrN8kpA1uMeTNJuM5NWBckH8Lt/1XI90bh7tlaTDMyTyEOocZ6uAKlYfn/49e4Gim9Ssg04f9Adw0DbvttaI5YNObROmKB3BWncv4aF4JAvS8BTrwLOLBwR6i/DDtxeiRv6NFjKtYBaGaR0eXjBAAMMWR6/b+pcOS8ziZumbZjmcB7XAPTmcct1DH8+nsvN+ckm8zewUvtaF1tBy6QOjJIScCaNeFgZTC7LaC45J0gAb2Mt7iEFT4ZUCuL0cms0EyPDw0N47TG8puMbDh7D65wKXRM/Da8EqRiHkxkQk1oq5nv2ZfM3FWYIudfni2c5tNtgNfjs7WEmHe0OF8MWmvAymlgN2ydzsTnh4lbtAq1zN9tWDzsRDE6igIEZRUs0BY2JPDynxyrgGL/HyfV0mPw4dN6AvNVFyklkrNkDy2jEiNqIynwh85AOeZbxXG5GRVJngbTIDwC0uNnCQiyfSb2b5RyAEka1ku1hH1lsZtPFB5XxW4mgSvei2DZcxzRdy5sjd+65njOeGD1jbjmOb+K5g23f1yvUPolAg5vWtm36LrJdxzoVqY443mhV9XRCaHmWoc+8Xo8WesdooSTcm9NC9wCwr0kL/f/F8DuI4fFMeBNiaOERib7nWUF3PvC5VzJ9VvBMAJ/e+Cu1e3Ljryu+ko2/DvvHVPqKh3UGfiJNvJ9arJck8sjk1j0A5iL734v183dy+xsMZ2KXbn5P2Z6aU/8Tqm3LD8xZiw+kfIj4Op9lkOgEGyFQ7FHRy+3psbXPBNdwbNT9jW9hbGxote4zw3JBrk8Vy86IHb+JhJaSH7RcsVDeUO2xZYRiQUuARVBJAXgmKyp6szP141ZHYQhubcq620eJfUSqpFMAdYz2eyPoeMeMjiEskzimTEJNQil79xErYWRc+mXB5BNyKu7DlNdRg7o67lVvMnFT+c13a9bEoY0zEezYNJwTIYrHRzYfKfgIXchbZ4nsfvA/UBEmyusFb/x2vQKfVAq0wxj1kB0p76WHneZwd6TVrt/YRzRK99SmI8mTcnRAbfbJxmuRshwGqe/kUft2jfZlm1j+VMBYrUBnaHAfKHeN7wiGJBodcLXR/TIaMvP27m69Mb/mvuFMHPl6p5pPsH38hEJkNB4xne887D/CmEOOPsy9l4DA34NgIsStiRC3nu9/yO5+d9GU9X69gq//AQ==</diagram></mxfile>
+<mxfile host="Electron" modified="2023-04-21T17:25:12.588Z" agent="5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/17.4.2 Chrome/100.0.4896.60 Electron/18.0.1 Safari/537.36" etag="ygK9XyVXmGS6CwvxcTU6" version="17.4.2" type="device"><diagram id="qoV5RRVPhCf4OfzaRsKY" name="techdoc-components">7Vpbd5s4EP41eTQHEDc/5ubspT2bnHS3TV5yBMigGhALwpf99TsCCYPBjrON27TdnONYGl0Q830zo5F8hi7T9U2B8/g9C0lyZurh+gxdnZmmMUUIvoRk00g83W4EUUFD2WkruKf/ECnUpbSiISl7HTljCad5XxiwLCMB78lwUbBVv9ucJf2n5jgiA8F9gJOh9CMNeSzfwnS38l8IjWL1ZMOZNi0pVp3lm5QxDtmqI0LXZ+iyYIw3pXR9SRKhPKWXZtxsT2u7sIJk/JgBa/3u8c5eY/rnX493+d0Nielm4jSzLHFSyReWi+UbpQFYdy6KNK1VdbEkBaegoHfYJ8ktKymnLIN2n3HOUuiQiIYLHCyiglVZeMkSVkB7SOa4SnhnhvOERmIkZzlIcZk3AM7pmsCaL+oHniupriRQjjkX8J+LlzVnq9VKS2mZT/KCfYbOGisiEOOyJLyEQj2qLgQM/qflBArZBBn6Gj5ankUw9VCbUsFisWTdEUnt3hCWEl5soItstSyJtKS6oaZYdYgju8QdzigZllSN2pm3aIp1N4C+AFzTGYBJQmC3rLKCxyxiGU6ut9KLGjOh/1rj2z7vmEDpygDhZ8L5RpoqrjgDUczTRLaSNeWfOuUHMZVmy9rVWs5cVzayUnJc8HNhriAIEoCOBko8o4mauuQFW7R2iA7BVrKqCMgB5SgHA4+ICH/eRITmDrKgIAnmdNn3G6+Pqfu9YAqIFJtP3UozyrRVfTuurn0PZDDtN8UG9E0tXH8BG+Ys43JCw3zjIKs9yxsBWa27F6SdOpKWOc568Dt/V2I/Uat7spJBBuKk7up6rTzVAUqR+H7/6/0tNN8meOMztlATw0KbuZteA5b1ObSKKSf3Oa7Vv4KNYJ8vc8BT7QLOTBRi4s2DFtxOixN4xJ+LvYDcGSRkvn/DAAsMaBa9q/tc2a8TxA3D0gyjH8cVAJ04bjq25k2HsdyYniqYG+j5rZrYcOVDhRs+NogpWdGRz+u/MSB03bk+n71Io+0WHPtqOfphTTv97ZKpD9Vs6CP7JetkKjZGVNzYg68s4XbTWExrJv5JbMQ3wnCuj0Fj6C6akmNtZIjfYXI9byffDp0fIFWp8oThUFvRBU1JSLFMVUQ9F3UoByxNWSbSFR5XqS8k4gMAzW43EKqzSQLhepIxAIpr5VKMh0wjX0/Gm/fmN19KBNm6Y8WW5tiQBJvuVHemruPaQ9fpalPTtj0DTW1keZ7aw3RJhHStHm1ZhufolmObpyLVEQlw41VP5whN19TUqcjb8YXuMb5QEO6H84XOHmDfki/0/neGX8EZHs+EH8IZmmhAoq+ZTbYZ5EOnZTybfCGAz6eG0ts9mxqqjm8kNVRmf8hLX7GgSkFPuLb3UzvrOQ5dPJrc+cBc3frvzvrlqdxugmGP5HHG13TbYzH1p/DalvhAzJq9x8UiZKtskkKhddi6Dh570PR6J/PI3GWCo9mW3v4Nz+ktpClv3WWG6YC7PpUt2wN2/MFjUgh+kGJJA3GHscOWAYo5KQAWTgQF4Jk0L8ntVtS1W2WFAai1bmvvpwT2IS7j1gPIg5YPtUNHW2a0DKGpwDGhAmocCLf3FNICVsaEXmZUPCEj/ClIWBXWqMsDQfkmI3dZX3z70lpxB1V7xNiRodknQhQNj2w+EtCRfiHuJQWyu8a/IDyIpdZzVuvtegk6KSVo+zHqIDvwvJcusuvjv4GvdrxaPqBRsuNtWpI86472eJtdsrGKJzSDRapbW715u9r3petIXCZryyX4GeI/+VJdw1PkPokGB1yNdb+OD5m4O7d77pBfU0+zRw4F3VPFE2QdH1CwsMYjwvlWw94BxuxT9H7uvQYE3g4EIyZujpi4+Qr6rx7QgkT0Q3J+7f1uPfo0WqU/75GUSMCQiOe/VfkGLPpJ5Fn9cL7b0ovmI4cmA2bs39dZqE8DZGo2Gjp7U1Nzd8ng6JrlvpgPUN3+UqNu6/zeBV3/Cw==</diagram></mxfile>