From 24be4465981354fc06ce885c5108185b32d1f64a Mon Sep 17 00:00:00 2001
From: Julien DEPAILLAT <julien.depaillat@akheros.com>
Date: Mon, 10 May 2021 16:08:58 +0200
Subject: [PATCH 01/19] New Feature : It is now possible to import IoCs from an
 added MISP instance.

---
 app/backend/src/App.vue               |   5 +-
 app/backend/src/assets/custom.css     |  55 +++-
 app/backend/src/router/index.js       |   6 +
 app/backend/src/views/iocs-misp.vue   | 402 ++++++++++++++++++++++++++
 assets/requirements.txt               |   3 +-
 assets/scheme.sql                     |  11 +
 server/backend/app/blueprints/ioc.py  |  16 +-
 server/backend/app/blueprints/misp.py |  76 +++++
 server/backend/app/classes/iocs.py    |   7 +-
 server/backend/app/classes/mispobj.py | 240 +++++++++++++++
 server/backend/app/db/models.py       |  10 +
 11 files changed, 826 insertions(+), 5 deletions(-)
 create mode 100644 app/backend/src/views/iocs-misp.vue
 create mode 100644 server/backend/app/blueprints/misp.py
 create mode 100644 server/backend/app/classes/mispobj.py

diff --git a/app/backend/src/App.vue b/app/backend/src/App.vue
index cec5174..cd06924 100644
--- a/app/backend/src/App.vue
+++ b/app/backend/src/App.vue
@@ -39,6 +39,9 @@
                 <li class="menu-item">
                   <span @click="$router.push('/iocs/manage')">Manage IOCs</span>
                 </li>
+                <li class="menu-item">
+                  <span @click="$router.push('/iocs/misp')">MISP IOCs</span>
+                </li>
                 <li class="menu-item">
                   <span @click="$router.push('/iocs/search')">Search IOCs</span>
                 </li>
@@ -95,4 +98,4 @@
   .fade-leave-active {
     opacity: 0
   }
-</style>
\ No newline at end of file
+</style>
diff --git a/app/backend/src/assets/custom.css b/app/backend/src/assets/custom.css
index dc347ec..9b6ccec 100644
--- a/app/backend/src/assets/custom.css
+++ b/app/backend/src/assets/custom.css
@@ -650,4 +650,57 @@ h4, h5 {
 
 .upper {
 	text-transform: uppercase;
-}
\ No newline at end of file
+}
+
+/*** MISP CSS ***/
+
+.misp-form {
+	/* Using CSS Grid to lay out the elements in two-dimensions: */
+	display: grid;
+	/* specifying a 0.2em gutter/gap between adjacent elements: */
+	gap: 0.2em;
+	overflow:auto;
+	grid-template-columns: 10em 0.5em 1fr;
+	width: 100%;
+	border:0.05rem solid #cecece;
+	border-radius:.1rem;
+	margin-bottom:.4rem;
+	padding:.4rem;
+}
+
+.misp-label {
+	/* placing all <label> elements in the grid column 1 (the first): */
+	grid-column: 1;
+	text-align: left;
+}
+
+.misp-name {
+	font-size: 1rem;
+	font-family: "Roboto-Bold";
+	color: #484848;
+}
+
+.misp-name:disabled {
+	border-style: none;
+	color:inherit;
+	background-color: inherit;
+	padding: unset;
+}
+
+.misp-input {
+	grid-column: 3;
+	align-self: center;
+}
+
+.misp-input:disabled {
+	border-style: none;
+	color:inherit;
+	background-color: inherit;
+	padding: unset;
+}
+
+.misp-button {
+	/* positioning the <button> element in the grid-area identified
+	   by the name of 'submit': */
+	grid-area: submit;
+}
diff --git a/app/backend/src/router/index.js b/app/backend/src/router/index.js
index e86607a..e554d1d 100644
--- a/app/backend/src/router/index.js
+++ b/app/backend/src/router/index.js
@@ -34,6 +34,12 @@ const routes = [
     component: () => import('../views/iocs-manage.vue'),
     props: true
   },
+  {
+    path: '/iocs/misp',
+    name: 'iocs-manage',
+    component: () => import('../views/iocs-misp.vue'),
+    props: true
+  },
   {
     path: '/iocs/search',
     name: 'iocs-search',
diff --git a/app/backend/src/views/iocs-misp.vue b/app/backend/src/views/iocs-misp.vue
new file mode 100644
index 0000000..2bc03fb
--- /dev/null
+++ b/app/backend/src/views/iocs-misp.vue
@@ -0,0 +1,402 @@
+<template>
+    <div class="backend-content" id="content">
+        <div class="column col-6 col-xs-12">
+            <h3 class="s-title">Manage MISP IOCs</h3>
+            <div>
+                Here you can add IOCs from your MISP instances. To do so, you first need to fullfil the "Add a new MISP instance" form. Then go to the "Existing instances" tab and scroll to the desired instance.
+                Finally, just fill the parameters as you wish and click on the "Import IOCs" button. All the IOCs that are not already in the database will be added.
+                Note that only IOCs (attributes) that belongs to the "Network activity" category will be inserted.
+            </div>
+            <ul class="tab tab-block">
+                <li class="tab-item">
+                    <a href="#" v-on:click="switch_tab('addmisp')" v-bind:class="{ active: tabs.addmisp }">Add instance</a>
+                </li>
+                <li class="tab-item">
+                    <a href="#" v-on:click="switch_tab('instances')" v-bind:class="{ active: tabs.instances }">Existing instances</a>
+                </li>
+            </ul>
+            <div v-if="tabs.addmisp">
+                <h5>Add a new MISP instance</h5>
+                <div class="misp-form">
+                    <label class="misp-label">Name</label><span>:</span>
+                    <input class="misp-input" type="text" ref="misp_name" placeholder="Enter the name to give to your MISP instance" v-model="mispinst.name" required>
+                    <label class="misp-label">URL</label><span>:</span>
+                    <input class="misp-input" type="text" ref="misp_url" placeholder="Enter your MISP instance URL" v-model="mispinst.url" required>
+                    <label class="misp-label">API key</label><span>:</span>
+                    <input class="misp-input" type="text" ref="misp_key" placeholder="Enter the API key to use" v-model="mispinst.key" required>
+                    <label class="misp-label">Verify certificate</label><span>:</span>
+                    <div style="flex:50%"><input class="misp-input" style="margin-right: 5px;" type="checkbox" id="checkbox" v-model="mispinst.ssl"><label for="checkbox">{{ mispinst.ssl }}</label></div>
+                </div>
+                <button class="btn-primary btn col-12" v-on:click="add_misp_instance()">Add MISP instance</button>
+                <div class="form-group" v-if="addedInstance.length>0">
+                    <div class="toast toast-success">
+                        ✓ MISP instance added successfully.
+                    </div>
+                </div>
+                <div v-if="errorsInstance.length>0">
+                    <div class="form-group">
+                        <div class="toast toast-error">
+                            ✗ MISP instance not added, see details below.
+                        </div>
+                    </div>
+                    <div class="form-group">
+                        <table class="table table-striped table-hover">
+                            <thead>
+                                <tr>
+                                    <th>Name</th>
+                                    <th>URL</th>
+                                    <th>API key</th>
+                                    <th>Reason</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                <tr v-for="e in errorsInstance" v-bind:key="e.name">
+                                    <td>{{ e.name }}</td>
+                                    <td>{{ e.url }}</td>
+                                    <td>{{ e.apikey }}</td>
+                                    <td>{{ e.message }}</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+            <div class="form-group" v-if="tabs.instances">
+                <div v-if="mispInstances.length>0">
+                    <div v-for="r in mispInstances" v-bind:key="r.id">
+                        <div style="position: relative">
+                            <input class="misp-name" :id="r.id + 'name'" v-bind:value="r.name" v-model="r.name" disabled="disabled" required>
+                            <button class="btn btn-sm" :id="r.id + 'edit'" :ref="r.id + 'edit'" v-on:click="edit_misp_instance(r)" style="position: absolute; right:120px;">Edit instance</button>
+                            <button class="btn btn-sm" :id="r.id + 'delete'" :ref="r.id + 'delete'" v-on:click="remove_or_cancel_edit_misp_instance(r)" style="position: absolute; right:0;">Delete instance</button>
+                        </div>
+                        <div class="misp-form">
+                            <label class="misp-label">URL</label><span>:</span>
+                            <input class="misp-input" :id="r.id + 'insturl'" v-bind:value="r.url" v-model="r.url" disabled="disabled" required>
+                            <label class="misp-label">API Key</label><span>:</span>
+                            <input class="misp-input" :id="r.id + 'instkey'" v-bind:value="r.apikey" v-model="r.apikey" disabled="disabled" required>
+                            <label class="misp-label">Verify certificate</label><span>:</span>
+                            <div style="flex:50%;"><input class="misp-input" :id="r.id + 'check'" type="checkbox" v-bind:value="r.verifycert" v-model="r.verifycert" style="visibility: hidden; width: 0;"><label v-bind:value="r.verifycert">{{ r.verifycert == 0 ? 'false' : 'true'}}</label></div>
+                            <label class="misp-label">Limit</label><span>:</span>
+                            <input class="misp-input" type="number" step="1" min="0" :id="r.id + 'limit'" placeholder="Enter the maximum number of IOCs to retrieve">
+                            <label class="misp-label">Page index</label><span>:</span>
+                            <input class="misp-input" type="number" step="1" min="0" :id="r.id + 'page'" placeholder="Enter the page index where to start retrieving IOCs">
+                            <button class="btn btn-sm" :id="r.id + 'import'" v-on:click="import_misp_iocs(r)">Import IOCs</button>
+                        </div>
+                    </div>
+                    <div class="form-group" v-if="addedInstance.length>0">
+                    <div class="toast toast-success">
+                        ✓ MISP instance edited successfully.
+                    </div>
+                </div>
+                <div v-if="errorsInstance.length>0">
+                    <div class="form-group">
+                        <div class="toast toast-error">
+                            ✗ MISP instance count not be edited, see details below.
+                        </div>
+                    </div>
+                    <div class="form-group">
+                        <table class="table table-striped table-hover">
+                            <thead>
+                                <tr>
+                                    <th>Name</th>
+                                    <th>URL</th>
+                                    <th>API key</th>
+                                    <th>Reason</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                <tr v-for="e in errorsInstance" v-bind:key="e.name">
+                                    <td>{{ e.name }}</td>
+                                    <td>{{ e.url }}</td>
+                                    <td>{{ e.apikey }}</td>
+                                    <td>{{ e.message }}</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+                </div>
+                <div v-else>
+                    <p>No MISP instance found. Click the "Add" button to add new MISP instance.</p>
+                    <button class="btn btn-sm" v-on:click="switch_tab('addmisp')" v-bind:class="{ active: tabs.addmisp }">Add a new instance</button>
+                </div>
+            </div>
+          
+            <div class="form-group" v-if="imported.length>0">
+                <div class="toast toast-success">
+                    ✓ {{imported.length}} IOC<span v-if="imported.length>1">s</span> imported successfully.
+                </div>
+                <div class="form-group">
+                    <table class="table table-striped table-hover">
+                        <thead>
+                            <tr>
+                                <th>Indicator</th>
+                                <th>Type</th>
+                                <th>Tag</th>
+                                <th>TLP</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr v-for="i in imported" v-bind:key="i.ioc">
+                                <td>{{ i.ioc }}</td>
+                                <td>{{ i.type }}</td>
+                                <td>{{ i.tag }}</td>
+                                <td>{{ i.tlp }}</td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+            <div v-if="errors.length>0">
+                <div class="form-group">
+                    <div class="toast toast-error">
+                        ✗ {{errors.length}} IOC<span v-if="errors.length>1">s</span> not imported, see details below.
+                    </div>
+                </div>
+                <div class="form-group">
+                    <table class="table table-striped table-hover">
+                        <thead>
+                            <tr>
+                                <th>Indicator</th>
+                                <th>Importation error</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr v-for="e in errors" v-bind:key="e.ioc">
+                                <td>{{ e.ioc }}</td>
+                                <td>{{ e.message }}</td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+            <div v-else-if="type_tag_error==true">
+                <div  class="form-group">
+                    <div class="toast toast-error">
+                        ✗ IOC(s) not imported, see details below.
+                    </div>
+                </div>
+                <div  class="form-group">
+                    <div class="empty">
+                        <p class="empty-title h5">Please select a tag and a type.</p>
+                        <p class="empty-subtitle">If different IOCs types, select "Unknown (regex parsing)".</p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script>
+import axios from 'axios'
+
+export default {
+    name: 'managemisp',   
+    data() {
+        return { 
+            errors:[],
+            imported:[],
+            errorsInstance:[],
+            addedInstance:[],
+            mispinst:{name:'', url:'',key:'', ssl:false},
+            mispInstances:[],
+            tabs: { "addmisp" : true, "instances" : false },
+            jwt:"",
+            type_tag_error: false
+        }
+    },
+    props: { },
+    methods: {
+        add_misp_instance: function()
+        {  
+            this.errors = [];
+            this.imported = [];
+            this.errorsInstance = []
+            this.addedInstance = []
+            if (this.mispinst["name"] != "" && this.mispinst["url"] != "" && this.mispinst["key"] != "")
+            {
+                axios.post(`/api/misp/add`, { data: { instance: this.mispinst } }, { headers: {'X-Token': this.jwt} }).then(response => {
+                    if(response.data.status){
+                        this.addedInstance.push(response.data);
+                    } else if (response.data.message){
+                        this.errorsInstance.push(response.data);
+                    }
+                })
+                .catch(err => (console.log(err)))
+            }
+            else
+            {
+                console.log(this.mispinst["name"]);
+                console.log(this.mispinst["url"]);
+                console.log(this.mispinst["key"]);
+            }
+        },
+        edit_misp_instance (elem)
+        {
+            if (document.getElementById(elem.id+'insturl').disabled == false)
+            {   // The misp instance was in edit mode
+                   
+                this.errors = [];
+                this.imported = [];
+                this.errorsInstance = []
+                this.addedInstance = []
+                if (elem["name"] != "" && elem["url"] != "" && elem["key"] != "")
+                {
+                    axios.post(`/api/misp/edit`, { data: { instance: elem } }, { headers: {'X-Token': this.jwt} }).then(response => {
+                        if(response.data.status){
+                            this.addedInstance.push(response.data);
+                        } else if (response.data.message){
+                            this.errorsInstance.push(response.data);
+                        }
+                    })
+                    .catch(err => (console.log(err)))
+                }
+                this.cancel_edit_misp(elem);
+            }
+            else
+            {   // the misp instance should enter in edit mode
+
+                document.getElementById(elem.id+'edit').innerText = 'Validate edit';
+                document.getElementById(elem.id+'delete').innerText = 'Cancel edit';
+                document.getElementById(elem.id+'name').disabled = false;
+                document.getElementById(elem.id+'insturl').disabled = false;
+                document.getElementById(elem.id+'instkey').disabled = false;
+                document.getElementById(elem.id+'limit').disabled = true;
+                document.getElementById(elem.id+'page').disabled = true;
+                document.getElementById(elem.id+'import').disabled = true;
+                document.getElementById(elem.id+'check').style = "margin-right: 5px;";
+            }
+        },
+        remove_or_cancel_edit_misp_instance(elem)
+        {
+            if (document.getElementById(elem.id+'insturl').disabled == false)
+            {   // The misp instance was in edit mode
+
+                this.cancel_edit_misp(elem)
+            }
+            else
+            {   // The misp instance should be delete
+
+                axios.get(`/api/misp/delete/${elem.id}`, { timeout: 10000, headers: {'X-Token': this.jwt} })
+                .then(response => {
+                    if(response.data.status){
+                        this.mispInstances = this.mispInstances.filter(function(el) { return el != elem; }); 
+                    }
+                })
+                .catch(err => (console.log(err)))
+            }
+        },
+        cancel_edit_misp(elem)
+        {
+            document.getElementById(elem.id+'edit').innerText = 'Edit instance';
+            document.getElementById(elem.id+'delete').innerText = 'Delete instance';  
+            document.getElementById(elem.id+'name').disabled = true;
+            document.getElementById(elem.id+'insturl').disabled = true;
+            document.getElementById(elem.id+'instkey').disabled = true;
+            document.getElementById(elem.id+'limit').disabled = false;
+            document.getElementById(elem.id+'page').disabled = false;
+            document.getElementById(elem.id+'import').disabled = false;
+            document.getElementById(elem.id+'check').style = "visibility: hidden; width: 0;";
+        },
+        import_misp_iocs(elem)
+        {
+            this.errors = [];
+            this.imported = [];
+            this.errorsInstance = []
+            this.addedInstance = []
+
+            axios.post(`/api/misp/get_iocs`, { data: { misp_id: elem.id, page: document.getElementById(elem.id+'page').value, limit: document.getElementById(elem.id+'limit').value } }, { headers: {'X-Token': this.jwt} })
+            .then(response => {
+                if(response.data.results.length>0){
+                    console.log(response.data.results);
+                    response.data.results.forEach(ioc => {
+                    this.import_ioc(ioc["tag"], ioc["type"], ioc["tlp"], ioc["value"], elem.name + "_" + elem.id);
+                    });
+                }
+                else
+                {
+                    console.log(response);
+                }
+            })
+            .catch(err => (console.log(err)))
+        },
+        import_ioc: function(tag, type, tlp, ioc, source) {
+            if (ioc != "" && ioc.slice(0,1)  != "#"){
+                if("alert " != ioc.slice(0,6)) {
+                    ioc = ioc.trim()
+                    ioc = ioc.replace(" ", "")
+                    ioc = ioc.replace("[", "")
+                    ioc = ioc.replace("]", "")
+                    ioc = ioc.replace("\\", "")
+                    ioc = ioc.replace("(", "")
+                    ioc = ioc.replace(")", "")
+                }
+                
+                let finalioc = {ioc_tag: tag, ioc_type: type, ioc_tlp: tlp, ioc_value: ioc, ioc_source: "misp_" + source}
+
+                axios.post(`/api/ioc/add_post`, { data: { ioc: finalioc } }, { headers: {'X-Token': this.jwt} })
+                .then(response => {
+                    if(response.data.status){
+                        this.imported.push(response.data);
+                    } else if (response.data.message){
+                        this.errors.push(response.data);
+                    }
+                })
+                .catch(err => (console.log(err)))
+            }
+        },
+        get_misp_instances()
+        {
+            this.errorsInstance = []
+            this.addedInstance = []
+            this.mispInstances = []
+            axios.get(`/api/misp/get_all`, { timeout: 10000, headers: {'X-Token': this.jwt} })
+            .then(response => {
+                console.log(response.data);
+                if(response.data.results.length>0){
+                    this.mispInstances = [].concat(this.mispInstances, response.data.results);
+                }
+            })
+            .catch(err => (console.log(err)))
+        },
+        switch_tab: function(tab) {
+            this.errors   = []
+            this.errorsInstance = []
+            this.addedInstance = []
+
+            Object.keys(this.tabs).forEach(key => {
+                if( key == tab ){
+                    this.tabs[key] = true
+                    if (key == "instances")
+                    {
+                        this.get_misp_instances();
+                    }
+                } else {
+                    this.tabs[key] = false
+                }
+            });
+        },
+        get_jwt(){
+            axios.get(`/api/get-token`, { timeout: 10000 })
+                .then(response => {
+                    if(response.data.token){
+                        this.jwt = response.data.token
+                    }
+                })
+            .catch(err => (console.log(err)))
+        }
+    },
+    created: function() {
+        this.get_jwt();
+        this.get_misp_instances();
+        if (this.mispInstances.length>0)
+        {
+            this.tabs["addmisp"] = false;
+            this.tabs["instances"] = true;
+        }
+    }
+}
+
+
+
+</script>
diff --git a/assets/requirements.txt b/assets/requirements.txt
index 2ecede3..a6affc2 100644
--- a/assets/requirements.txt
+++ b/assets/requirements.txt
@@ -2,6 +2,7 @@ ipwhois
 M2Crypto
 pyOpenSSL
 pydig
+pymisp
 netaddr
 pyyaml
 flask
@@ -14,4 +15,4 @@ wifi
 qrcode
 netifaces
 weasyprint
-python-whois
\ No newline at end of file
+python-whois
diff --git a/assets/scheme.sql b/assets/scheme.sql
index fb89ec6..ec8e9d9 100644
--- a/assets/scheme.sql
+++ b/assets/scheme.sql
@@ -17,3 +17,14 @@ CREATE TABLE "whitelist" (
 	"added_on"	INTEGER NOT NULL,
 	PRIMARY KEY("id" AUTOINCREMENT)
 );
+
+CREATE TABLE "mispinstance" (
+	"id" 	INTEGER UNIQUE,
+	"name" 	TEXT,
+	"url"	TEXT NOT NULL,
+	"apikey"	TEXT NOT NULL,
+	"verifycert" INTEGER NOT NULL DEFAULT 0,
+	"source" TEXT NOT NULL,
+	"added_on" NUMERIC NOT NULL,
+	PRIMARY KEY("id" AUTOINCREMENT)
+);
diff --git a/server/backend/app/blueprints/ioc.py b/server/backend/app/blueprints/ioc.py
index 3fa7f7c..a0e0f0b 100644
--- a/server/backend/app/blueprints/ioc.py
+++ b/server/backend/app/blueprints/ioc.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from flask import Blueprint, jsonify, Response
+from flask import Blueprint, jsonify, Response, request
 from app.decorators import require_header_token, require_get_token
 from app.classes.iocs import IOCs
 
@@ -23,6 +23,20 @@ def add(ioc_type, ioc_tag, ioc_tlp, ioc_value):
     return jsonify(res)
 
 
+@ioc_bp.route('/add_post', methods=['POST'])
+@require_header_token
+def add_post():
+    """
+        Parse and add an IOC to the database using the post method.
+        :return: status of the operation in JSON
+    """
+
+    data = json.loads(request.data)
+    ioc = data["data"]["ioc"]
+    res = IOCs.add(ioc["ioc_type"], ioc["ioc_tag"], ioc["ioc_tlp"], ioc["ioc_value"], ioc["ioc_source"])
+    return jsonify(res)
+
+
 @ioc_bp.route('/delete/<ioc_id>', methods=['GET'])
 @require_header_token
 def delete(ioc_id):
diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
new file mode 100644
index 0000000..41a61ba
--- /dev/null
+++ b/server/backend/app/blueprints/misp.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from flask import Blueprint, jsonify, Response, request
+from app.decorators import require_header_token, require_get_token
+from app.classes.mispobj import MISPObj
+
+import json
+
+misp_bp = Blueprint("misp", __name__)
+misp = MISPObj()
+
+
+@misp_bp.route('/add', methods=['POST'])
+@require_header_token
+def add ():
+    """
+        Parse and add a MISP instance to the database.
+        :return: status of the operation in JSON
+    """
+    data = json.loads(request.data)
+    instance = data["data"]["instance"]
+    
+    source = "backend"
+    res = MISPObj.add(instance["name"], instance["url"], instance["key"], instance["ssl"], source)
+    return jsonify(res)
+
+@misp_bp.route('/delete/<misp_id>', methods=['GET'])
+@require_header_token
+def delete(misp_id):
+    """
+        Delete a MISP instance by its id to the database.
+        :return: status of the operation in JSON
+    """
+    res = MISPObj.delete(misp_id)
+    return jsonify(res)
+
+@misp_bp.route('/get_all', methods=['GET'])
+@require_header_token
+def get_all():
+    """
+        Retreive a list of all MISP instances.
+        :return: list of MISP instances in JSON.
+    """
+    res = MISPObj.get_all()
+    return jsonify({"results": [i for i in res]})
+
+
+@misp_bp.route('/get_iocs', methods=['POST'])
+#@require_header_token
+def get_iocs():
+    """
+        Retreive a list of all MISP instances.
+        :return: list of MISP instances in JSON.
+    """
+
+    data = json.loads(request.data)
+    data = data["data"]
+
+    res = MISPObj.get_iocs(data["misp_id"], data["limit"], data["page"])
+    print(res)
+    return jsonify(res)
+
+
+@misp_bp.route('/edit', methods=['POST'])
+@require_header_token
+def edit ():
+    """
+        Parse and edit the desired MISP instance.
+        :return: status of the operation in JSON
+    """
+    data = json.loads(request.data)
+    instance = data["data"]["instance"]
+    print(instance)
+    res = MISPObj.edit(instance["id"], instance["name"], instance["url"], instance["apikey"], instance["verifycert"])
+    return jsonify(res)
\ No newline at end of file
diff --git a/server/backend/app/classes/iocs.py b/server/backend/app/classes/iocs.py
index c54c34e..c2126d4 100644
--- a/server/backend/app/classes/iocs.py
+++ b/server/backend/app/classes/iocs.py
@@ -56,7 +56,12 @@ class IOCs(object):
                 db.session.commit()
                 return {"status": True,
                         "message": "IOC added",
-                        "ioc": escape(ioc_value)}
+                        "ioc": escape(ioc_value),
+                        "type": escape(ioc_type),
+                        "tlp": escape(ioc_tlp),
+                        "tag": escape(ioc_tag),
+                        "source": escape(source),
+                        "added_on": escape(added_on)}
             else:
                 return {"status": False,
                         "message": "Wrong IOC format",
diff --git a/server/backend/app/classes/mispobj.py b/server/backend/app/classes/mispobj.py
new file mode 100644
index 0000000..b3e22ec
--- /dev/null
+++ b/server/backend/app/classes/mispobj.py
@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from app import db
+from app.db.models import MISPInst
+from sqlalchemy.sql import exists
+from app.definitions import definitions
+from urllib.parse import unquote
+from flask import escape
+from pymisp import PyMISP
+import re
+import time
+import sys
+
+
+class MISPObj(object):
+    def __init__(self):
+        return None
+
+    @staticmethod
+    def add(misp_name, misp_url, misp_key, misp_verifycert, source):
+        """
+            Parse and add a MISP"instance to the database.
+            :return: status of the operation in JSON
+        """
+        
+        sameinstances = db.session.query(MISPInst).filter(MISPInst.url == misp_url, MISPInst.apikey == misp_key)
+        if sameinstances.count() > 0:
+            return {"status": False,
+                    "message": "This MISP instance already exists",
+                    "name": escape(misp_name),
+                    "url": escape(misp_url),
+                    "apikey": escape(misp_key),
+                    "verifycert": escape(misp_verifycert)}
+        elif misp_name != "":          
+            if misp_url != "":               
+                if re.match(r"^(?:(?:http|https)://)", misp_url):
+                    if misp_key != "":
+                        added_on = int(time.time())
+                        db.session.add(MISPInst(misp_name, escape(misp_url), misp_key, misp_verifycert, source, added_on))
+                        db.session.commit()
+                        return {"status": True,
+                            "message": "MISP instance added",
+                            "name": escape(misp_name),
+                            "url": escape(misp_url),
+                            "apikey": escape(misp_key),
+                            "verifycert": escape(misp_verifycert)}
+                    else:
+                        return {"status": False,
+                        "message": "The key can't be empty",
+                        "name": escape(misp_name),
+                        "url": escape(misp_url),
+                        "apikey": "",
+                        "verifycert": escape(misp_verifycert)}
+                else:
+                    return {"status": False,
+                        "message": "The url must begin with http:// or https://",
+                        "name": escape(misp_name),
+                        "url": escape(misp_url),
+                        "apikey": escape(misp_key),
+                        "verifycert": escape(misp_verifycert)}
+            else:
+                return {"status": False,
+                        "message": "The url can't be empty",
+                        "name": escape(misp_name),
+                        "url": "",
+                        "apikey": escape(misp_key),
+                        "verifycert": escape(misp_verifycert)}
+        else:
+            return {"status": False,
+                    "message": "The MISP instance name can't be empty",
+                    "name":"",
+                    "url": escape(misp_url),
+                    "apikey": escape(misp_key),
+                    "verifycert": escape(misp_verifycert)}
+
+    @staticmethod
+    def edit(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
+        """
+            Parse and edit the desired MISP instance.
+            :return: status of the operation in JSON
+        """
+        mispinstance = MISPInst.query.get(int(misp_id))
+        otherinstances = db.session.query(MISPInst).filter(MISPInst.id != int(misp_id), MISPInst.url == misp_url, MISPInst.apikey == misp_key)
+        if mispinstance is None:                                                                                                                                            
+            return {"status": False,
+                    "message": "Can't find the MISP instance"}
+        if otherinstances.count() > 0:
+            return {"status": False,
+                    "message": "This MISP instance already exists",
+                    "name": escape(misp_name),
+                    "url": escape(misp_url),
+                    "apikey": escape(misp_key),
+                    "verifycert": escape(misp_verifycert)}
+        elif misp_name != "":          
+            if misp_url != "":               
+                if re.match(r"^(?:(?:http|https)://)", misp_url):
+                    if misp_key != "":
+                        mispinstance.name = misp_name
+                        mispinstance.url = misp_url
+                        mispinstance.apikey = misp_key
+                        mispinstance.verifycert = misp_verifycert
+                        db.session.commit()
+                        return {"status": True,
+                            "message": "MISP instance edited",
+                            "name": escape(misp_name),
+                            "url": escape(misp_url),
+                            "apikey": escape(misp_key),
+                            "verifycert": escape(misp_verifycert)}
+                    else:
+                        return {"status": False,
+                        "message": "The key can't be empty",
+                        "name": escape(misp_name),
+                        "url": escape(misp_url),
+                        "apikey": "",
+                        "verifycert": escape(misp_verifycert)}
+                else:
+                    return {"status": False,
+                        "message": "The url must begin with http:// or https://",
+                        "name": escape(misp_name),
+                        "url": escape(misp_url),
+                        "apikey": escape(misp_key),
+                        "verifycert": escape(misp_verifycert)}
+            else:
+                return {"status": False,
+                        "message": "The url can't be empty",
+                        "name": escape(misp_name),
+                        "url": "",
+                        "apikey": escape(misp_key),
+                        "verifycert": escape(misp_verifycert)}
+        else:
+            return {"status": False,
+                    "message": "The MISP instance name can't be empty",
+                    "name":"",
+                    "url": escape(misp_url),
+                    "apikey": escape(misp_key),
+                    "verifycert": escape(misp_verifycert)}
+
+
+    @staticmethod
+    def delete(misp_id):
+        """
+            Delete a MISP instance by its id in the database.
+            :return: status of the operation in JSON
+        """
+        if db.session.query(exists().where(MISPInst.id == misp_id)).scalar():
+            db.session.query(MISPInst).filter_by(id=misp_id).delete()
+            db.session.commit()
+            return {"status": True,
+                    "message": "MISP instance deleted"}
+        else:
+            return {"status": False,
+                    "message": "MISP instance not found"}
+
+    @staticmethod
+    def get_all():
+        """
+            Get all MISP instances from the database
+            :return: generator of the records.
+        """
+        for mispinstance in db.session.query(MISPInst).all():
+            mispinstance = mispinstance.__dict__
+            yield {"id": mispinstance["id"],
+                   "name": mispinstance["name"],
+                   "url": mispinstance["url"],
+                   "apikey": mispinstance["apikey"],
+                   "verifycert": mispinstance["verifycert"]}
+
+    @staticmethod
+    def get_iocs(misp_id, limit, page):
+        """
+            Get all IOCs from the desired MISP instance
+            :return: generator of the records.
+        """
+        mispinstance = MISPInst.query.get(int(misp_id))
+        if mispinstance is not None:
+            if mispinstance.url != "":
+                if mispinstance.apikey != "":
+                    try:
+                        # Connects to the desired MISP instance
+                        mispinstance = PyMISP(mispinstance.url, mispinstance.apikey, mispinstance.verifycert)
+                        
+                        # Retreives the attributes (or IOCs) that are supported by Tinycheck
+                        attributes = mispinstance.search('attributes', category='Network activity', limit=limit, page=page, metadata=True)
+                        
+
+                        if 'Attribute' in attributes:
+                            iocs = []
+                            for attribute in attributes['Attribute']:
+                                #print(attribute)
+                                if 'value' in attribute and attribute['value'] != '':
+                                    # We have a valid value
+                                    ioc_value = attribute['value']
+                                    ioc_type = "unknown"
+                                    ioc_tag = "No tag"
+                                    ioc_tlp = "white"
+                                    isFirstTag = True
+                                    
+                                    if 'Tag' in attribute:
+                                        # We have some tags
+                                        #print (attribute['Tag'])
+                                        for tag in attribute['Tag']:
+                                            tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'])
+                                            if tlp:
+                                                # The current tag is the tlp level
+                                                ioc_tlp = tlp.group(1)
+                                                #print(ioc_tlp)
+                                            elif isFirstTag:
+                                                # It is the first retreived tag that is not a tlp 
+                                                isFirstTag = False
+                                                ioc_tag = tag['name']
+                                            else:
+                                                # It is another tag and not the first one
+                                                ioc_tag += ", " + tag['name']
+                                                
+                                    ioc = { "value": ioc_value,
+                                            "type": ioc_type,
+                                            "tag": ioc_tag,
+                                            "tlp": ioc_tlp }
+                                    iocs.append(ioc)
+                            return { "status":True,
+                                     "results": iocs}
+                        else:
+                            return { "status":False,
+                                     "message":"No valid IOCs found."}
+                    except TypeError as error:
+                        print (error)
+                        pass
+                    except:
+                        print("An exception has been raised: ", sys.exc_info()[0])
+                        pass
+                else:
+                    {"status": False,
+                     "message": "The api key can't be empty"}       
+            else:
+                return {"status": False,
+                        "message": "The url can't be empty"}
+        else:
+            return {"status": False,
+                    "message": "Unknown MISP instance."}
\ No newline at end of file
diff --git a/server/backend/app/db/models.py b/server/backend/app/db/models.py
index bed4b6f..625091d 100644
--- a/server/backend/app/db/models.py
+++ b/server/backend/app/db/models.py
@@ -16,5 +16,15 @@ class Whitelist(db.Model):
         self.source = source
         self.added_on = added_on
 
+class MISPInst(db.Model):
+    def __init__(self, name, url, key, ssl, source, added_on):
+        self.name = name
+        self.url = url
+        self.apikey = key
+        self.verifycert = ssl
+        self.source = source
+        self.added_on = added_on
+
 db.mapper(Whitelist, db.Table('whitelist', db.metadata, autoload=True))
 db.mapper(Ioc, db.Table('iocs', db.metadata, autoload=True))
+db.mapper(MISPInst, db.Table('mispinstance', db.metadata, autoload=True))

From e0c79fa5d6b6f0e4be165c5ecf9d4065774f6a08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Tue, 8 Jun 2021 18:22:52 +0200
Subject: [PATCH 02/19] Working on the MISP integration, still WIP (untested)

---
 server/backend/app/blueprints/misp.py |  35 ++--
 server/backend/app/classes/misp.py    | 181 +++++++++++++++++++
 server/backend/app/classes/mispobj.py | 240 --------------------------
 server/backend/app/db/models.py       |  11 +-
 server/backend/main.py                |   2 +
 server/backend/watchers.py            |  37 ++--
 6 files changed, 238 insertions(+), 268 deletions(-)
 create mode 100644 server/backend/app/classes/misp.py
 delete mode 100644 server/backend/app/classes/mispobj.py

diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index 41a61ba..2f627fc 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -3,28 +3,30 @@
 
 from flask import Blueprint, jsonify, Response, request
 from app.decorators import require_header_token, require_get_token
-from app.classes.mispobj import MISPObj
+from app.classes.misp import MISP
 
 import json
 
 misp_bp = Blueprint("misp", __name__)
-misp = MISPObj()
+misp = MISP()
 
 
 @misp_bp.route('/add', methods=['POST'])
 @require_header_token
-def add ():
+def add():
     """
         Parse and add a MISP instance to the database.
         :return: status of the operation in JSON
     """
     data = json.loads(request.data)
     instance = data["data"]["instance"]
-    
+
     source = "backend"
-    res = MISPObj.add(instance["name"], instance["url"], instance["key"], instance["ssl"], source)
+    res = MISP.add(instance["name"], instance["url"],
+                   instance["key"], instance["ssl"], source)
     return jsonify(res)
 
+
 @misp_bp.route('/delete/<misp_id>', methods=['GET'])
 @require_header_token
 def delete(misp_id):
@@ -32,9 +34,10 @@ def delete(misp_id):
         Delete a MISP instance by its id to the database.
         :return: status of the operation in JSON
     """
-    res = MISPObj.delete(misp_id)
+    res = MISP.delete(misp_id)
     return jsonify(res)
 
+
 @misp_bp.route('/get_all', methods=['GET'])
 @require_header_token
 def get_all():
@@ -42,12 +45,12 @@ def get_all():
         Retreive a list of all MISP instances.
         :return: list of MISP instances in JSON.
     """
-    res = MISPObj.get_all()
+    res = MISP.get_all()
     return jsonify({"results": [i for i in res]})
 
 
 @misp_bp.route('/get_iocs', methods=['POST'])
-#@require_header_token
+# @require_header_token
 def get_iocs():
     """
         Retreive a list of all MISP instances.
@@ -57,20 +60,24 @@ def get_iocs():
     data = json.loads(request.data)
     data = data["data"]
 
-    res = MISPObj.get_iocs(data["misp_id"], data["limit"], data["page"])
-    print(res)
+    res = MISP.get_iocs(data["misp_id"],
+                        data["limit"],
+                        data["page"])
     return jsonify(res)
 
 
 @misp_bp.route('/edit', methods=['POST'])
 @require_header_token
-def edit ():
+def edit():
     """
         Parse and edit the desired MISP instance.
         :return: status of the operation in JSON
     """
     data = json.loads(request.data)
     instance = data["data"]["instance"]
-    print(instance)
-    res = MISPObj.edit(instance["id"], instance["name"], instance["url"], instance["apikey"], instance["verifycert"])
-    return jsonify(res)
\ No newline at end of file
+    res = MISP.edit(instance["id"],
+                    instance["name"],
+                    instance["url"],
+                    instance["apikey"],
+                    instance["verifycert"])
+    return jsonify(res)
diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
new file mode 100644
index 0000000..4cf3cce
--- /dev/null
+++ b/server/backend/app/classes/misp.py
@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from app import db
+from app.db.models import MISPInst
+from sqlalchemy.sql import exists
+from app.definitions import definitions as defs
+from urllib.parse import unquote
+from flask import escape
+from pymisp import PyMISP
+import re
+import time
+import sys
+
+
+class MISP(object):
+    def __init__(self):
+        return None
+
+    @staticmethod
+    def add(misp_name, misp_url, misp_key, misp_verifycert):
+        """
+            Parse and add a MISP instance to the database.
+            :return: status of the operation in JSON
+        """
+
+        sameinstances = db.session.query(MISPInst).filter(
+            MISPInst.url == misp_url, MISPInst.apikey == misp_key)
+        if sameinstances.count():
+            return {"status": False,
+                    "message": "This MISP instance already exists"}
+        elif misp_name != "":
+            if misp_url != "":
+                if re.match(r"^(?:(?:http|https)://)", misp_url):
+                    if misp_key != "":
+                        added_on = int(time.time())
+                        db.session.add(MISPInst(misp_name, escape(
+                            misp_url), misp_key, misp_verifycert, added_on))
+                        db.session.commit()
+                        return {"status": True,
+                                "message": "MISP instance added",
+                                "name": escape(misp_name),
+                                "url": escape(misp_url),
+                                "apikey": escape(misp_key),
+                                "verifycert": escape(misp_verifycert)}
+                    else:
+                        return {"status": False,
+                                "message": "The key can't be empty"}
+                else:
+                    return {"status": False,
+                            "message": "The url must begin with http:// or https://"}
+            else:
+                return {"status": False,
+                        "message": "The url can't be empty"}
+        else:
+            return {"status": False,
+                    "message": "The MISP instance name can't be empty"}
+
+    @staticmethod
+    def edit(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
+        """
+            Parse and edit the desired MISP instance.
+            :return: status of the operation in JSON
+        """
+        misp = MISPInst.query.get(int(misp_id))
+        otherinstances = db.session.query(MISPInst).filter(MISPInst.id != int(
+            misp_id), MISPInst.url == misp_url, MISPInst.apikey == misp_key)
+        if misp is None:
+            return {"status": False,
+                    "message": "Can't find the MISP instance"}
+        if otherinstances.count() > 0:
+            return {"status": False,
+                    "message": "This MISP instance already exists"}
+        elif misp_name != "":
+            if misp_url != "":
+                if re.match(r"^(?:(?:http|https)://)", misp_url):
+                    if misp_key != "":
+                        misp.name = misp_name
+                        misp.url = misp_url
+                        misp.apikey = misp_key
+                        misp.verifycert = misp_verifycert
+                        db.session.commit()
+                        return {"status": True,
+                                "message": "MISP instance edited"}
+                    else:
+                        return {"status": False,
+                                "message": "The key can't be empty"}
+                else:
+                    return {"status": False,
+                            "message": "The url must begin with http:// or https://"}
+            else:
+                return {"status": False,
+                        "message": "The url can't be empty"}
+        else:
+            return {"status": False,
+                    "message": "The MISP instance name can't be empty"}
+
+    @staticmethod
+    def delete_instance(misp_id):
+        """
+            Delete a MISP instance by its id in the database.
+            :return: status of the operation in JSON
+        """
+        if db.session.query(exists().where(MISPInst.id == misp_id)).scalar():
+            db.session.query(MISPInst).filter_by(id=misp_id).delete()
+            db.session.commit()
+            return {"status": True,
+                    "message": "MISP instance deleted"}
+        else:
+            return {"status": False,
+                    "message": "MISP instance not found"}
+
+    @staticmethod
+    def get_instances():
+        """
+            Get MISP instances from the database
+            :return: generator of the records.
+        """
+        for misp in db.session.query(MISPInst).all():
+            misp = misp.__dict__
+            yield {"id": misp["id"],
+                   "name": misp["name"],
+                   "url": misp["url"],
+                   "apikey": misp["apikey"],
+                   "verifycert": misp["verifycert"]}
+
+    @staticmethod
+    def get_iocs(misp_id):
+        """
+            Get all IOCs from specific MISP instance
+            /!\ Todo: NEED TO ADD LAST SYNCHRO DATE + page etc. stuff.
+            :return: generator containing the IOCs.
+        """
+        misp = MISPInst.query.get(int(misp_id))
+        if misp is not None:
+            if misp.url and misp.apikey:
+                try:
+                    # Connect to MISP instance and get network activity attributes.
+                    m = PyMISP(misp.url, misp.apikey, misp.verifycert)
+                    r = m.search("attributes", category="Network activity")
+
+                    for attr in r["Attribute"]:
+                        if attr["type"] in ["ip_dst", "domain", "snort", "x509-fingerprint-sha1"]:
+
+                            ioc = {"value": attr["value"],
+                                   "type": None,
+                                   "tag": "suspect",
+                                   "tlp": "white"}
+
+                            # Deduce the IOC type.
+                            if re.match(defs["iocs_types"][0]["regex"], attr["value"]):
+                                ioc["type"] = "ipv4addr"
+                            elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
+                                ioc["type"] = "ipv6addr"
+                            elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
+                                ioc["type"] = "domain"
+                            elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):
+                                ioc["type"] = "sha1cert"
+                            elif "alert " in attr["value"][0:5]:
+                                ioc["type"] = "snort"
+
+                            if "Tag" in attr:
+                                for tag in attribute['Tag']:
+                                    # Add the TLP of the IOC.
+                                    tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'])
+                                    if tlp: ioc["tlp"] = tlp.group(1)
+
+                                    # Add possible tag.
+                                    if lower(tag["name"]) in [t["tag"] for t in defs["iocs_tags"]]:
+                                        ioc["tag"] = lower(tag["name"])
+                            yield ioc
+                except:
+                    return {"status": False,
+                            "message": "An exception has been raised: ", sys.exc_info()[0])}
+                    pass
+            else:
+                return {"status": False,
+                        "message": "The URL or API key is empty."}
+        else:
+            return {"status": False,
+                    "message": "Unknown MISP instance."}
diff --git a/server/backend/app/classes/mispobj.py b/server/backend/app/classes/mispobj.py
deleted file mode 100644
index b3e22ec..0000000
--- a/server/backend/app/classes/mispobj.py
+++ /dev/null
@@ -1,240 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from app import db
-from app.db.models import MISPInst
-from sqlalchemy.sql import exists
-from app.definitions import definitions
-from urllib.parse import unquote
-from flask import escape
-from pymisp import PyMISP
-import re
-import time
-import sys
-
-
-class MISPObj(object):
-    def __init__(self):
-        return None
-
-    @staticmethod
-    def add(misp_name, misp_url, misp_key, misp_verifycert, source):
-        """
-            Parse and add a MISP"instance to the database.
-            :return: status of the operation in JSON
-        """
-        
-        sameinstances = db.session.query(MISPInst).filter(MISPInst.url == misp_url, MISPInst.apikey == misp_key)
-        if sameinstances.count() > 0:
-            return {"status": False,
-                    "message": "This MISP instance already exists",
-                    "name": escape(misp_name),
-                    "url": escape(misp_url),
-                    "apikey": escape(misp_key),
-                    "verifycert": escape(misp_verifycert)}
-        elif misp_name != "":          
-            if misp_url != "":               
-                if re.match(r"^(?:(?:http|https)://)", misp_url):
-                    if misp_key != "":
-                        added_on = int(time.time())
-                        db.session.add(MISPInst(misp_name, escape(misp_url), misp_key, misp_verifycert, source, added_on))
-                        db.session.commit()
-                        return {"status": True,
-                            "message": "MISP instance added",
-                            "name": escape(misp_name),
-                            "url": escape(misp_url),
-                            "apikey": escape(misp_key),
-                            "verifycert": escape(misp_verifycert)}
-                    else:
-                        return {"status": False,
-                        "message": "The key can't be empty",
-                        "name": escape(misp_name),
-                        "url": escape(misp_url),
-                        "apikey": "",
-                        "verifycert": escape(misp_verifycert)}
-                else:
-                    return {"status": False,
-                        "message": "The url must begin with http:// or https://",
-                        "name": escape(misp_name),
-                        "url": escape(misp_url),
-                        "apikey": escape(misp_key),
-                        "verifycert": escape(misp_verifycert)}
-            else:
-                return {"status": False,
-                        "message": "The url can't be empty",
-                        "name": escape(misp_name),
-                        "url": "",
-                        "apikey": escape(misp_key),
-                        "verifycert": escape(misp_verifycert)}
-        else:
-            return {"status": False,
-                    "message": "The MISP instance name can't be empty",
-                    "name":"",
-                    "url": escape(misp_url),
-                    "apikey": escape(misp_key),
-                    "verifycert": escape(misp_verifycert)}
-
-    @staticmethod
-    def edit(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
-        """
-            Parse and edit the desired MISP instance.
-            :return: status of the operation in JSON
-        """
-        mispinstance = MISPInst.query.get(int(misp_id))
-        otherinstances = db.session.query(MISPInst).filter(MISPInst.id != int(misp_id), MISPInst.url == misp_url, MISPInst.apikey == misp_key)
-        if mispinstance is None:                                                                                                                                            
-            return {"status": False,
-                    "message": "Can't find the MISP instance"}
-        if otherinstances.count() > 0:
-            return {"status": False,
-                    "message": "This MISP instance already exists",
-                    "name": escape(misp_name),
-                    "url": escape(misp_url),
-                    "apikey": escape(misp_key),
-                    "verifycert": escape(misp_verifycert)}
-        elif misp_name != "":          
-            if misp_url != "":               
-                if re.match(r"^(?:(?:http|https)://)", misp_url):
-                    if misp_key != "":
-                        mispinstance.name = misp_name
-                        mispinstance.url = misp_url
-                        mispinstance.apikey = misp_key
-                        mispinstance.verifycert = misp_verifycert
-                        db.session.commit()
-                        return {"status": True,
-                            "message": "MISP instance edited",
-                            "name": escape(misp_name),
-                            "url": escape(misp_url),
-                            "apikey": escape(misp_key),
-                            "verifycert": escape(misp_verifycert)}
-                    else:
-                        return {"status": False,
-                        "message": "The key can't be empty",
-                        "name": escape(misp_name),
-                        "url": escape(misp_url),
-                        "apikey": "",
-                        "verifycert": escape(misp_verifycert)}
-                else:
-                    return {"status": False,
-                        "message": "The url must begin with http:// or https://",
-                        "name": escape(misp_name),
-                        "url": escape(misp_url),
-                        "apikey": escape(misp_key),
-                        "verifycert": escape(misp_verifycert)}
-            else:
-                return {"status": False,
-                        "message": "The url can't be empty",
-                        "name": escape(misp_name),
-                        "url": "",
-                        "apikey": escape(misp_key),
-                        "verifycert": escape(misp_verifycert)}
-        else:
-            return {"status": False,
-                    "message": "The MISP instance name can't be empty",
-                    "name":"",
-                    "url": escape(misp_url),
-                    "apikey": escape(misp_key),
-                    "verifycert": escape(misp_verifycert)}
-
-
-    @staticmethod
-    def delete(misp_id):
-        """
-            Delete a MISP instance by its id in the database.
-            :return: status of the operation in JSON
-        """
-        if db.session.query(exists().where(MISPInst.id == misp_id)).scalar():
-            db.session.query(MISPInst).filter_by(id=misp_id).delete()
-            db.session.commit()
-            return {"status": True,
-                    "message": "MISP instance deleted"}
-        else:
-            return {"status": False,
-                    "message": "MISP instance not found"}
-
-    @staticmethod
-    def get_all():
-        """
-            Get all MISP instances from the database
-            :return: generator of the records.
-        """
-        for mispinstance in db.session.query(MISPInst).all():
-            mispinstance = mispinstance.__dict__
-            yield {"id": mispinstance["id"],
-                   "name": mispinstance["name"],
-                   "url": mispinstance["url"],
-                   "apikey": mispinstance["apikey"],
-                   "verifycert": mispinstance["verifycert"]}
-
-    @staticmethod
-    def get_iocs(misp_id, limit, page):
-        """
-            Get all IOCs from the desired MISP instance
-            :return: generator of the records.
-        """
-        mispinstance = MISPInst.query.get(int(misp_id))
-        if mispinstance is not None:
-            if mispinstance.url != "":
-                if mispinstance.apikey != "":
-                    try:
-                        # Connects to the desired MISP instance
-                        mispinstance = PyMISP(mispinstance.url, mispinstance.apikey, mispinstance.verifycert)
-                        
-                        # Retreives the attributes (or IOCs) that are supported by Tinycheck
-                        attributes = mispinstance.search('attributes', category='Network activity', limit=limit, page=page, metadata=True)
-                        
-
-                        if 'Attribute' in attributes:
-                            iocs = []
-                            for attribute in attributes['Attribute']:
-                                #print(attribute)
-                                if 'value' in attribute and attribute['value'] != '':
-                                    # We have a valid value
-                                    ioc_value = attribute['value']
-                                    ioc_type = "unknown"
-                                    ioc_tag = "No tag"
-                                    ioc_tlp = "white"
-                                    isFirstTag = True
-                                    
-                                    if 'Tag' in attribute:
-                                        # We have some tags
-                                        #print (attribute['Tag'])
-                                        for tag in attribute['Tag']:
-                                            tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'])
-                                            if tlp:
-                                                # The current tag is the tlp level
-                                                ioc_tlp = tlp.group(1)
-                                                #print(ioc_tlp)
-                                            elif isFirstTag:
-                                                # It is the first retreived tag that is not a tlp 
-                                                isFirstTag = False
-                                                ioc_tag = tag['name']
-                                            else:
-                                                # It is another tag and not the first one
-                                                ioc_tag += ", " + tag['name']
-                                                
-                                    ioc = { "value": ioc_value,
-                                            "type": ioc_type,
-                                            "tag": ioc_tag,
-                                            "tlp": ioc_tlp }
-                                    iocs.append(ioc)
-                            return { "status":True,
-                                     "results": iocs}
-                        else:
-                            return { "status":False,
-                                     "message":"No valid IOCs found."}
-                    except TypeError as error:
-                        print (error)
-                        pass
-                    except:
-                        print("An exception has been raised: ", sys.exc_info()[0])
-                        pass
-                else:
-                    {"status": False,
-                     "message": "The api key can't be empty"}       
-            else:
-                return {"status": False,
-                        "message": "The url can't be empty"}
-        else:
-            return {"status": False,
-                    "message": "Unknown MISP instance."}
\ No newline at end of file
diff --git a/server/backend/app/db/models.py b/server/backend/app/db/models.py
index 625091d..c429da8 100644
--- a/server/backend/app/db/models.py
+++ b/server/backend/app/db/models.py
@@ -1,5 +1,6 @@
 from app import db
 
+
 class Ioc(db.Model):
     def __init__(self, value, type, tlp, tag, source, added_on):
         self.value = value
@@ -9,6 +10,7 @@ class Ioc(db.Model):
         self.source = source
         self.added_on = added_on
 
+
 class Whitelist(db.Model):
     def __init__(self, element, type, source, added_on):
         self.element = element
@@ -16,15 +18,16 @@ class Whitelist(db.Model):
         self.source = source
         self.added_on = added_on
 
+
 class MISPInst(db.Model):
-    def __init__(self, name, url, key, ssl, source, added_on):
+    def __init__(self, name, url, key, ssl, added_on):
         self.name = name
         self.url = url
-        self.apikey = key
+        self.authkey = key
         self.verifycert = ssl
-        self.source = source
         self.added_on = added_on
 
+
 db.mapper(Whitelist, db.Table('whitelist', db.metadata, autoload=True))
 db.mapper(Ioc, db.Table('iocs', db.metadata, autoload=True))
-db.mapper(MISPInst, db.Table('mispinstance', db.metadata, autoload=True))
+db.mapper(MISP, db.Table('misp', db.metadata, autoload=True))
diff --git a/server/backend/main.py b/server/backend/main.py
index b081caf..eedf327 100644
--- a/server/backend/main.py
+++ b/server/backend/main.py
@@ -6,6 +6,7 @@ from app.decorators import auth
 from app.blueprints.ioc import ioc_bp
 from app.blueprints.whitelist import whitelist_bp
 from app.blueprints.config import config_bp
+from app.blueprints.misp import misp_bp
 import datetime
 import secrets
 import jwt
@@ -56,6 +57,7 @@ def page_not_found(e):
 app.register_blueprint(ioc_bp, url_prefix='/api/ioc')
 app.register_blueprint(whitelist_bp, url_prefix='/api/whitelist')
 app.register_blueprint(config_bp, url_prefix='/api/config')
+app.register_blueprint(misp_bp, url_prefix='/api/misp')
 
 if __name__ == '__main__':
     ssl_cert = "{}/{}".format(path[0], 'cert.pem')
diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index fc970b0..60a4c4b 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -4,6 +4,7 @@
 from app.utils import read_config
 from app.classes.iocs import IOCs
 from app.classes.whitelist import WhiteList
+from app.classes.misp import MISP
 
 import requests
 import json
@@ -16,11 +17,6 @@ from multiprocessing import Process
     in the configuration file. This in order to get
     automatically new iocs / elements from remote
     sources without user interaction.
-
-    As of today the default export JSON format from
-    the backend and unauthenticated HTTP requests
-    are accepted. The code is little awkward, it'll
-    be better in a next version ;)
 """
 
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
@@ -29,7 +25,7 @@ urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 def watch_iocs():
     """
         Retrieve IOCs from the remote URLs defined in config/watchers.
-        For each (new ?) IOC, add it to the DB.
+        For each IOC, add it to the DB.
     """
 
     # Retrieve the URLs from the configuration
@@ -45,8 +41,10 @@ def watch_iocs():
                     res = requests.get(w["url"], verify=False)
                     if res.status_code == 200:
                         content = json.loads(res.content)
-                        iocs_list = content["iocs"] if "iocs" in content else []
-                        to_delete = content["to_delete"] if "to_delete" in content else []
+                        iocs_list = content["iocs"] if "iocs" in content else [
+                        ]
+                        to_delete = content["to_delete"] if "to_delete" in content else [
+                        ]
                     else:
                         w["status"] = False
                 except:
@@ -93,8 +91,10 @@ def watch_whitelists():
                     res = requests.get(w["url"], verify=False)
                     if res.status_code == 200:
                         content = json.loads(res.content)
-                        elements = content["elements"] if "elements" in content else []
-                        to_delete = content["to_delete"] if "to_delete" in content else []
+                        elements = content["elements"] if "elements" in content else [
+                        ]
+                        to_delete = content["to_delete"] if "to_delete" in content else [
+                        ]
                     else:
                         w["status"] = False
                 except:
@@ -120,8 +120,25 @@ def watch_whitelists():
             break
 
 
+def watch_misp():
+    """
+        Retrieve IOCs from misp instances. Each new element is
+        tested added to the database.
+    """
+    while True:
+        for misp in MISP.get_instances():
+            try:
+                for ioc in MISP.get_iocs(misp.id):
+                    iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
+                             ioc["value"], "misp-{}".format(misp["name"]))
+            except:
+                continue
+
+
 p1 = Process(target=watch_iocs)
 p2 = Process(target=watch_whitelists)
+p3 = Process(target=watch_misp)
 
 p1.start()
 p2.start()
+p3.start()

From 73ee7a280bb43d15e5541dd95e2f0a9f45b149ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Tue, 8 Jun 2021 20:11:51 +0200
Subject: [PATCH 03/19] Some modifications, still need tests and debug

---
 assets/scheme.sql                     |  3 +-
 server/backend/app/blueprints/misp.py | 19 ++++---
 server/backend/app/classes/misp.py    | 75 ++++++++++++---------------
 server/backend/app/db/models.py       |  4 +-
 4 files changed, 45 insertions(+), 56 deletions(-)

diff --git a/assets/scheme.sql b/assets/scheme.sql
index ec8e9d9..d51bdd9 100644
--- a/assets/scheme.sql
+++ b/assets/scheme.sql
@@ -18,13 +18,12 @@ CREATE TABLE "whitelist" (
 	PRIMARY KEY("id" AUTOINCREMENT)
 );
 
-CREATE TABLE "mispinstance" (
+CREATE TABLE "misp" (
 	"id" 	INTEGER UNIQUE,
 	"name" 	TEXT,
 	"url"	TEXT NOT NULL,
 	"apikey"	TEXT NOT NULL,
 	"verifycert" INTEGER NOT NULL DEFAULT 0,
-	"source" TEXT NOT NULL,
 	"added_on" NUMERIC NOT NULL,
 	PRIMARY KEY("id" AUTOINCREMENT)
 );
diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index 2f627fc..8686bb5 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -13,7 +13,7 @@ misp = MISP()
 
 @misp_bp.route('/add', methods=['POST'])
 @require_header_token
-def add():
+def add_instance():
     """
         Parse and add a MISP instance to the database.
         :return: status of the operation in JSON
@@ -21,31 +21,30 @@ def add():
     data = json.loads(request.data)
     instance = data["data"]["instance"]
 
-    source = "backend"
-    res = MISP.add(instance["name"], instance["url"],
-                   instance["key"], instance["ssl"], source)
+    res = MISP.add_instance(instance["name"], instance["url"],
+                   instance["key"], instance["ssl"])
     return jsonify(res)
 
 
 @misp_bp.route('/delete/<misp_id>', methods=['GET'])
 @require_header_token
-def delete(misp_id):
+def delete_instance(misp_id):
     """
         Delete a MISP instance by its id to the database.
         :return: status of the operation in JSON
     """
-    res = MISP.delete(misp_id)
+    res = MISP.delete_instance(misp_id)
     return jsonify(res)
 
 
 @misp_bp.route('/get_all', methods=['GET'])
-@require_header_token
+# @require_header_token
 def get_all():
     """
         Retreive a list of all MISP instances.
         :return: list of MISP instances in JSON.
     """
-    res = MISP.get_all()
+    res = MISP.get_instances()
     return jsonify({"results": [i for i in res]})
 
 
@@ -68,14 +67,14 @@ def get_iocs():
 
 @misp_bp.route('/edit', methods=['POST'])
 @require_header_token
-def edit():
+def edit_instance():
     """
         Parse and edit the desired MISP instance.
         :return: status of the operation in JSON
     """
     data = json.loads(request.data)
     instance = data["data"]["instance"]
-    res = MISP.edit(instance["id"],
+    res = MISP.edit_instance(instance["id"],
                     instance["name"],
                     instance["url"],
                     instance["apikey"],
diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 4cf3cce..7634514 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -18,7 +18,7 @@ class MISP(object):
         return None
 
     @staticmethod
-    def add(misp_name, misp_url, misp_key, misp_verifycert):
+    def add_instance(misp_name, misp_url, misp_key, misp_verifycert):
         """
             Parse and add a MISP instance to the database.
             :return: status of the operation in JSON
@@ -57,7 +57,7 @@ class MISP(object):
                     "message": "The MISP instance name can't be empty"}
 
     @staticmethod
-    def edit(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
+    def edit_instance(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
         """
             Parse and edit the desired MISP instance.
             :return: status of the operation in JSON
@@ -134,48 +134,39 @@ class MISP(object):
         misp = MISPInst.query.get(int(misp_id))
         if misp is not None:
             if misp.url and misp.apikey:
-                try:
-                    # Connect to MISP instance and get network activity attributes.
-                    m = PyMISP(misp.url, misp.apikey, misp.verifycert)
-                    r = m.search("attributes", category="Network activity")
+                # Connect to MISP instance and get network activity attributes.
+                m = PyMISP(misp.url, misp.apikey, misp.verifycert)
+                r = m.search("attributes", category="Network activity")
 
-                    for attr in r["Attribute"]:
-                        if attr["type"] in ["ip_dst", "domain", "snort", "x509-fingerprint-sha1"]:
+                for attr in r["Attribute"]:
+                    if attr["type"] in ["ip-dst", "domain", "snort", "x509-fingerprint-sha1"]:
 
-                            ioc = {"value": attr["value"],
-                                   "type": None,
-                                   "tag": "suspect",
-                                   "tlp": "white"}
+                        ioc = {"value": attr["value"],
+                               "type": None,
+                               "tag": "suspect",
+                               "tlp": "white"}
 
-                            # Deduce the IOC type.
-                            if re.match(defs["iocs_types"][0]["regex"], attr["value"]):
-                                ioc["type"] = "ipv4addr"
-                            elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
-                                ioc["type"] = "ipv6addr"
-                            elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
-                                ioc["type"] = "domain"
-                            elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):
-                                ioc["type"] = "sha1cert"
-                            elif "alert " in attr["value"][0:5]:
-                                ioc["type"] = "snort"
+                        # Deduce the IOC type.
+                        if re.match(defs["iocs_types"][0]["regex"], attr["value"]):
+                            ioc["type"] = "ipv4addr"
+                        elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
+                            ioc["type"] = "ipv6addr"
+                        elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
+                            ioc["type"] = "domain"
+                        elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):
+                            ioc["type"] = "sha1cert"
+                        elif "alert " in attr["value"][0:6]:
+                            ioc["type"] = "snort"
+                        else:
+                            continue
 
-                            if "Tag" in attr:
-                                for tag in attribute['Tag']:
-                                    # Add the TLP of the IOC.
-                                    tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'])
-                                    if tlp: ioc["tlp"] = tlp.group(1)
+                        if "Tag" in attr:
+                            for tag in attr["Tag"]:
+                                # Add the TLP of the IOC.
+                                tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'].lower())
+                                if tlp: ioc["tlp"] = tlp.group(1)
 
-                                    # Add possible tag.
-                                    if lower(tag["name"]) in [t["tag"] for t in defs["iocs_tags"]]:
-                                        ioc["tag"] = lower(tag["name"])
-                            yield ioc
-                except:
-                    return {"status": False,
-                            "message": "An exception has been raised: ", sys.exc_info()[0])}
-                    pass
-            else:
-                return {"status": False,
-                        "message": "The URL or API key is empty."}
-        else:
-            return {"status": False,
-                    "message": "Unknown MISP instance."}
+                                # Add possible tag.
+                                if tag["name"].lower() in [t["tag"] for t in defs["iocs_tags"]]:
+                                    ioc["tag"] = tag["name"].lower()
+                        yield ioc
diff --git a/server/backend/app/db/models.py b/server/backend/app/db/models.py
index c429da8..cfa33ae 100644
--- a/server/backend/app/db/models.py
+++ b/server/backend/app/db/models.py
@@ -23,11 +23,11 @@ class MISPInst(db.Model):
     def __init__(self, name, url, key, ssl, added_on):
         self.name = name
         self.url = url
-        self.authkey = key
+        self.apikey = key
         self.verifycert = ssl
         self.added_on = added_on
 
 
 db.mapper(Whitelist, db.Table('whitelist', db.metadata, autoload=True))
 db.mapper(Ioc, db.Table('iocs', db.metadata, autoload=True))
-db.mapper(MISP, db.Table('misp', db.metadata, autoload=True))
+db.mapper(MISPInst, db.Table('misp', db.metadata, autoload=True))

From 691a413bfbbe031cfef0827a8dfba8ee03f31399 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 09:27:30 +0200
Subject: [PATCH 04/19] Modifying ip4addr & ip6addr types

---
 server/backend/app/classes/misp.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 7634514..36b5995 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -148,9 +148,9 @@ class MISP(object):
 
                         # Deduce the IOC type.
                         if re.match(defs["iocs_types"][0]["regex"], attr["value"]):
-                            ioc["type"] = "ipv4addr"
+                            ioc["type"] = "ip4addr"
                         elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
-                            ioc["type"] = "ipv6addr"
+                            ioc["type"] = "ip6addr"
                         elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
                             ioc["type"] = "domain"
                         elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):

From 50baeaa9e555ee31f0f191d96dc8af87e525f1fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 11:11:55 +0200
Subject: [PATCH 05/19] Updating misp class and associated watcher code

---
 server/backend/app/classes/misp.py | 113 +++++++++++------------------
 server/backend/watchers.py         |  30 ++++----
 2 files changed, 55 insertions(+), 88 deletions(-)

diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 36b5995..2bfbc62 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -17,83 +17,34 @@ class MISP(object):
     def __init__(self):
         return None
 
-    @staticmethod
-    def add_instance(misp_name, misp_url, misp_key, misp_verifycert):
+    def add_instance(self, name, url, apikey, verify):
         """
             Parse and add a MISP instance to the database.
             :return: status of the operation in JSON
         """
 
         sameinstances = db.session.query(MISPInst).filter(
-            MISPInst.url == misp_url, MISPInst.apikey == misp_key)
+            MISPInst.url == url, MISPInst.apikey == apikey)
         if sameinstances.count():
             return {"status": False,
                     "message": "This MISP instance already exists"}
-        elif misp_name != "":
-            if misp_url != "":
-                if re.match(r"^(?:(?:http|https)://)", misp_url):
-                    if misp_key != "":
-                        added_on = int(time.time())
-                        db.session.add(MISPInst(misp_name, escape(
-                            misp_url), misp_key, misp_verifycert, added_on))
-                        db.session.commit()
-                        return {"status": True,
-                                "message": "MISP instance added",
-                                "name": escape(misp_name),
-                                "url": escape(misp_url),
-                                "apikey": escape(misp_key),
-                                "verifycert": escape(misp_verifycert)}
-                    else:
-                        return {"status": False,
-                                "message": "The key can't be empty"}
-                else:
-                    return {"status": False,
-                            "message": "The url must begin with http:// or https://"}
+        if name:
+            if self.test_instance(url, apikey, verify):
+                added_on = int(time.time())
+                db.session.add(MISPInst(name, escape(url), apikey, verify, added_on))
+                db.session.commit()
+                return {"status": True,
+                        "message": "MISP instance added",
+                        "name": escape(name),
+                        "url": escape(url),
+                        "apikey": escape(apikey),
+                        "verifycert": escape(verify)}
             else:
                 return {"status": False,
-                        "message": "The url can't be empty"}
+                        "message": "Please verify the connection to the MISP instance"}
         else:
             return {"status": False,
-                    "message": "The MISP instance name can't be empty"}
-
-    @staticmethod
-    def edit_instance(misp_id, misp_name, misp_url, misp_key, misp_verifycert):
-        """
-            Parse and edit the desired MISP instance.
-            :return: status of the operation in JSON
-        """
-        misp = MISPInst.query.get(int(misp_id))
-        otherinstances = db.session.query(MISPInst).filter(MISPInst.id != int(
-            misp_id), MISPInst.url == misp_url, MISPInst.apikey == misp_key)
-        if misp is None:
-            return {"status": False,
-                    "message": "Can't find the MISP instance"}
-        if otherinstances.count() > 0:
-            return {"status": False,
-                    "message": "This MISP instance already exists"}
-        elif misp_name != "":
-            if misp_url != "":
-                if re.match(r"^(?:(?:http|https)://)", misp_url):
-                    if misp_key != "":
-                        misp.name = misp_name
-                        misp.url = misp_url
-                        misp.apikey = misp_key
-                        misp.verifycert = misp_verifycert
-                        db.session.commit()
-                        return {"status": True,
-                                "message": "MISP instance edited"}
-                    else:
-                        return {"status": False,
-                                "message": "The key can't be empty"}
-                else:
-                    return {"status": False,
-                            "message": "The url must begin with http:// or https://"}
-            else:
-                return {"status": False,
-                        "message": "The url can't be empty"}
-        else:
-            return {"status": False,
-                    "message": "The MISP instance name can't be empty"}
+                    "message": "Please provide a name for your instance"}
 
     @staticmethod
     def delete_instance(misp_id):
@@ -110,8 +61,7 @@ class MISP(object):
             return {"status": False,
                     "message": "MISP instance not found"}
 
-    @staticmethod
-    def get_instances():
+    def get_instances(self):
         """
             Get MISP instances from the database
             :return: generator of the records.
@@ -122,7 +72,20 @@ class MISP(object):
                    "name": misp["name"],
                    "url": misp["url"],
                    "apikey": misp["apikey"],
-                   "verifycert": misp["verifycert"]}
+                   "verifycert": True if misp["verifycert"] else False,
+                   "connected": self.test_instance(misp["url"], misp["apikey"], misp["verifycert"]) }
+
+    @staticmethod
+    def test_instance(url, apikey, verify):
+        """
+            Test the connection of the MISP instance.
+            :return: generator of the records.
+        """
+        try:
+            PyMISP(url, apikey, verify)
+            return True
+        except:
+            return False
 
     @staticmethod
     def get_iocs(misp_id):
@@ -134,9 +97,13 @@ class MISP(object):
         misp = MISPInst.query.get(int(misp_id))
         if misp is not None:
             if misp.url and misp.apikey:
-                # Connect to MISP instance and get network activity attributes.
-                m = PyMISP(misp.url, misp.apikey, misp.verifycert)
-                r = m.search("attributes", category="Network activity")
+                try:
+                    # Connect to MISP instance and get network activity attributes.
+                    m = PyMISP(misp.url, misp.apikey, misp.verifycert)
+                    r = m.search("attributes", category="Network activity")
+                except:
+                    print("Unable to connect to the MISP instance ({}/{}).".format(misp.url, misp.apikey))
+                    return []
 
                 for attr in r["Attribute"]:
                     if attr["type"] in ["ip-dst", "domain", "snort", "x509-fingerprint-sha1"]:
@@ -151,6 +118,8 @@ class MISP(object):
                             ioc["type"] = "ip4addr"
                         elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
                             ioc["type"] = "ip6addr"
+                        elif re.match(defs["iocs_types"][2]["regex"], attr["value"]):
+                            ioc["type"] = "cidr"
                         elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
                             ioc["type"] = "domain"
                         elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):
@@ -162,11 +131,11 @@ class MISP(object):
 
                         if "Tag" in attr:
                             for tag in attr["Tag"]:
-                                # Add the TLP of the IOC.
+                                # Add a TLP to the IOC if defined in tags.
                                 tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'].lower())
                                 if tlp: ioc["tlp"] = tlp.group(1)
 
-                                # Add possible tag.
+                                # Add possible tag (need to match TinyCheck tags)
                                 if tag["name"].lower() in [t["tag"] for t in defs["iocs_tags"]]:
                                     ioc["tag"] = tag["name"].lower()
                         yield ioc
diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index 60a4c4b..08f599f 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -41,10 +41,8 @@ def watch_iocs():
                     res = requests.get(w["url"], verify=False)
                     if res.status_code == 200:
                         content = json.loads(res.content)
-                        iocs_list = content["iocs"] if "iocs" in content else [
-                        ]
-                        to_delete = content["to_delete"] if "to_delete" in content else [
-                        ]
+                        iocs_list = content["iocs"] if "iocs" in content else []
+                        to_delete = content["to_delete"] if "to_delete" in content else []
                     else:
                         w["status"] = False
                 except:
@@ -91,10 +89,8 @@ def watch_whitelists():
                     res = requests.get(w["url"], verify=False)
                     if res.status_code == 200:
                         content = json.loads(res.content)
-                        elements = content["elements"] if "elements" in content else [
-                        ]
-                        to_delete = content["to_delete"] if "to_delete" in content else [
-                        ]
+                        elements = content["elements"] if "elements" in content else []
+                        to_delete = content["to_delete"] if "to_delete" in content else []
                     else:
                         w["status"] = False
                 except:
@@ -125,15 +121,17 @@ def watch_misp():
         Retrieve IOCs from misp instances. Each new element is
         tested added to the database.
     """
-    while True:
-        for misp in MISP.get_instances():
-            try:
-                for ioc in MISP.get_iocs(misp.id):
-                    iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
-                             ioc["value"], "misp-{}".format(misp["name"]))
-            except:
-                continue
+    iocs, misp = IOCs(), MISP()
+    instances = [i for i in misp.get_instances()]
 
+    while instances:
+        for i, inst in enumerate(instances):
+            if inst["connected"]:
+                for ioc in misp.get_iocs(inst["id"]):
+                    iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
+                             ioc["value"], "misp-{}".format(inst["id"]))
+                instances.pop(i)
+        if instances: time.sleep(60)
 
 p1 = Process(target=watch_iocs)
 p2 = Process(target=watch_whitelists)

From 93e164d7c2dc3dc31e7a6a21ba1c04a75d4924f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 11:17:30 +0200
Subject: [PATCH 06/19] Typo in comment

---
 server/backend/watchers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index 08f599f..7a35736 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -119,7 +119,7 @@ def watch_whitelists():
 def watch_misp():
     """
         Retrieve IOCs from misp instances. Each new element is
-        tested added to the database.
+        tested and then added to the database.
     """
     iocs, misp = IOCs(), MISP()
     instances = [i for i in misp.get_instances()]

From 1d1c217258c80f59305e330cb4c53e1660257f68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 12:48:44 +0200
Subject: [PATCH 07/19] Deleting edit endpoint

---
 server/backend/app/blueprints/misp.py | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index 8686bb5..228c685 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -44,7 +44,7 @@ def get_all():
         Retreive a list of all MISP instances.
         :return: list of MISP instances in JSON.
     """
-    res = MISP.get_instances()
+    res = MISP().get_instances()
     return jsonify({"results": [i for i in res]})
 
 
@@ -63,20 +63,3 @@ def get_iocs():
                         data["limit"],
                         data["page"])
     return jsonify(res)
-
-
-@misp_bp.route('/edit', methods=['POST'])
-@require_header_token
-def edit_instance():
-    """
-        Parse and edit the desired MISP instance.
-        :return: status of the operation in JSON
-    """
-    data = json.loads(request.data)
-    instance = data["data"]["instance"]
-    res = MISP.edit_instance(instance["id"],
-                    instance["name"],
-                    instance["url"],
-                    instance["apikey"],
-                    instance["verifycert"])
-    return jsonify(res)

From a481e88251de51ad0d3b18d12d0ec7e657aed5dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 12:49:28 +0200
Subject: [PATCH 08/19] Deleting get iocs endpoint

---
 server/backend/app/blueprints/misp.py | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index 228c685..dcd92f0 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -46,20 +46,3 @@ def get_all():
     """
     res = MISP().get_instances()
     return jsonify({"results": [i for i in res]})
-
-
-@misp_bp.route('/get_iocs', methods=['POST'])
-# @require_header_token
-def get_iocs():
-    """
-        Retreive a list of all MISP instances.
-        :return: list of MISP instances in JSON.
-    """
-
-    data = json.loads(request.data)
-    data = data["data"]
-
-    res = MISP.get_iocs(data["misp_id"],
-                        data["limit"],
-                        data["page"])
-    return jsonify(res)

From f189f2e1008c9e1678d7d5210d4c41404d77358c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Wed, 9 Jun 2021 18:24:37 +0200
Subject: [PATCH 09/19] Code modifications regarding MISP integration

---
 app/backend/src/App.vue               |   2 +-
 app/backend/src/assets/custom.css     |  57 +++-
 app/backend/src/views/iocs-misp.vue   | 386 +++++---------------------
 server/backend/app/blueprints/misp.py |  11 +-
 server/backend/app/classes/misp.py    |   7 +-
 5 files changed, 138 insertions(+), 325 deletions(-)

diff --git a/app/backend/src/App.vue b/app/backend/src/App.vue
index cd06924..1350785 100644
--- a/app/backend/src/App.vue
+++ b/app/backend/src/App.vue
@@ -40,7 +40,7 @@
                   <span @click="$router.push('/iocs/manage')">Manage IOCs</span>
                 </li>
                 <li class="menu-item">
-                  <span @click="$router.push('/iocs/misp')">MISP IOCs</span>
+                  <span @click="$router.push('/iocs/misp')">MISP Instances</span>
                 </li>
                 <li class="menu-item">
                   <span @click="$router.push('/iocs/search')">Search IOCs</span>
diff --git a/app/backend/src/assets/custom.css b/app/backend/src/assets/custom.css
index 9b6ccec..969789b 100644
--- a/app/backend/src/assets/custom.css
+++ b/app/backend/src/assets/custom.css
@@ -658,22 +658,38 @@ h4, h5 {
 	/* Using CSS Grid to lay out the elements in two-dimensions: */
 	display: grid;
 	/* specifying a 0.2em gutter/gap between adjacent elements: */
-	gap: 0.2em;
+	gap: 0.4em;
 	overflow:auto;
 	grid-template-columns: 10em 0.5em 1fr;
 	width: 100%;
-	border:0.05rem solid #cecece;
 	border-radius:.1rem;
-	margin-bottom:.4rem;
-	padding:.4rem;
+	margin-bottom: .8rem;
 }
 
 .misp-label {
 	/* placing all <label> elements in the grid column 1 (the first): */
 	grid-column: 1;
 	text-align: left;
+	padding-top: .3em;
 }
 
+.misp-offline {
+	background-color: #e85600;
+	color: #FFF;
+	font-size: 11px;
+	border-radius: 3px;
+	padding:3px;
+	text-transform: uppercase;
+}
+
+.misp-online {
+	background-color: #64c800;
+	color: #FFF;
+	font-size: 11px;
+	border-radius: 3px;
+	padding:3px;
+	text-transform: uppercase;
+}
 .misp-name {
 	font-size: 1rem;
 	font-family: "Roboto-Bold";
@@ -704,3 +720,36 @@ h4, h5 {
 	   by the name of 'submit': */
 	grid-area: submit;
 }
+
+.loading {
+	margin-bottom: 12px;
+	display: block;
+}
+
+.loading::after {
+    animation: loading .5s infinite linear;
+    background: 0 0;
+    border: .1rem solid #66758c;
+    border-radius: 50%;
+    border-right-color: transparent;
+    border-top-color: transparent;
+    content: "";
+    display: block;
+    height: .8rem;
+    left: 50%;
+    margin-left: -.4rem;
+    margin-top: -.4rem;
+    opacity: 1;
+    padding: 0;
+    position: absolute;
+    top: 50%;
+    width: .8rem;
+    z-index: 1;
+}
+
+.loading.loading-lg::after {
+    height: 1.6rem;
+    margin-left: -.8rem;
+    margin-top: -.8rem;
+    width: 1.6rem;
+}
\ No newline at end of file
diff --git a/app/backend/src/views/iocs-misp.vue b/app/backend/src/views/iocs-misp.vue
index 2bc03fb..a619f1f 100644
--- a/app/backend/src/views/iocs-misp.vue
+++ b/app/backend/src/views/iocs-misp.vue
@@ -1,12 +1,7 @@
 <template>
     <div class="backend-content" id="content">
         <div class="column col-6 col-xs-12">
-            <h3 class="s-title">Manage MISP IOCs</h3>
-            <div>
-                Here you can add IOCs from your MISP instances. To do so, you first need to fullfil the "Add a new MISP instance" form. Then go to the "Existing instances" tab and scroll to the desired instance.
-                Finally, just fill the parameters as you wish and click on the "Import IOCs" button. All the IOCs that are not already in the database will be added.
-                Note that only IOCs (attributes) that belongs to the "Network activity" category will be inserted.
-            </div>
+            <h3 class="s-title">Manage MISP instances</h3>
             <ul class="tab tab-block">
                 <li class="tab-item">
                     <a href="#" v-on:click="switch_tab('addmisp')" v-bind:class="{ active: tabs.addmisp }">Add instance</a>
@@ -16,361 +11,137 @@
                 </li>
             </ul>
             <div v-if="tabs.addmisp">
-                <h5>Add a new MISP instance</h5>
                 <div class="misp-form">
-                    <label class="misp-label">Name</label><span>:</span>
-                    <input class="misp-input" type="text" ref="misp_name" placeholder="Enter the name to give to your MISP instance" v-model="mispinst.name" required>
-                    <label class="misp-label">URL</label><span>:</span>
-                    <input class="misp-input" type="text" ref="misp_url" placeholder="Enter your MISP instance URL" v-model="mispinst.url" required>
-                    <label class="misp-label">API key</label><span>:</span>
-                    <input class="misp-input" type="text" ref="misp_key" placeholder="Enter the API key to use" v-model="mispinst.key" required>
-                    <label class="misp-label">Verify certificate</label><span>:</span>
-                    <div style="flex:50%"><input class="misp-input" style="margin-right: 5px;" type="checkbox" id="checkbox" v-model="mispinst.ssl"><label for="checkbox">{{ mispinst.ssl }}</label></div>
+                    <label class="misp-label">Instance name</label><span></span>
+                    <input class="form-input" type="text" ref="misp_name" placeholder="CYBERACME MISP" v-model="mispinst.name" required>
+                    <label class="misp-label">Instance URL</label><span></span>
+                    <input class="form-input" type="text" ref="misp_url" placeholder="https://misp.cyberacme.com" v-model="mispinst.url" required>
+                    <label class="misp-label">Authentication key</label><span></span>
+                    <input class="form-input" type="text" ref="misp_key" placeholder="OqHSMyAuth3ntic4t10nK3y3iiH" v-model="mispinst.key" required>
+                    <label class="misp-label">Verify certificate? </label><span></span>
+                    <div style="flex:50%"><label class="form-switch">
+                    <input type="checkbox" @change="switch_config('frontend', 'kiosk_mode')" v-model="mispinst.ssl">
+                    <i class="form-icon"></i>
+                    </label></div>
                 </div>
-                <button class="btn-primary btn col-12" v-on:click="add_misp_instance()">Add MISP instance</button>
-                <div class="form-group" v-if="addedInstance.length>0">
+                <button class="btn-primary btn col-12" v-on:click="add_instance()">Add MISP instance</button>
+                <div class="form-group" v-if="added">
                     <div class="toast toast-success">
                         ✓ MISP instance added successfully.
                     </div>
                 </div>
-                <div v-if="errorsInstance.length>0">
-                    <div class="form-group">
-                        <div class="toast toast-error">
-                            ✗ MISP instance not added, see details below.
-                        </div>
-                    </div>
-                    <div class="form-group">
-                        <table class="table table-striped table-hover">
-                            <thead>
-                                <tr>
-                                    <th>Name</th>
-                                    <th>URL</th>
-                                    <th>API key</th>
-                                    <th>Reason</th>
-                                </tr>
-                            </thead>
-                            <tbody>
-                                <tr v-for="e in errorsInstance" v-bind:key="e.name">
-                                    <td>{{ e.name }}</td>
-                                    <td>{{ e.url }}</td>
-                                    <td>{{ e.apikey }}</td>
-                                    <td>{{ e.message }}</td>
-                                </tr>
-                            </tbody>
-                        </table>
+                <div class="form-group" v-if="error">
+                    <div class="toast toast-error">
+                        ✗ MISP instance not added. {{error}}
                     </div>
                 </div>
             </div>
             <div class="form-group" v-if="tabs.instances">
-                <div v-if="mispInstances.length>0">
-                    <div v-for="r in mispInstances" v-bind:key="r.id">
-                        <div style="position: relative">
-                            <input class="misp-name" :id="r.id + 'name'" v-bind:value="r.name" v-model="r.name" disabled="disabled" required>
-                            <button class="btn btn-sm" :id="r.id + 'edit'" :ref="r.id + 'edit'" v-on:click="edit_misp_instance(r)" style="position: absolute; right:120px;">Edit instance</button>
-                            <button class="btn btn-sm" :id="r.id + 'delete'" :ref="r.id + 'delete'" v-on:click="remove_or_cancel_edit_misp_instance(r)" style="position: absolute; right:0;">Delete instance</button>
-                        </div>
-                        <div class="misp-form">
-                            <label class="misp-label">URL</label><span>:</span>
-                            <input class="misp-input" :id="r.id + 'insturl'" v-bind:value="r.url" v-model="r.url" disabled="disabled" required>
-                            <label class="misp-label">API Key</label><span>:</span>
-                            <input class="misp-input" :id="r.id + 'instkey'" v-bind:value="r.apikey" v-model="r.apikey" disabled="disabled" required>
-                            <label class="misp-label">Verify certificate</label><span>:</span>
-                            <div style="flex:50%;"><input class="misp-input" :id="r.id + 'check'" type="checkbox" v-bind:value="r.verifycert" v-model="r.verifycert" style="visibility: hidden; width: 0;"><label v-bind:value="r.verifycert">{{ r.verifycert == 0 ? 'false' : 'true'}}</label></div>
-                            <label class="misp-label">Limit</label><span>:</span>
-                            <input class="misp-input" type="number" step="1" min="0" :id="r.id + 'limit'" placeholder="Enter the maximum number of IOCs to retrieve">
-                            <label class="misp-label">Page index</label><span>:</span>
-                            <input class="misp-input" type="number" step="1" min="0" :id="r.id + 'page'" placeholder="Enter the page index where to start retrieving IOCs">
-                            <button class="btn btn-sm" :id="r.id + 'import'" v-on:click="import_misp_iocs(r)">Import IOCs</button>
-                        </div>
-                    </div>
-                    <div class="form-group" v-if="addedInstance.length>0">
-                    <div class="toast toast-success">
-                        ✓ MISP instance edited successfully.
-                    </div>
-                </div>
-                <div v-if="errorsInstance.length>0">
-                    <div class="form-group">
-                        <div class="toast toast-error">
-                            ✗ MISP instance count not be edited, see details below.
-                        </div>
-                    </div>
-                    <div class="form-group">
-                        <table class="table table-striped table-hover">
-                            <thead>
-                                <tr>
-                                    <th>Name</th>
-                                    <th>URL</th>
-                                    <th>API key</th>
-                                    <th>Reason</th>
-                                </tr>
-                            </thead>
-                            <tbody>
-                                <tr v-for="e in errorsInstance" v-bind:key="e.name">
-                                    <td>{{ e.name }}</td>
-                                    <td>{{ e.url }}</td>
-                                    <td>{{ e.apikey }}</td>
-                                    <td>{{ e.message }}</td>
-                                </tr>
-                            </tbody>
-                        </table>
-                    </div>
-                </div>
+                <div v-if="instances.length">
+                    <table class="table table-striped table-hover">
+                        <thead>
+                            <tr>
+                                <th>Name</th>
+                                <th>Server</th>
+                                <th>Authkey</th>
+                                <th>Status</th>
+                                <th>Action</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr v-for="i in instances" v-bind:key="i.id">
+                                <td>{{ i.name }}</td>
+                                <td>{{ i.url.replace('https://', '') .replace('http://', '') }}</td>
+                                <td>{{ i.apikey.slice(0,5) }} [...] {{ i.apikey.slice(35,40) }}</td>
+                                <td>
+                                    <span v-if="i.connected" class="misp-online">✓ Online</span>
+                                    <span v-else class="misp-offline">⚠ Offline</span>
+                                </td>
+                                <td><button class="btn btn-sm" v-on:click="delete_instance(i)">Delete</button></td>
+                            </tr>
+                        </tbody>
+                    </table>
                 </div>
                 <div v-else>
-                    <p>No MISP instance found. Click the "Add" button to add new MISP instance.</p>
-                    <button class="btn btn-sm" v-on:click="switch_tab('addmisp')" v-bind:class="{ active: tabs.addmisp }">Add a new instance</button>
-                </div>
-            </div>
-          
-            <div class="form-group" v-if="imported.length>0">
-                <div class="toast toast-success">
-                    ✓ {{imported.length}} IOC<span v-if="imported.length>1">s</span> imported successfully.
-                </div>
-                <div class="form-group">
-                    <table class="table table-striped table-hover">
-                        <thead>
-                            <tr>
-                                <th>Indicator</th>
-                                <th>Type</th>
-                                <th>Tag</th>
-                                <th>TLP</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            <tr v-for="i in imported" v-bind:key="i.ioc">
-                                <td>{{ i.ioc }}</td>
-                                <td>{{ i.type }}</td>
-                                <td>{{ i.tag }}</td>
-                                <td>{{ i.tlp }}</td>
-                            </tr>
-                        </tbody>
-                    </table>
-                </div>
-            </div>
-            <div v-if="errors.length>0">
-                <div class="form-group">
-                    <div class="toast toast-error">
-                        ✗ {{errors.length}} IOC<span v-if="errors.length>1">s</span> not imported, see details below.
-                    </div>
-                </div>
-                <div class="form-group">
-                    <table class="table table-striped table-hover">
-                        <thead>
-                            <tr>
-                                <th>Indicator</th>
-                                <th>Importation error</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            <tr v-for="e in errors" v-bind:key="e.ioc">
-                                <td>{{ e.ioc }}</td>
-                                <td>{{ e.message }}</td>
-                            </tr>
-                        </tbody>
-                    </table>
-                </div>
-            </div>
-            <div v-else-if="type_tag_error==true">
-                <div  class="form-group">
-                    <div class="toast toast-error">
-                        ✗ IOC(s) not imported, see details below.
-                    </div>
-                </div>
-                <div  class="form-group">
                     <div class="empty">
-                        <p class="empty-title h5">Please select a tag and a type.</p>
-                        <p class="empty-subtitle">If different IOCs types, select "Unknown (regex parsing)".</p>
+                        <div v-if="loading">
+                            <p class="empty-title h5">
+                                <span class="loading loading-lg"></span>
+                            </p>
+                            <p class="empty-subtitle">Testing and loading your MISP instances.</p>
+                        </div>
+                        <div v-else>
+                            <p class="empty-title h5">No MISP instance found.</p>
+                            <p class="empty-subtitle">Do not hesitate to add a MISP instance.</p>
+                        </div>
                     </div>
                 </div>
             </div>
         </div>
     </div>
 </template>
-
 <script>
+
 import axios from 'axios'
 
 export default {
     name: 'managemisp',   
     data() {
         return { 
-            errors:[],
-            imported:[],
-            errorsInstance:[],
-            addedInstance:[],
-            mispinst:{name:'', url:'',key:'', ssl:false},
-            mispInstances:[],
+            error:false,
+            loading:false,
+            added:false,
+            mispinst:{ name:'', url:'',key:'', ssl:false },
+            instances:[],
             tabs: { "addmisp" : true, "instances" : false },
-            jwt:"",
-            type_tag_error: false
+            jwt:""
         }
     },
     props: { },
     methods: {
-        add_misp_instance: function()
+        add_instance: function()
         {  
-            this.errors = [];
-            this.imported = [];
-            this.errorsInstance = []
-            this.addedInstance = []
-            if (this.mispinst["name"] != "" && this.mispinst["url"] != "" && this.mispinst["key"] != "")
+            this.added = false;
+            this.error = false;
+            if (this.mispinst.name && this.mispinst.url && this.mispinst.key)
             {
                 axios.post(`/api/misp/add`, { data: { instance: this.mispinst } }, { headers: {'X-Token': this.jwt} }).then(response => {
                     if(response.data.status){
-                        this.addedInstance.push(response.data);
-                    } else if (response.data.message){
-                        this.errorsInstance.push(response.data);
-                    }
-                })
-                .catch(err => (console.log(err)))
-            }
-            else
-            {
-                console.log(this.mispinst["name"]);
-                console.log(this.mispinst["url"]);
-                console.log(this.mispinst["key"]);
-            }
-        },
-        edit_misp_instance (elem)
-        {
-            if (document.getElementById(elem.id+'insturl').disabled == false)
-            {   // The misp instance was in edit mode
-                   
-                this.errors = [];
-                this.imported = [];
-                this.errorsInstance = []
-                this.addedInstance = []
-                if (elem["name"] != "" && elem["url"] != "" && elem["key"] != "")
-                {
-                    axios.post(`/api/misp/edit`, { data: { instance: elem } }, { headers: {'X-Token': this.jwt} }).then(response => {
-                        if(response.data.status){
-                            this.addedInstance.push(response.data);
-                        } else if (response.data.message){
-                            this.errorsInstance.push(response.data);
-                        }
-                    })
-                    .catch(err => (console.log(err)))
-                }
-                this.cancel_edit_misp(elem);
-            }
-            else
-            {   // the misp instance should enter in edit mode
-
-                document.getElementById(elem.id+'edit').innerText = 'Validate edit';
-                document.getElementById(elem.id+'delete').innerText = 'Cancel edit';
-                document.getElementById(elem.id+'name').disabled = false;
-                document.getElementById(elem.id+'insturl').disabled = false;
-                document.getElementById(elem.id+'instkey').disabled = false;
-                document.getElementById(elem.id+'limit').disabled = true;
-                document.getElementById(elem.id+'page').disabled = true;
-                document.getElementById(elem.id+'import').disabled = true;
-                document.getElementById(elem.id+'check').style = "margin-right: 5px;";
-            }
-        },
-        remove_or_cancel_edit_misp_instance(elem)
-        {
-            if (document.getElementById(elem.id+'insturl').disabled == false)
-            {   // The misp instance was in edit mode
-
-                this.cancel_edit_misp(elem)
-            }
-            else
-            {   // The misp instance should be delete
-
-                axios.get(`/api/misp/delete/${elem.id}`, { timeout: 10000, headers: {'X-Token': this.jwt} })
-                .then(response => {
-                    if(response.data.status){
-                        this.mispInstances = this.mispInstances.filter(function(el) { return el != elem; }); 
+                        this.added = true;
+                    } else {
+                        this.error = response.data.message;
                     }
                 })
                 .catch(err => (console.log(err)))
             }
         },
-        cancel_edit_misp(elem)
+        delete_instance(elem)
         {
-            document.getElementById(elem.id+'edit').innerText = 'Edit instance';
-            document.getElementById(elem.id+'delete').innerText = 'Delete instance';  
-            document.getElementById(elem.id+'name').disabled = true;
-            document.getElementById(elem.id+'insturl').disabled = true;
-            document.getElementById(elem.id+'instkey').disabled = true;
-            document.getElementById(elem.id+'limit').disabled = false;
-            document.getElementById(elem.id+'page').disabled = false;
-            document.getElementById(elem.id+'import').disabled = false;
-            document.getElementById(elem.id+'check').style = "visibility: hidden; width: 0;";
-        },
-        import_misp_iocs(elem)
-        {
-            this.errors = [];
-            this.imported = [];
-            this.errorsInstance = []
-            this.addedInstance = []
-
-            axios.post(`/api/misp/get_iocs`, { data: { misp_id: elem.id, page: document.getElementById(elem.id+'page').value, limit: document.getElementById(elem.id+'limit').value } }, { headers: {'X-Token': this.jwt} })
+            axios.get(`/api/misp/delete/${elem.id}`, { timeout: 10000, headers: {'X-Token': this.jwt} })
             .then(response => {
-                if(response.data.results.length>0){
-                    console.log(response.data.results);
-                    response.data.results.forEach(ioc => {
-                    this.import_ioc(ioc["tag"], ioc["type"], ioc["tlp"], ioc["value"], elem.name + "_" + elem.id);
-                    });
-                }
-                else
-                {
-                    console.log(response);
+                if(response.data.status){
+                    this.instances = this.instances.filter(function(el) { return el != elem; }); 
                 }
             })
             .catch(err => (console.log(err)))
         },
-        import_ioc: function(tag, type, tlp, ioc, source) {
-            if (ioc != "" && ioc.slice(0,1)  != "#"){
-                if("alert " != ioc.slice(0,6)) {
-                    ioc = ioc.trim()
-                    ioc = ioc.replace(" ", "")
-                    ioc = ioc.replace("[", "")
-                    ioc = ioc.replace("]", "")
-                    ioc = ioc.replace("\\", "")
-                    ioc = ioc.replace("(", "")
-                    ioc = ioc.replace(")", "")
-                }
-                
-                let finalioc = {ioc_tag: tag, ioc_type: type, ioc_tlp: tlp, ioc_value: ioc, ioc_source: "misp_" + source}
-
-                axios.post(`/api/ioc/add_post`, { data: { ioc: finalioc } }, { headers: {'X-Token': this.jwt} })
-                .then(response => {
-                    if(response.data.status){
-                        this.imported.push(response.data);
-                    } else if (response.data.message){
-                        this.errors.push(response.data);
-                    }
-                })
-                .catch(err => (console.log(err)))
-            }
-        },
         get_misp_instances()
         {
-            this.errorsInstance = []
-            this.addedInstance = []
-            this.mispInstances = []
+            this.loading = true;
+            this.instances = []
             axios.get(`/api/misp/get_all`, { timeout: 10000, headers: {'X-Token': this.jwt} })
             .then(response => {
-                console.log(response.data);
-                if(response.data.results.length>0){
-                    this.mispInstances = [].concat(this.mispInstances, response.data.results);
-                }
+                if(response.data.results) this.instances = response.data.results;
+                this.loading = false
             })
             .catch(err => (console.log(err)))
         },
         switch_tab: function(tab) {
-            this.errors   = []
-            this.errorsInstance = []
-            this.addedInstance = []
 
             Object.keys(this.tabs).forEach(key => {
                 if( key == tab ){
                     this.tabs[key] = true
-                    if (key == "instances")
-                    {
-                        this.get_misp_instances();
-                    }
+                    if (key == "instances") this.get_misp_instances();
                 } else {
                     this.tabs[key] = false
                 }
@@ -388,15 +159,6 @@ export default {
     },
     created: function() {
         this.get_jwt();
-        this.get_misp_instances();
-        if (this.mispInstances.length>0)
-        {
-            this.tabs["addmisp"] = false;
-            this.tabs["instances"] = true;
-        }
     }
 }
-
-
-
 </script>
diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index dcd92f0..e5d0664 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -20,12 +20,9 @@ def add_instance():
     """
     data = json.loads(request.data)
     instance = data["data"]["instance"]
-
-    res = MISP.add_instance(instance["name"], instance["url"],
-                   instance["key"], instance["ssl"])
+    res = misp.add_instance(instance)
     return jsonify(res)
 
-
 @misp_bp.route('/delete/<misp_id>', methods=['GET'])
 @require_header_token
 def delete_instance(misp_id):
@@ -33,16 +30,16 @@ def delete_instance(misp_id):
         Delete a MISP instance by its id to the database.
         :return: status of the operation in JSON
     """
-    res = MISP.delete_instance(misp_id)
+    res = misp.delete_instance(misp_id)
     return jsonify(res)
 
 
 @misp_bp.route('/get_all', methods=['GET'])
-# @require_header_token
+@require_header_token
 def get_all():
     """
         Retreive a list of all MISP instances.
         :return: list of MISP instances in JSON.
     """
-    res = MISP().get_instances()
+    res = misp.get_instances()
     return jsonify({"results": [i for i in res]})
diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 2bfbc62..0296da5 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -17,12 +17,17 @@ class MISP(object):
     def __init__(self):
         return None
 
-    def add_instance(self, name, url, apikey, verify):
+    def add_instance(self, instance):
         """
             Parse and add a MISP instance to the database.
             :return: status of the operation in JSON
         """
 
+        url = instance["url"]
+        name = instance["name"]
+        apikey = instance["key"]
+        verify = instance["ssl"]
+
         sameinstances = db.session.query(MISPInst).filter(
             MISPInst.url == url, MISPInst.apikey == apikey)
         if sameinstances.count():

From 8e09d4e1c8cc10ff03e712a50b2edf5bbb853520 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Thu, 10 Jun 2021 18:37:40 +0200
Subject: [PATCH 10/19] More code modification regarding MISP integration

---
 app/backend/src/views/iocs-misp.vue   |  4 ++--
 assets/scheme.sql                     |  1 +
 server/backend/app/blueprints/misp.py |  3 +--
 server/backend/app/classes/misp.py    | 29 ++++++++++++++++++---------
 server/backend/app/db/models.py       |  3 ++-
 server/backend/watchers.py            |  1 +
 6 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/app/backend/src/views/iocs-misp.vue b/app/backend/src/views/iocs-misp.vue
index a619f1f..a0941fd 100644
--- a/app/backend/src/views/iocs-misp.vue
+++ b/app/backend/src/views/iocs-misp.vue
@@ -1,6 +1,6 @@
 <template>
     <div class="backend-content" id="content">
-        <div class="column col-6 col-xs-12">
+        <div class="column col-8 col-xs-12">
             <h3 class="s-title">Manage MISP instances</h3>
             <ul class="tab tab-block">
                 <li class="tab-item">
@@ -17,7 +17,7 @@
                     <label class="misp-label">Instance URL</label><span></span>
                     <input class="form-input" type="text" ref="misp_url" placeholder="https://misp.cyberacme.com" v-model="mispinst.url" required>
                     <label class="misp-label">Authentication key</label><span></span>
-                    <input class="form-input" type="text" ref="misp_key" placeholder="OqHSMyAuth3ntic4t10nK3y3iiH" v-model="mispinst.key" required>
+                    <input class="form-input" type="text" ref="misp_key" placeholder="OqHSMyAuth3ntic4t10nK3y0MyAuth3ntic4t10nK3y3iiH" v-model="mispinst.key" required>
                     <label class="misp-label">Verify certificate? </label><span></span>
                     <div style="flex:50%"><label class="form-switch">
                     <input type="checkbox" @change="switch_config('frontend', 'kiosk_mode')" v-model="mispinst.ssl">
diff --git a/assets/scheme.sql b/assets/scheme.sql
index d51bdd9..a689cb6 100644
--- a/assets/scheme.sql
+++ b/assets/scheme.sql
@@ -25,5 +25,6 @@ CREATE TABLE "misp" (
 	"apikey"	TEXT NOT NULL,
 	"verifycert" INTEGER NOT NULL DEFAULT 0,
 	"added_on" NUMERIC NOT NULL,
+	"last_sync" NUMERIC NOT NULL DEFAULT 0,
 	PRIMARY KEY("id" AUTOINCREMENT)
 );
diff --git a/server/backend/app/blueprints/misp.py b/server/backend/app/blueprints/misp.py
index e5d0664..1843c1b 100644
--- a/server/backend/app/blueprints/misp.py
+++ b/server/backend/app/blueprints/misp.py
@@ -19,8 +19,7 @@ def add_instance():
         :return: status of the operation in JSON
     """
     data = json.loads(request.data)
-    instance = data["data"]["instance"]
-    res = misp.add_instance(instance)
+    res = misp.add_instance(data["data"]["instance"])
     return jsonify(res)
 
 @misp_bp.route('/delete/<misp_id>', methods=['GET'])
diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 0296da5..0835ca8 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -27,6 +27,7 @@ class MISP(object):
         name = instance["name"]
         apikey = instance["key"]
         verify = instance["ssl"]
+        last_sync = int(time.time()-31536000) # One year
 
         sameinstances = db.session.query(MISPInst).filter(
             MISPInst.url == url, MISPInst.apikey == apikey)
@@ -36,14 +37,11 @@ class MISP(object):
         if name:
             if self.test_instance(url, apikey, verify):
                 added_on = int(time.time())
-                db.session.add(MISPInst(name, escape(url), apikey, verify, added_on))
+                db.session.add(MISPInst(name, escape(
+                    url), apikey, verify, added_on, last_sync))
                 db.session.commit()
                 return {"status": True,
-                        "message": "MISP instance added",
-                        "name": escape(name),
-                        "url": escape(url),
-                        "apikey": escape(apikey),
-                        "verifycert": escape(verify)}
+                        "message": "MISP instance added"}
             else:
                 return {"status": False,
                         "message": "Please verify the connection to the MISP instance"}
@@ -78,7 +76,8 @@ class MISP(object):
                    "url": misp["url"],
                    "apikey": misp["apikey"],
                    "verifycert": True if misp["verifycert"] else False,
-                   "connected": self.test_instance(misp["url"], misp["apikey"], misp["verifycert"]) }
+                   "connected": self.test_instance(misp["url"], misp["apikey"], misp["verifycert"]),
+                   "lastsync": misp["last_sync"]}
 
     @staticmethod
     def test_instance(url, apikey, verify):
@@ -92,11 +91,23 @@ class MISP(object):
         except:
             return False
 
+    def update_sync(misp_id):
+        """
+            Update the last synchronization date by the actual date.
+            :return: bool, True if updated.
+        """
+        try:
+            misp = MISPInst.query.get(int(misp_id))
+            misp.last_sync = int(time.time())
+            db.session.commit()
+            return True
+        except:
+            return False
+
     @staticmethod
     def get_iocs(misp_id):
         """
             Get all IOCs from specific MISP instance
-            /!\ Todo: NEED TO ADD LAST SYNCHRO DATE + page etc. stuff.
             :return: generator containing the IOCs.
         """
         misp = MISPInst.query.get(int(misp_id))
@@ -105,7 +116,7 @@ class MISP(object):
                 try:
                     # Connect to MISP instance and get network activity attributes.
                     m = PyMISP(misp.url, misp.apikey, misp.verifycert)
-                    r = m.search("attributes", category="Network activity")
+                    r = m.search("attributes", category="Network activity", date_from=misp.lastsync)
                 except:
                     print("Unable to connect to the MISP instance ({}/{}).".format(misp.url, misp.apikey))
                     return []
diff --git a/server/backend/app/db/models.py b/server/backend/app/db/models.py
index cfa33ae..e965caa 100644
--- a/server/backend/app/db/models.py
+++ b/server/backend/app/db/models.py
@@ -20,12 +20,13 @@ class Whitelist(db.Model):
 
 
 class MISPInst(db.Model):
-    def __init__(self, name, url, key, ssl, added_on):
+    def __init__(self, name, url, key, ssl, added_on, last_sync):
         self.name = name
         self.url = url
         self.apikey = key
         self.verifycert = ssl
         self.added_on = added_on
+        self.last_sync = last_sync
 
 
 db.mapper(Whitelist, db.Table('whitelist', db.metadata, autoload=True))
diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index 7a35736..9198e22 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -133,6 +133,7 @@ def watch_misp():
                 instances.pop(i)
         if instances: time.sleep(60)
 
+
 p1 = Process(target=watch_iocs)
 p2 = Process(target=watch_whitelists)
 p3 = Process(target=watch_misp)

From 73946c27e224e264e7a65652d25cd9a13d1d4740 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Thu, 10 Jun 2021 19:00:06 +0200
Subject: [PATCH 11/19] More code modification regarding MISP integration

---
 server/backend/app/classes/misp.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index 0835ca8..b67447d 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -3,8 +3,9 @@
 
 from app import db
 from app.db.models import MISPInst
-from sqlalchemy.sql import exists
 from app.definitions import definitions as defs
+
+from sqlalchemy.sql import exists
 from urllib.parse import unquote
 from flask import escape
 from pymisp import PyMISP
@@ -27,7 +28,7 @@ class MISP(object):
         name = instance["name"]
         apikey = instance["key"]
         verify = instance["ssl"]
-        last_sync = int(time.time()-31536000) # One year
+        last_sync = int(time.time()-31536000)  # One year
 
         sameinstances = db.session.query(MISPInst).filter(
             MISPInst.url == url, MISPInst.apikey == apikey)

From 926daf3e34d606c963532b279e1158b2e8955714 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Thu, 10 Jun 2021 19:48:35 +0200
Subject: [PATCH 12/19] Debug after testing, everything works great now

---
 server/backend/app/classes/misp.py | 3 ++-
 server/backend/watchers.py         | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/server/backend/app/classes/misp.py b/server/backend/app/classes/misp.py
index b67447d..9527efb 100644
--- a/server/backend/app/classes/misp.py
+++ b/server/backend/app/classes/misp.py
@@ -92,6 +92,7 @@ class MISP(object):
         except:
             return False
 
+    @staticmethod
     def update_sync(misp_id):
         """
             Update the last synchronization date by the actual date.
@@ -117,7 +118,7 @@ class MISP(object):
                 try:
                     # Connect to MISP instance and get network activity attributes.
                     m = PyMISP(misp.url, misp.apikey, misp.verifycert)
-                    r = m.search("attributes", category="Network activity", date_from=misp.lastsync)
+                    r = m.search("attributes", category="Network activity", date_from=int(misp.last_sync))
                 except:
                     print("Unable to connect to the MISP instance ({}/{}).".format(misp.url, misp.apikey))
                     return []
diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index 9198e22..ff3b63b 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -130,6 +130,7 @@ def watch_misp():
                 for ioc in misp.get_iocs(inst["id"]):
                     iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
                              ioc["value"], "misp-{}".format(inst["id"]))
+                misp.update_sync(inst["id"])
                 instances.pop(i)
         if instances: time.sleep(60)
 

From 772ff95108f56c98e453d4c6dba5aecf889b4f09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Thu, 10 Jun 2021 20:17:24 +0200
Subject: [PATCH 13/19] Updating the update script

---
 update.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/update.sh b/update.sh
index 9dd6faa..c06ab5a 100644
--- a/update.sh
+++ b/update.sh
@@ -40,6 +40,10 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
     cd /usr/share/tinycheck/app/frontend/ && npm install && npm audit fix && npm run build
     cd /usr/share/tinycheck/app/backend/ && npm install && npm audit fix && npm run build
 
+    echo "[+] Updating the database scheme..."
+    cd /usr/share/tinycheck/
+    sqlite3 tinycheck.sqlite3 < assets/scheme.sql 2>/dev/null
+
     echo "[+] Updating current configuration with new values."
     if ! grep -q reboot_option /usr/share/tinycheck/config.yaml; then
         sed -i 's/frontend:/frontend:\n  reboot_option: true/g' /usr/share/tinycheck/config.yaml
@@ -74,6 +78,9 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
     service tinycheck-frontend restart
     service tinycheck-watchers restart
 
+    echo "[+] Deleting assets folder"
+    rm -rf /usr/share/tinycheck/assets/
+
     echo "[+] Updating the TinyCheck version"
     cd /tmp/tinycheck && git tag | tail -n 1 | xargs echo -n > /usr/share/tinycheck/VERSION
 

From 436870960d1eb5a7f7a1531117f72a853b282bda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Thu, 10 Jun 2021 21:11:41 +0200
Subject: [PATCH 14/19] Correcting error

---
 update.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/update.sh b/update.sh
index c06ab5a..a02f170 100644
--- a/update.sh
+++ b/update.sh
@@ -42,7 +42,7 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
 
     echo "[+] Updating the database scheme..."
     cd /usr/share/tinycheck/
-    sqlite3 tinycheck.sqlite3 < assets/scheme.sql 2>/dev/null
+    sqlite3 tinycheck.sqlite3 < /tmp/tinycheck/assets/scheme.sql 2>/dev/null
 
     echo "[+] Updating current configuration with new values."
     if ! grep -q reboot_option /usr/share/tinycheck/config.yaml; then
@@ -78,9 +78,6 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
     service tinycheck-frontend restart
     service tinycheck-watchers restart
 
-    echo "[+] Deleting assets folder"
-    rm -rf /usr/share/tinycheck/assets/
-
     echo "[+] Updating the TinyCheck version"
     cd /tmp/tinycheck && git tag | tail -n 1 | xargs echo -n > /usr/share/tinycheck/VERSION
 

From cb0742d4407fdbd4dabe1089082e908370c67cfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aim=C3=A9?= <felix.aime@gmail.com>
Date: Fri, 11 Jun 2021 14:10:08 +0200
Subject: [PATCH 15/19] Hiding warnings of watchers.

---
 install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index 4e1d8a1..d76474f 100644
--- a/install.sh
+++ b/install.sh
@@ -441,7 +441,7 @@ change_configs() {
 
 feeding_iocs() {
     echo -e "\e[39m[+] Feeding your TinyCheck instance with fresh IOCs and whitelist, please wait."
-    python3 /usr/share/tinycheck/server/backend/watchers.py
+    python3 /usr/share/tinycheck/server/backend/watchers.py 2>/dev/null
 }
 
 reboot_box() {

From 940d5954a3ec5404174ee6cb9f9709878915ec93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Fri, 11 Jun 2021 14:46:11 +0200
Subject: [PATCH 16/19] Updating MISP watcher

---
 server/backend/watchers.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/server/backend/watchers.py b/server/backend/watchers.py
index ff3b63b..7299eb8 100644
--- a/server/backend/watchers.py
+++ b/server/backend/watchers.py
@@ -125,12 +125,15 @@ def watch_misp():
     instances = [i for i in misp.get_instances()]
 
     while instances:
-        for i, inst in enumerate(instances):
-            if inst["connected"]:
-                for ioc in misp.get_iocs(inst["id"]):
+        for i, ist in enumerate(instances):
+            status = misp.test_instance(ist["url"],
+                                        ist["apikey"],
+                                        ist["verifycert"])
+            if status:
+                for ioc in misp.get_iocs(ist["id"]):
                     iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
-                             ioc["value"], "misp-{}".format(inst["id"]))
-                misp.update_sync(inst["id"])
+                             ioc["value"], "misp-{}".format(ist["id"]))
+                misp.update_sync(ist["id"])
                 instances.pop(i)
         if instances: time.sleep(60)
 

From 601450d9fd611e74bed5d755ff9f14010789cae6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Fri, 11 Jun 2021 15:45:57 +0200
Subject: [PATCH 17/19] Adding last sync tooltip

---
 app/backend/src/App.vue             |  7 ++-----
 app/backend/src/assets/custom.css   | 29 +++++++++++++++++++++++++++--
 app/backend/src/views/iocs-misp.vue |  9 ++++++---
 3 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/app/backend/src/App.vue b/app/backend/src/App.vue
index 1350785..d556d5b 100644
--- a/app/backend/src/App.vue
+++ b/app/backend/src/App.vue
@@ -25,9 +25,6 @@
                 <li class="menu-item">
                   <span @click="$router.push('/device/db')">Manage database</span>
                 </li>
-                <!-- <li class="menu-item">
-                  <span @click="$router.push('/device/user')">User configuration</a>
-                </li> -->
               </ul>
             </div>
           </div>
@@ -40,10 +37,10 @@
                   <span @click="$router.push('/iocs/manage')">Manage IOCs</span>
                 </li>
                 <li class="menu-item">
-                  <span @click="$router.push('/iocs/misp')">MISP Instances</span>
+                  <span @click="$router.push('/iocs/search')">Search IOCs</span>
                 </li>
                 <li class="menu-item">
-                  <span @click="$router.push('/iocs/search')">Search IOCs</span>
+                  <span @click="$router.push('/iocs/misp')">MISP Instances</span>
                 </li>
               </ul>
             </div>
diff --git a/app/backend/src/assets/custom.css b/app/backend/src/assets/custom.css
index 969789b..1231861 100644
--- a/app/backend/src/assets/custom.css
+++ b/app/backend/src/assets/custom.css
@@ -678,8 +678,9 @@ h4, h5 {
 	color: #FFF;
 	font-size: 11px;
 	border-radius: 3px;
-	padding:3px;
+	padding:3px 6px 3px 6px;
 	text-transform: uppercase;
+	cursor: help;
 }
 
 .misp-online {
@@ -687,8 +688,9 @@ h4, h5 {
 	color: #FFF;
 	font-size: 11px;
 	border-radius: 3px;
-	padding:3px;
+	padding:3px 6px 3px 6px;
 	text-transform: uppercase;
+	cursor: help;
 }
 .misp-name {
 	font-size: 1rem;
@@ -752,4 +754,27 @@ h4, h5 {
     margin-left: -.8rem;
     margin-top: -.8rem;
     width: 1.6rem;
+}
+
+.tooltip::after{
+	background:rgba(48,55,66,.95);
+	border-radius:3px;
+	bottom:100%;
+	color:#fff;
+	content:attr(data-tooltip);
+	display:block;
+	font-size: 11px;
+	text-transform: capitalize;
+	left:50%;
+	max-width:320px;
+	opacity:0;
+	overflow:hidden;
+	padding:3px 6px 3px 6px;
+	pointer-events:none;
+	position:absolute;
+	text-overflow:ellipsis;
+	transform:translate(-50%,.4rem);
+	transition:opacity .2s,transform .2s;
+	white-space:pre;
+	z-index:300
 }
\ No newline at end of file
diff --git a/app/backend/src/views/iocs-misp.vue b/app/backend/src/views/iocs-misp.vue
index a0941fd..c0edeb2 100644
--- a/app/backend/src/views/iocs-misp.vue
+++ b/app/backend/src/views/iocs-misp.vue
@@ -54,8 +54,8 @@
                                 <td>{{ i.url.replace('https://', '') .replace('http://', '') }}</td>
                                 <td>{{ i.apikey.slice(0,5) }} [...] {{ i.apikey.slice(35,40) }}</td>
                                 <td>
-                                    <span v-if="i.connected" class="misp-online">✓ Online</span>
-                                    <span v-else class="misp-offline">⚠ Offline</span>
+                                    <span v-if="i.connected" class="misp-online tooltip" :data-tooltip="i.lastsync">✓ Online</span>
+                                    <span v-else class="misp-offline tooltip" :data-tooltip="i.lastsync">⚠ Offline</span>
                                 </td>
                                 <td><button class="btn btn-sm" v-on:click="delete_instance(i)">Delete</button></td>
                             </tr>
@@ -131,7 +131,10 @@ export default {
             this.instances = []
             axios.get(`/api/misp/get_all`, { timeout: 10000, headers: {'X-Token': this.jwt} })
             .then(response => {
-                if(response.data.results) this.instances = response.data.results;
+                if(response.data.results){
+                    this.instances = response.data.results;
+                    this.instances.forEach(e => { e.lastsync = "Last-sync: "+ new Date(e.lastsync * 1000).toDateString() } )
+                }
                 this.loading = false
             })
             .catch(err => (console.log(err)))

From 22315277f3fa64b63997502aaa1cb54b224953b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Fri, 11 Jun 2021 16:27:10 +0200
Subject: [PATCH 18/19] Changing last synchronization value style

---
 app/backend/src/assets/custom.css   | 2 --
 app/backend/src/views/iocs-misp.vue | 9 ++++++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/backend/src/assets/custom.css b/app/backend/src/assets/custom.css
index 1231861..51a7661 100644
--- a/app/backend/src/assets/custom.css
+++ b/app/backend/src/assets/custom.css
@@ -679,7 +679,6 @@ h4, h5 {
 	font-size: 11px;
 	border-radius: 3px;
 	padding:3px 6px 3px 6px;
-	text-transform: uppercase;
 	cursor: help;
 }
 
@@ -689,7 +688,6 @@ h4, h5 {
 	font-size: 11px;
 	border-radius: 3px;
 	padding:3px 6px 3px 6px;
-	text-transform: uppercase;
 	cursor: help;
 }
 .misp-name {
diff --git a/app/backend/src/views/iocs-misp.vue b/app/backend/src/views/iocs-misp.vue
index c0edeb2..4becd1a 100644
--- a/app/backend/src/views/iocs-misp.vue
+++ b/app/backend/src/views/iocs-misp.vue
@@ -54,8 +54,8 @@
                                 <td>{{ i.url.replace('https://', '') .replace('http://', '') }}</td>
                                 <td>{{ i.apikey.slice(0,5) }} [...] {{ i.apikey.slice(35,40) }}</td>
                                 <td>
-                                    <span v-if="i.connected" class="misp-online tooltip" :data-tooltip="i.lastsync">✓ Online</span>
-                                    <span v-else class="misp-offline tooltip" :data-tooltip="i.lastsync">⚠ Offline</span>
+                                    <span v-if="i.connected" class="misp-online tooltip" :data-tooltip="i.lastsync">✓ ONLINE</span>
+                                    <span v-else class="misp-offline tooltip" :data-tooltip="i.lastsync">⚠ OFFLINE</span>
                                 </td>
                                 <td><button class="btn btn-sm" v-on:click="delete_instance(i)">Delete</button></td>
                             </tr>
@@ -133,7 +133,10 @@ export default {
             .then(response => {
                 if(response.data.results){
                     this.instances = response.data.results;
-                    this.instances.forEach(e => { e.lastsync = "Last-sync: "+ new Date(e.lastsync * 1000).toDateString() } )
+                    this.instances.forEach(e => { 
+                        var lastsync = parseInt((Date.now()/1000 - e.lastsync) / 86400)
+                        e.lastsync = (!lastsync)? "Synchronized today" : `Synchronized ${lastsync} day(s) ago`
+                        } )
                 }
                 this.loading = false
             })

From 6f5fd11a26c7e7f20254d9190db03bd4fb88a571 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Aime?= <felix.aime@kaspersky.com>
Date: Fri, 11 Jun 2021 17:15:12 +0200
Subject: [PATCH 19/19] Modifying iocs search to show the source

---
 app/backend/src/assets/custom.css     |  1 -
 app/backend/src/views/iocs-search.vue | 27 ++++++++++++++++++++-------
 server/backend/app/classes/iocs.py    |  3 ++-
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/app/backend/src/assets/custom.css b/app/backend/src/assets/custom.css
index 51a7661..17db9f8 100644
--- a/app/backend/src/assets/custom.css
+++ b/app/backend/src/assets/custom.css
@@ -762,7 +762,6 @@ h4, h5 {
 	content:attr(data-tooltip);
 	display:block;
 	font-size: 11px;
-	text-transform: capitalize;
 	left:50%;
 	max-width:320px;
 	opacity:0;
diff --git a/app/backend/src/views/iocs-search.vue b/app/backend/src/views/iocs-search.vue
index 1390e99..dc633df 100644
--- a/app/backend/src/views/iocs-search.vue
+++ b/app/backend/src/views/iocs-search.vue
@@ -13,27 +13,37 @@
                     <thead>
                         <tr>
                             <th>Indicator</th>
-                            <th>Type</th>
                             <th>Tag</th>
                             <th>TLP</th>
-                            <th> </th>
+                            <th>Source</th>
+                            <th>Action</th>
                         </tr>
                     </thead>
                     <tbody>
                         <tr v-for="r in results" :key="r.tlp">
                             <td>{{ r.value }}</td>
-                            <td class="capi">{{ r.type }}</td>
                             <td class="upper">{{ r.tag }}</td>
                             <td><label :class="['tlp-' + r.tlp]">{{ r.tlp }}</label></td>
+                            <td class="capi">{{ r.source }}</td>
                             <td><button class="btn btn-sm" v-on:click="remove(r)">Delete</button></td>
                         </tr>
                     </tbody>
                 </table>
             </div>
             <div v-else-if="first_search==false">
-                <div class="empty">
-                    <p class="empty-title h5">IOC<span v-if="this.iocs.match(/[^\r\n]+/g).length>1">s</span> not found.</p>
-                    <p class="empty-subtitle">Try wildcard search to expend your search.</p>
+                <div v-if="loading">
+                    <div class="empty">
+                        <p class="empty-title h5">
+                            <span class="loading loading-lg"></span>
+                        </p>
+                        <p class="empty-subtitle">Finding your IOC(s)...</p>
+                    </div>
+                </div>
+                <div v-else>
+                    <div class="empty">
+                        <p class="empty-title h5">IOC<span v-if="this.iocs.match(/[^\r\n]+/g).length>1">s</span> not found.</p>
+                        <p class="empty-subtitle">Try wildcard search to expend your search.</p>
+                    </div>
                 </div>
             </div>
         </div>
@@ -49,7 +59,8 @@ export default {
         return { 
             results: [],
             first_search: true,
-            jwt:""
+            jwt:"",
+            loading:false
         }
     },
     props: { },
@@ -57,6 +68,7 @@ export default {
         search_iocs: function() {
             this.results = []
             this.first_search = false
+            this.loading = true;
             this.iocs.match(/[^\r\n]+/g).forEach(ioc => {
                 ioc = ioc.trim()
                 if("alert " != ioc.slice(0,6)) {
@@ -72,6 +84,7 @@ export default {
                     if(response.data.results.length>0){
                         this.results = [].concat(this.results, response.data.results);
                     }
+                    this.loading = false;
                 })
                 .catch(err => (console.log(err)))
             });
diff --git a/server/backend/app/classes/iocs.py b/server/backend/app/classes/iocs.py
index c2126d4..41c03c6 100644
--- a/server/backend/app/classes/iocs.py
+++ b/server/backend/app/classes/iocs.py
@@ -116,7 +116,8 @@ class IOCs(object):
                    "type": ioc["type"],
                    "tag": ioc["tag"],
                    "tlp": ioc["tlp"],
-                   "value": ioc["value"]}
+                   "value": ioc["value"],
+                   "source": ioc["source"]}
 
     @staticmethod
     def get_types():