MISP / MISP/PyMISP

Bug / Deficiency: get_sharing_group by name does NOT function as intended with "name" searches instead of ID/UUID searches

Open
#1,028 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

The get_sharing_group function in PyMISP objects seems to not function as intended when searching by strings.

In an instance, we have a sharing group that is titled exactly "Tor Nodes Data". The get_sharing_group object suggests that it might be possible to use a sharing group name to get the sharing group by text search as such:

misp.get_sharing_group("Tor Nodes Data")

However, this returns a hard error when passed to the MISP API backend:

Something went wrong (405): {'name': 'Sharing group doesn't exist or you do not have permission to access it.', 'message': 'Sharing group doesn't exist or you do not have permission to access it.', 'url': '/sharing_groups/view/Tor%20Nodes%20Data'}

This suggests that abstract search of this form does not work. If this is not a usable search mechanism, it will not be easy/trivial to get data out from what sharing group(s) a user is part of in order to use it for filtration in a misp.search call later.

The only way I've discovered as a work around to do this would be akin to this:

def get_sharing_group(groupname: str):
    groups = misp.sharing_groups(pythonify=True)
    for group in groups:
        if group.name.lower() == groupname.lower():
            return group
    return None

It seems this type of search functionality should be part of get_sharing_group if we're accepting abstract strings in the code.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the PyMISP get_sharing_group entry point and reproduce the name lookup using the documented "Tor Nodes Data" example. Compare its behavior with sharing_groups(pythonify=True); done means a valid sharing-group name can be resolved as intended and the existing ID/UUID lookups remain usable.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.