MISP / MISP/PyMISP

Complex Build Query TAG parameter not working

Open
#1,074 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

Hello,

I am using PyMISP to pull data from our MISP instance. In this case I am using a 'search' command with complex query, that contains OR parameters for TAG applied to Events.

Here is a snippet where I perform this search and build the complex query:

tagQuery = misp.build_complex_query(
        or_parameters  = {
            global,
            country,
        },
        and_parameters = None,
        not_parameters = None
        )

    return misp.search("events", event_tags = tagQuery, date_from = LAST_MONTH, includeEventTags=True, published=False)

Last time I ran this was last month and it worked. Today is no longer working, it seems to ALSO pull Events from MISP that do NOT have the specified 'Tags'. I only need the events with specified tags.

Is this an issue with some newer releases? Or am I missing an update?

EDIT:
I have found out that if i replace event_tags with tags in the misp.search it seems to work.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the PyMISP search implementation and the handling of the event_tags and tags parameters. Reproduce the reported complex OR-tag query against a MISP instance, then verify that event_tags returns only events matching the specified tags and add or update coverage for that behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.