MISP / MISP/PyMISP

"The info field of the new event is required." returned when attempting to create a new event

Open
#1,259 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

PyMISP Version: 2.4.165.1
MISP server version: 2.4.190

When creating new events in one instance of MISP that one of our customers is using we are hitting the following error:

Error occured: The info field of the new event is required.

Traceback (most recent call last):

File "/app/debug_app.py", line 28, in run

added = client.add_event(event, pythonify=True)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/usr/local/lib/python3.11/site-packages/pymisp/api.py", line 401, in add_event

e.load(new_event)

File "/usr/local/lib/python3.11/site-packages/pymisp/mispevent.py", line 1720, in load

self.from_dict(**event)

File "/usr/local/lib/python3.11/site-packages/pymisp/mispevent.py", line 1765, in from_dict

raise NewEventError('The info field of the new event is required.')

pymisp.exceptions.NewEventError: The info field of the new event is required.

This error is not reproducible in my development environment using the same PyMISP and MISP server versions.

The code below simulates the issue at the customer site.

Any guidance very much appreciated.


Sample Code

import traceback

from datetime import datetime
from pymisp import ExpandedPyMISP, MISPEvent


def create_pymisp_client() -> ExpandedPyMISP:
  print("Enter MISP server URL:")
  url = input()
  print("Enter MISP API Key:")
  api_key = input()

  return ExpandedPyMISP(url, api_key, ssl=False, debug=True)


def run():
  client = create_pymisp_client()

  event = MISPEvent()
  event.info = "This is a DEBUG Event"
  event.threat_level_id = 3
  event.analysis = 2
  event.distribution = 0
  event.date = datetime.now().strftime("%Y-%m-%d")

  print("Submitting event")
  try:
    added = client.add_event(event, pythonify=True)
    if isinstance(added, MISPEvent):
      print(f"Added event. Event ID: {added.id}")
    else:
      print(f"Error from MISP API: {str(added)}")
  except Exception as ex:
    print(f"Error occured: {str(ex)}")
    print(traceback.format_exc())


if __name__ == "__main__":
  run()

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the sample code and trace client.add_event in pymisp/api.py through MISPEvent.load and from_dict in pymisp/mispevent.py. Compare the working and failing environments to determine why the populated info value is rejected; done means identifying the cause and documenting or correcting the behavior so the sample is handled consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.