Sync Sightings: add sightings discards sighting UUID passed on
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Exported sightings from one MISP and trying to add them to another MISP (basically Sync Sightings), we are able to add the sightings, however it does NOT use the given sighting_uuid. Instead the PyMISP API calls allocates a new sighting UUID. Basically making it as a new sighing instead of sync sighting.
We tried with MISP API calls: misp.add_sighting and attribute.add_sighting
Please advise how can we mimic the Sync Sightings with PyMISP API v 2.4.194
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the PyMISP entry points mentioned in the report, misp.add_sighting and attribute.add_sighting, and trace how the supplied sighting_uuid is handled. Compare that behavior with the Sync Sightings flow; done means adding an exported sighting preserves its original UUID rather than allocating a new one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100