MISP / MISP/PyMISP

Filtering on tags seems broken

Open
#571 3 comments 0 reactions 1 assignee View on GitHub

@iglocska is already working on this.

Since May 7, 2020.

convert to FAQ documentation S: diagnosed T: support
Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

image

image

Clean MISP install (via Docker), screen shot of events above. One with TEST in info and the other TEST as a tag. Tag is listed as exportable, and not hidden.

Using the example feed-generator:

  • filters = {'published':'true'} produces an output of two events, as expected.
  • filters = {'published':'true', 'tag': 'TEST'} per example yields zero events
  • filters = {'published':'true', 'tags': 'TEST'} yields zero events
  • filters = {'published':'true', 'tag': ['TEST']} yields zero events
  • filters = {'published':'true', 'tags': ['TEST']} yields zero events
  • filters = {'published':'true', 'tag': 'TEST|feed-export'} yields zero events
  • filters = {'published':'true', 'tags': 'TEST|feed-export'} yields zero events

What lead me down to test this, in our prod environment, I set: filters = {'published':'true', 'tag': '$keyword'} ([keyword being our internal keyword) and MISP returns an event where that is not tagged but $keyword is in the info section. Testing with tags also yielded the same event.

I thought maybe because keyword was encased in [] in the info section, so I added [TEST] event, and it still didn't return the event like it does in our prod - so I can't quantify why event with $keyword is being returned.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.