Filtering on tags seems broken
@iglocska is already working on this.
Since May 7, 2020.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description


Clean MISP install (via Docker), screen shot of events above. One with TEST in info and the other TEST as a tag. Tag is listed as exportable, and not hidden.
Using the example feed-generator:
filters = {'published':'true'}produces an output of two events, as expected.filters = {'published':'true', 'tag': 'TEST'}per example yields zero eventsfilters = {'published':'true', 'tags': 'TEST'}yields zero eventsfilters = {'published':'true', 'tag': ['TEST']}yields zero eventsfilters = {'published':'true', 'tags': ['TEST']}yields zero eventsfilters = {'published':'true', 'tag': 'TEST|feed-export'}yields zero eventsfilters = {'published':'true', 'tags': 'TEST|feed-export'}yields zero events
What lead me down to test this, in our prod environment, I set: filters = {'published':'true', 'tag': '$keyword'} ([keyword being our internal keyword) and MISP returns an event where that is not tagged but $keyword is in the info section. Testing with tags also yielded the same event.
I thought maybe because keyword was encased in [] in the info section, so I added [TEST] event, and it still didn't return the event like it does in our prod - so I can't quantify why event with $keyword is being returned.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.