MISP / MISP/PyMISP

Extend add_object for new server-side feature breakOnDuplicate

Open
#677 19 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

T: enhancement
Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

Extend the add_object() method for the duplicate-detection feature supported by the server. MISP was extended to allow detection of duplicate object-attribute collections - see https://github.com/MISP/MISP/issues/2826 - but today there appears to be no way to invoke that feature from PyMISP.

I'll be glad to propose a change to api.py, but it's not obvious how to pass the parameter that's read here:

https://github.com/MISP/MISP/blob/ca5043a184b8eec53fb4093377fc4a727d4345cf/app/Controller/ObjectsController.php#L224

Here's client code you might use to test the feature:

#!/usr/bin/env python3

import sys
import urllib3
from pymisp import PyMISP, MISPAttribute, MISPEvent, MISPObject
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def add_phishing_obj(misp_client, event):
    """Create an object on an event with a single attribute"""
    obj = MISPObject(name='phishing', strict=True)
    obj.add_attribute(object_relation='url', simple_value='https://simple.tld/')
    response = misp_client.add_object(event.id, obj, pythonify=True)  # *NEED NEW PARAMETER HERE*
    print('added obj on evt: {}'.format(obj.to_json(sort_keys=True, indent=4)))
    return obj

misp_client = PyMISP(url='https://misp:48752', key='keykeykey', ssl=False)
if not misp_client:
    print('PyMISP() failed\n', file=sys.stderr)
    sys.exit(1)

event = MISPEvent()
event.distribution = 0  # internal
event.published = False
event.info = 'Test event for dupes'
event = misp_client.add_event(event, pythonify=True)
print('created event:\n{}'.format(event.to_json(sort_keys=True, indent=4)))

obj1 = add_phishing_obj(misp_client, event)
obj2 = add_phishing_obj(misp_client, event)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in api.py at PyMISP.add_object() and compare its request parameters with the server-side ObjectsController.php reference linked in the issue. Use the provided duplicate-object example to verify that the new option reaches the server and that duplicate detection behaves as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.