Extend add_object for new server-side feature breakOnDuplicate
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Extend the add_object() method for the duplicate-detection feature supported by the server. MISP was extended to allow detection of duplicate object-attribute collections - see https://github.com/MISP/MISP/issues/2826 - but today there appears to be no way to invoke that feature from PyMISP.
I'll be glad to propose a change to api.py, but it's not obvious how to pass the parameter that's read here:
Here's client code you might use to test the feature:
#!/usr/bin/env python3
import sys
import urllib3
from pymisp import PyMISP, MISPAttribute, MISPEvent, MISPObject
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def add_phishing_obj(misp_client, event):
"""Create an object on an event with a single attribute"""
obj = MISPObject(name='phishing', strict=True)
obj.add_attribute(object_relation='url', simple_value='https://simple.tld/')
response = misp_client.add_object(event.id, obj, pythonify=True) # *NEED NEW PARAMETER HERE*
print('added obj on evt: {}'.format(obj.to_json(sort_keys=True, indent=4)))
return obj
misp_client = PyMISP(url='https://misp:48752', key='keykeykey', ssl=False)
if not misp_client:
print('PyMISP() failed\n', file=sys.stderr)
sys.exit(1)
event = MISPEvent()
event.distribution = 0 # internal
event.published = False
event.info = 'Test event for dupes'
event = misp_client.add_event(event, pythonify=True)
print('created event:\n{}'.format(event.to_json(sort_keys=True, indent=4)))
obj1 = add_phishing_obj(misp_client, event)
obj2 = add_phishing_obj(misp_client, event)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in api.py at PyMISP.add_object() and compare its request parameters with the server-side ObjectsController.php reference linked in the issue. Use the provided duplicate-object example to verify that the new option reaches the server and that duplicate detection behaves as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100