How to ignore case for keyword matching when using misp.search()
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
For example, I have the following 2 events：
- event1 info : APT actor Lazarus was focused on geopolitical agenda
- event2 info : North Korea-linked lazarus APT group has targeted the defense industry
r = misp.search(eventinfo='%Lazarus%')
When I use the keyword "Lazarus" to match, only event1 can be matched. I want to know how to ignore case and match the above 2 events at the same time.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking the documented misp.search() interface and its eventinfo parameter, then trace how the PyMISP request is passed to the MISP REST API. Document whether case-insensitive matching is supported and how the two example event strings should be handled; the issue is resolved when a user has an explicit, verified way to perform the search.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100