MISP / MISP/PyMISP

VTReportObject Raising Error if Hash not Previously Seen

Open
#752 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

Hi,
When querying for a VirusTotal Report with the line:

VTReportObject(apikey=vt_apikey, indicator=file_md5)

I have noticed that the if the indicator input (file_md5) has no matches found on VirusTotal, then the line will raise the exception:

pymisp.exceptions.InvalidMISPObject: [this is the file_md5 hash]: The requested resource is not among the finished, queued or pending scans

I am wondering:

  1. Is it possible for the VTReportObject to nevertheless return some kind of report (stating that the indicator has no match on VirusTotal), such that my program does not break at that particular line due to the exception raised.

  2. In the case that the file have nver been scanned by VirusTotal, is there a way to "upload" the file directly (as bytes?) through PyMISP for direct analysis by the vendor analyzers in VirusTotal?

Thanks

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing VTReportObject(apikey=vt_apikey, indicator=file_md5) and the InvalidMISPObject path for indicators with no VirusTotal matches. Review the VirusTotal response handling and determine the expected behavior for an unscanned hash and for uploading file bytes; done means the requested behavior is defined and covered without the current exception breaking the caller.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.