MISP to Sentinel Sync Error
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Discussed in https://github.com/MISP/PyMISP/discussions/758
Originally posted by anuashokas June 21, 2021
Could Somebody please help me to sort an issue while syncing data from MISP to Azure sentinel? Some of the threat intelligence data is not picking by MS graph API. Error Logs showing the following error.
"Error": "Target: body - ValidationFailed - Validation of indicator content failed.\nTarget: networkDestinationIPv4 - ValidationFailed - The value 51.158.66.18/32 is not a valid IPv4 address.\nThe value 51.158.66.18/32 is not a valid IPv4 address.",
I think the script method parsing the data that need to modify, but not sure how to do it.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked discussion and the MISP-to-Azure Sentinel sync path, then inspect how data is parsed before the Microsoft Graph API request. Reproduce the reported validation error with the 51.158.66.18/32 indicator; done means the sync handles the indicator in a form accepted by the API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, python
- Domain
- api, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100