MISP / MISP/PyMISP

[Support] PyMISP Attributes returning 0 for sharing_group_id for all attributes on all events, cannot filter attribute results by sharing group ID?

Open
#829 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

Using PyMISP 2.4.152, interfacing with a MISP server running 2.4.148.

I am trying to interface with a MISP system using PyMISP. This MISP system has my authkey in two sharing groups, with numeric IDs of 4 and 8.

I want to pull all attributes added to all events within the past 7 days, but I want to filter it specifically by sharing group, so that only sharing group 4 gets data pulled. Currently, it doesn't seem like this is possible, and even if I pull all data and try to programmatically determine the sharing group, it's not possible.

What I'm trying to do is get all the attributes added within a given timeframe (7 days) and produce an object for them (JSON) that we can work with. Since I can't add a sharing group filter to the search command, I simply pull all data, and expect the corresponding MISPAttribute items returned to have sharing_group_id populated based on the sharing group from which it was pulled

What I've got so far is:

import datetime
import pymisp

date_to = datetime.datetime.utcnow()
date_from = date_to - datetime.timedelta(days=7)

misp = pymisp.ExtendedPyMISP(...)  # ... indicates authenticaiton and URL arguments, trimmed here for privacy)
data = misp.search(controller='attributes', date_from=date_from, date_to=date_to, pythonify=True)

Now, this will return a list of attributes. Unfortunately, when I look into each attribute or its corresponding Event entry, the sharing_group_id which I would expect to be one of the two sharing groups I am a member of - 4 or 8 - there is only the data value of 0, which means I can't actually organize this by sharing group.

I'm not sure if this is a bug in PyMISP or the MISP server, but I thought I'd ask since I can't find any other support locations for PyMISP questions that get a little complex.

Anyone know if this is a bug, or if it's possible to filter the information from a search by the sharing group that the data belongs to?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the ExtendedPyMISP.search(controller='attributes', date_from=..., date_to=..., pythonify=True) call with PyMISP 2.4.152 against the reported MISP 2.4.148 server. Inspect the returned attributes and events to determine whether sharing_group_id is lost in PyMISP or absent from the server response; done means identifying the responsible component and confirming sharing-group filtering or reporting its limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.