[Support] PyMISP Attributes returning 0 for sharing_group_id for all attributes on all events, cannot filter attribute results by sharing group ID?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Using PyMISP 2.4.152, interfacing with a MISP server running 2.4.148.
I am trying to interface with a MISP system using PyMISP. This MISP system has my authkey in two sharing groups, with numeric IDs of 4 and 8.
I want to pull all attributes added to all events within the past 7 days, but I want to filter it specifically by sharing group, so that only sharing group 4 gets data pulled. Currently, it doesn't seem like this is possible, and even if I pull all data and try to programmatically determine the sharing group, it's not possible.
What I'm trying to do is get all the attributes added within a given timeframe (7 days) and produce an object for them (JSON) that we can work with. Since I can't add a sharing group filter to the search command, I simply pull all data, and expect the corresponding MISPAttribute items returned to have sharing_group_id populated based on the sharing group from which it was pulled
What I've got so far is:
import datetime
import pymisp
date_to = datetime.datetime.utcnow()
date_from = date_to - datetime.timedelta(days=7)
misp = pymisp.ExtendedPyMISP(...) # ... indicates authenticaiton and URL arguments, trimmed here for privacy)
data = misp.search(controller='attributes', date_from=date_from, date_to=date_to, pythonify=True)
Now, this will return a list of attributes. Unfortunately, when I look into each attribute or its corresponding Event entry, the sharing_group_id which I would expect to be one of the two sharing groups I am a member of - 4 or 8 - there is only the data value of 0, which means I can't actually organize this by sharing group.
I'm not sure if this is a bug in PyMISP or the MISP server, but I thought I'd ask since I can't find any other support locations for PyMISP questions that get a little complex.
Anyone know if this is a bug, or if it's possible to filter the information from a search by the sharing group that the data belongs to?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the ExtendedPyMISP.search(controller='attributes', date_from=..., date_to=..., pythonify=True) call with PyMISP 2.4.152 against the reported MISP 2.4.148 server. Inspect the returned attributes and events to determine whether sharing_group_id is lost in PyMISP or absent from the server response; done means identifying the responsible component and confirming sharing-group filtering or reporting its limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100