No way to search for attributes based on first_seen or last_seen
@Rafiot is already working on this.
Since Jun 30, 2022.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
In order to not break our MISP feeds, we have been updating attributes and editing them with update_attribute when we have new attribute data to provide. Namely, we keep updating last_seen manually. This way, if we have an attribute on a given event that we've seen since June 1, 2021 and we have last seen it on June 28, 2022 in our events (extracted from pcap data and then processed via Bro and then ingested via an ingestion script into a sharing group for indicators for specific malware groups), anyone with a MISP instance can see if a given indicator has been seen 'recently'.
However, when using PyMISP, there is no way to search or filter on the attribute's first_seen or last_seen values.
We know this is supported on the attributes rest client (/attributes/restSearch) with the relevant field and time entry of either exact time or a relative timeperiod (such as '24h' or similar), however this is oddly enough missing from PyMISP's ability to search.
Attempting to bruteforce the argument via last_seen='24h' or similar in the args does nothing, so I have to assume this functionality does not exist or is not implemented in PyMISP.
This seems like an oversight.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.