MISP / MISP/PyMISP

Servers hits not included in get_event() response

Open
#871 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

Server feed hits are not present in the JSON response when querying an existing MISP event using get_event(). Server feed hits and regular feed hits appear to be treated the same in the MISP user interface. Example below using test data:

1 is a traditional MISP feed hit
S2:1 is a server feed hit
image

When querying the same event using pymisp get_event(), only the 1 is present anywhere in the response:
(json response is truncated & filtered)

{
    "Event": {
        "id": "1234",
        "orgc_id": "2",
        "org_id": "2",
        "date": "some_date",
        "threat_level_id": "4",
        "info": "some_event_info",
        "published": false,
        "uuid": "some_event_uuid",
        "attribute_count": "14",
        "analysis": "0",
        "timestamp": "some_timestamp",
        "distribution": "0",
        "proposal_email_lock": false,
        "locked": false,
        "publish_timestamp": "0",
        "sharing_group_id": "0",
        "disable_correlation": false,
        "extends_uuid": "",
        "protected": null,
        "Feed": [
            {
                "id": "1",
                "name": "CIRCL OSINT Feed",
                "url": "https://www.circl.lu/doc/misp/feed-osint",
                "provider": "CIRCL",
                "source_format": "misp",
                "event_uuids": [
                    "some_event_uuid"
                ]
            }
        ],
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing get_event() for an existing event containing both a traditional feed hit and a server feed hit, then compare the JSON response with the MISP user interface data shown in the issue. Done means the response includes the server feed hit, such as S2:1, alongside the regular feed hit.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.