MISP / MISP/misp-modules

Query the csvimport module via REST API mechanism - Error: "Unsupported attributes type"

Open
#604 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

What I am trying to do

I've read from the training material related to MISP modules that we can query a module via REST API.
Based on the example query provided on the github to test the DNS module, I would like to query the csvimport module.

The way i do it
By inspecting csvimport.py handler function source code, i've made up a json payload that look like this:

{
	"data": "",
	"config": {
		"header":",ip-dst,ip-dst|port,,datetime,malware-type",
		"has_header": 0, 
		"special_delimiter": ","
	},

	"file": "/var/www/MISP/ipblocklist.csv",
	"module": "csvimport"
}

I request the csvimport by this command: curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @body7.json -X POST

The problem is that i get stuck into the start of the handler (I don't know what to put in the data field in order to pass the first if else) :

def handler(q=False):
    if q is False:
        return False
    request = json.loads(q)
    if request.get('data'):
        try:
            data = base64.b64decode(request['data']).decode('utf-8')
        except UnicodeDecodeError:
            misperrors['error'] = "Input is not valid UTF-8"
            return misperrors
    else:
        misperrors['error'] = "Unsupported attributes type" <-- Here comes the error 
        return misperrors
        ...

Any Help would be more than welcome
image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with csvimport.py and the linked MISP training material, then compare the module handler with the REST /query example for the DNS module. Determine the expected request data format and document a working csvimport request using the existing body7.json and curl command. Done means the example is clear enough to produce a successful module response.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.