Module creating object with previous template version
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 377
- Forks
- 280
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 10
Description
I'm trying to make some updates to the greynoise.py enrichment module, and one of the things I've noticed is that, upon enrichment, it creates a greynoise-ip version 1 object in the event. Here's a snippet of the object in the event json:
"Object":[{"id":"251433","name":"greynoise-ip","meta-category":"network","description":"GreyNoise IP Information","template_uuid":"6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9","template_version":"1","event_id":"34","uuid":"3bfb23e9-f608-4c2e-8321-8f3494214feb","timestamp":"1758131476","distribution":"5","sharing_group_id":"0","comment":"8.8.8.8: Enriched via the greynoise2 module"
The MISP instance, however, is a fresh install on the latest build and only has greynoise-ip v2
Name greynoise-ip
UUID 6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9
Version 2
The object is created and added to the event fine, but if you try and go to edit it, misp returns the following error:
Object cannot be edited, no valid template found. Force update anyway
Any advice on why the module is pinning to v1 despite that version having never existed on this instance and how I could approach trying to fix this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with misp_modules/modules/expansion/greynoise.py and reproduce enrichment using the reported greynoise-ip object. Trace how the module selects the object template version, then verify the generated event object against the instance's greynoise-ip v2 template. Done means enrichment creates an object that MISP can edit without the invalid-template error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100