MISP / MISP/misp-modules

Module creating object with previous template version

Open
#738 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

misp-related
Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

I'm trying to make some updates to the greynoise.py enrichment module, and one of the things I've noticed is that, upon enrichment, it creates a greynoise-ip version 1 object in the event. Here's a snippet of the object in the event json:

"Object":[{"id":"251433","name":"greynoise-ip","meta-category":"network","description":"GreyNoise IP Information","template_uuid":"6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9","template_version":"1","event_id":"34","uuid":"3bfb23e9-f608-4c2e-8321-8f3494214feb","timestamp":"1758131476","distribution":"5","sharing_group_id":"0","comment":"8.8.8.8: Enriched via the greynoise2 module"

The MISP instance, however, is a fresh install on the latest build and only has greynoise-ip v2

Name	greynoise-ip
UUID	6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9
Version	2

The object is created and added to the event fine, but if you try and go to edit it, misp returns the following error:
Object cannot be edited, no valid template found. Force update anyway

Any advice on why the module is pinning to v1 despite that version having never existed on this instance and how I could approach trying to fix this?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with misp_modules/modules/expansion/greynoise.py and reproduce enrichment using the reported greynoise-ip object. Trace how the module selects the object template version, then verify the generated event object against the instance's greynoise-ip v2 template. Done means enrichment creates an object that MISP can edit without the invalid-template error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.