MISP / MISP/misp-objects

Allow an array of possible vocabularies to be used for values_list/sane_default

Open
#157 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

topic:format
Dominant language
Python
Stars
110
Forks
139
Avg merge
12h 28m
Merged PRs (30d)
3

Description

Add an option for vocabularies (from misp-galaxies) to populate an attributes values from if they are present. This would make it far easier to have consistent text values in objects.

Having all an attributes possible values options hard-coded in in MISP objects can make the object structure much longer than it needs to be. Moving these options to vocabularies fits with the current model you have in place while also encouraging the use of more consistently correlate-able object properties.

A good example of where this would work is in the sectors property in the current victim object. If this were implemented as a separate optional values defaults_vocabulary and values_vocabulary which would populate the sane_defaults and values_list arrays with all of the options provided in vocabulary which is specified.

{
"name": "victim"
"description": "Victim object describes the target of an attack or abuse.",
...
"sectors": {
  ...
  "defaults_vocabulary": ["common/sector"] 
  "values_vocabulary": ["common/sector"] 
  ...
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the victim object and the misp-galaxy common/sector vocabulary referenced in the issue, then trace how object properties currently populate sane_defaults and values_list. Done means optional defaults_vocabulary and values_vocabulary entries can populate those arrays from the specified vocabulary while preserving existing object definitions.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.