search

MISP / MISP-STIX-Converter

A utility repo to assist with converting between MISP and STIX formats
GNU Lesser General Public License v3.0
64 stars 31 forks source link

Fix for "AttributeError: can't set attribute" #29

Closed davidonzo closed 6 years ago

davidonzo commented 6 years ago

In the latest VM version availables (ccb3118940f9fcdf356126bed4370f3e7b5900a2) STIX import does not work. Maybe caused by a change in another library (from pymisp import mispevent).

The error reported

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/misp_modules/__init__.py", line 197, in post
    response = yield tornado.gen.with_timeout(timeout, self.run_request(jsonpayload))
  File "/usr/local/lib/python3.6/dist-packages/tornado/gen.py", line 1055, in run
    value = future.result()
  File "/usr/local/lib/python3.6/dist-packages/tornado/concurrent.py", line 238, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "/usr/lib/python3.6/concurrent/futures/thread.py", line 56, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.6/dist-packages/misp_modules/__init__.py", line 185, in run_request
    response = mhandlers[x['module']].handler(q=jsonpayload)
  File "modules/import_mod/stiximport.py", line 35, in handler
    pkg = stix.load_stix(package)
  File "/usr/local/lib/python3.6/dist-packages/pymisp/tools/stix.py", line 18, in load_stix
    threat_level_id=threat_level_id, analysis=analysis)
  File "/usr/local/lib/python3.6/dist-packages/misp_stix_converter/converters/buildMISPAttribute.py", line 273, in buildEvent
    event.attributes = uniqueAttributes
AttributeError: can't set attribute
coveralls commented 6 years ago

Coverage Status

Coverage decreased (-0.7%) to 46.697% when pulling 1f28cf82cb44acd6758f90cf93d1785dd3cd7dd4 on davidonzo:master into 8ebdb3d406068d15351cd65eb1b543488b2eed63 on MISP:master.

Rafiot commented 6 years ago

Yes, it is caused by a change in MISPEvent. I'll fix it over there because it makes more sense.

Rafiot commented 6 years ago

That one should fix it: https://github.com/MISP/PyMISP/commit/749acd70b5ff00f2f74809b51cfb6db66b9543df

Can you check?

Rafiot commented 6 years ago

All things considered, your approach is better for this specific usecase. Merging.

davidonzo commented 6 years ago

If you want I'm able to test the using your latest PyMISP. Just let me know.

And thanks for the fix, of course.

Rafiot commented 6 years ago

It's all good, thank you :)