search

MISP / MISP-maltego

Set of Maltego transforms to inferface with a MISP Threat Sharing instance, and also to explore the whole MITRE ATT&CK dataset.
GNU Affero General Public License v3.0
168 stars 46 forks source link

Stack trace when Event To Attributes - template has no template_uuid #32

Open cvandeplas opened 4 years ago

cvandeplas commented 4 years ago

It seems that in some use-cases the MISP Object does not have a template_uuid .

Is this a bug on MISP-maltego or on MISP? 

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/canari/maltego/runner.py", line 130, in local_transform_runner
    config
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/eventtoattributes.py", line 109, in do_transform
    self.gen_response_objects()
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/eventtoattributes.py", line 79, in gen_response_objects
    self.response += self.conn.object_to_entity(o)
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/common/util.py", line 106, in object_to_entity
    o_template = self.misp.get_object_template(o['template_uuid'])
  File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 396, in get_object_template
    object_template_id = get_uuid_or_id_from_abstract_misp(object_template)
  File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 54, in get_uuid_or_id_from_abstract_misp
    if 'uuid' in obj:
TypeError: argument of type 'NoneType' is not iterable (from entity "12786")
Transform Event To Attributes returned with an error: Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/canari/maltego/runner.py", line 130, in local_transform_runner
    config
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/eventtoattributes.py", line 109, in do_transform
    self.gen_response_objects()
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/eventtoattributes.py", line 79, in gen_response_objects
    self.response += self.conn.object_to_entity(o)
  File "/usr/local/lib/python3.6/dist-packages/MISP_maltego/transforms/common/util.py", line 106, in object_to_entity
    o_template = self.misp.get_object_template(o['template_uuid'])
  File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 396, in get_object_template
    object_template_id = get_uuid_or_id_from_abstract_misp(object_template)
  File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 54, in get_uuid_or_id_from_abstract_misp
    if 'uuid' in obj:
TypeError: argument of type 'NoneType' is not iterable (from entity "12786")
Rafiot commented 4 years ago

it is definitely unexpected from PyMISP side, self.misp.get_object_template(o['template_uuid']) doesn't expect None there.

I'm not sure how you can get to the point where an object you get from MISP doesn't have a template_uuid. Could the object it fails on be self defined and the instance you get it from doesn't have the template?

cvandeplas commented 4 years ago

Thanks for the feedback ! I don't know yet, waiting for the MISP json file from the user.

cvandeplas commented 4 years ago

The uuid is missing from the template. It seems to be a locally made template. This indicates a bug in MISP that it loads templates that have no UUID.

Rafiot commented 4 years ago

Either that, or when you export the event from MISP, as it is not tied to a known template, it cannot fill the field. If that's the case, it should not create the key, and initialize with None. Calling o['template_uuid'] should fail with a key error.