MISP / PyMISP

Python library using the MISP Rest API
Other
442 stars 278 forks source link

Bug / Deficiency: get_sharing_group by name does NOT function as intended with "name" searches instead of ID/UUID searches #1028

Open teward opened 1 year ago

teward commented 1 year ago

The get_sharing_group function in PyMISP objects seems to not function as intended when searching by strings.

In an instance, we have a sharing group that is titled exactly "Tor Nodes Data". The get_sharing_group object suggests that it might be possible to use a sharing group name to get the sharing group by text search as such:

misp.get_sharing_group("Tor Nodes Data")

However, this returns a hard error when passed to the MISP API backend:

Something went wrong (405): {'name': 'Sharing group doesn't exist or you do not have permission to access it.', 'message': 'Sharing group doesn't exist or you do not have permission to access it.', 'url': '/sharing_groups/view/Tor%20Nodes%20Data'}

This suggests that abstract search of this form does not work. If this is not a usable search mechanism, it will not be easy/trivial to get data out from what sharing group(s) a user is part of in order to use it for filtration in a misp.search call later.

The only way I've discovered as a work around to do this would be akin to this:

def get_sharing_group(groupname: str):
    groups = misp.sharing_groups(pythonify=True)
    for group in groups:
        if group.name.lower() == groupname.lower():
            return group
    return None

It seems this type of search functionality should be part of get_sharing_group if we're accepting abstract strings in the code.

Rafiot commented 1 year ago

This method is expecting the ID of the sharing group. It is possible to have multiple sharing groups with the same name on a MISP instance, so searching like that will require to either optionally return a list, or ignore any group after we found one, causing even more inconsistency.

If you know the group you're looking for (by ID), you can use the get_sharing_group method.