search

MISP / PyMISP

Python library using the MISP Rest API
Other
438 stars 278 forks source link

Object dropped due to validation for Event #1209

Open dimitrion4a opened 5 months ago

dimitrion4a commented 5 months ago

I want to attach an object to an event using PyMISP 2.4.190 but I receive validation error:

Object dropped due to validation for Event 31 failed: -

Validation errors: {"meta-category":["stringNotEmpty"],"template_uuid":["Please provide a valid RFC 4122 UUID"]} Full Object: {"Object":{"name":"-","uuid":"866ff515-3ef9-4490-8599-306e305c61e7","Attribute":[{"uuid":"bde395c9-e67c-4697-b607-5645164782b9","object_relation":"md5","value":"14953f96f1bf142e3b6880dbd792f5de","type":"md5","disable_correlation":false,"to_ids":true,"category":"Payload delivery","AttributeTag":[]},{"uuid":"07b1570e-3885-4323-aa08-502e619f3ac4","object_relation":"sha1","value":"300a1d96c258fabac6c1afc64f9250b0d7ca72de","type":"sha1","disable_correlation":false,"to_ids":true,"category":"Payload delivery","AttributeTag":[]},{"uuid":"52af634f-839f-431d-853c-5a3518a1b9e6","object_relation":"sha256","value":"f49fece1d0547d2a66fc316bbbf3d0bdc48afafc053583c30de9ba77327264cc","type":"sha256","disable_correlation":false,"to_ids":true,"category":"Payload delivery","AttributeTag":[]},{"uuid":"798feee6-e3ba-4bce-adc8-89a0765aab5b","object_relation":"size-in-bytes","value":"104","type":"size-in-bytes","disable_correlation":false,"to_ids":false,"category":"Other","AttributeTag":[]}],"distribution":"5","sharing_group_id":"0","event_id":"31"}}

adulau commented 5 months ago

Could you share the script?

dimitrion4a commented 5 months ago

I solved the issue by creating the object with : misp_object=pymisp.MISPObject('file')

In the documentation it says : class pymisp.MISPObject(name, ....) I assumed that "name" is the name of the object (regardless of name) - like filename for example. It appears that it actually represents the object type.

Rafiot commented 5 months ago

It's not picking the template, but I cannot tell you more than that without more details.

Look at https://github.com/MISP/PyMISP/blob/main/docs/tutorial/FullOverview.ipynb -> Full example for a working example.