MISP / PyMISP

Python library using the MISP Rest API
Other
442 stars 279 forks source link

Tags returned when searching attributes #1302

Open christianskou07 opened 1 month ago

christianskou07 commented 1 month ago

When searching attributes using search(controller='attributes', ...) it would be a valuable addition to have the option to filter which tags are included in the response. For example, do we want to have both global and local tags included, or only local tags.

In both cases, it might also prove beneficial to have the option to filter tags within each category to reduce the size of the response, e.g., say only local tags are requested, then include only the tag foo in the response.

One could also argue that in some scenarios, a less verbose version of the tags would be meaningful, e.g., include only specific details of each tag, such as its name.

Rafiot commented 1 month ago

PyMISP returns the content provided by MISP, and afaict, there is no way to only return a subset of the tags for specific attributes. Can you open a detailed issue of which features you want in the MISP project, with a reference to this one?

From PyMISP perspective, it makes little sense to strip the response once we get it back from MISP, it is the same as what you would be doing in your own code.

christianskou07 commented 1 month ago

Sure @Rafiot, I agree with you. Obviously, one could easily just process the response to include only what they want.

However, I find the option to at least only return local tags and/or a less verbose version of the tags to be useful, but yes, that definitely belongs in the MISP project to begin with.