How can I update custom object?

[kovacsbalu]

I can successfully create new object and add some attribute with this:

obj = MISPObject('mycustomobject', misp_objects_path_custom='/app/misp_object')
for key, val in attributes.items():
     obj.add_attribute(key, value=val)
event = MISPEvent()
event.add_object(obj)
self.misp.add_event(event, pythonify=True)

But I need to define attribute type on update. Probably cannot read template for mycustomobject and not prepared with default attributes like Disable Correlation.

event = self.misp.get_event(event_id, pythonify=True)
obj = event.objects[0]
for kk, vv in attributes.items():
    obj.add_attribute(kk, value=vv)
    # obj.add_attribute(kk, type='text', value=vv) # looks better but what if not type=text?
event.add_object(obj)
self.misp.update_event(event)

  File "/usr/local/lib/python3.7/site-packages/pymisp/mispevent.py", line 1246, in add_attribute
    attribute.from_dict(object_relation=object_relation, **dict(self._default_attributes_parameters, **value))
  File "/usr/local/lib/python3.7/site-packages/pymisp/mispevent.py", line 1025, in from_dict
    raise NewAttributeError("The type of the attribute is required. Is the object template missing?")
pymisp.exceptions.NewAttributeError: The type of the attribute is required. Is the object template missing?

Can you please help with this issue? How should I update custom object? All this works perfectly with built-in objects.

[Rafiot]

I'm not sure to understand your question. Does it fails when you pass type='ip-dst' for example? The type needs to be a valid type as understood by MISP.

[kovacsbalu]

No, If I add a correct type it works. The problem is the custom object which is not part of MISP. obj = MISPObject('mycustomobject', misp_objects_path_custom='/app/misp_object') It works fine, when I try the same with build in object like Url. In my case I need to define type for every value. Why not use my custom object definition?

[Rafiot]

The type(s) you're trying to use are known MISP types, or not? If they're not, MISP will reject them.

Can you maybe show me some more sample code, because afaik, all you're telling me is supposed to work so I'm confused.

[kovacsbalu]

MISP should know like object creation, using the misp_objects_path_custom arg, but I cannot set this for my object after get_event. As I checked the source, the real problem is mycustomobject is not real part of MISP, not in misp_objects_path. Yes, I will create a minimal example to show...

[Rafiot]

Ahh, ok, gotcha.

You should create your object like that:

obj = MISPObject(misp_objects_path_custom=<path>)
obj.add_attribute(....)
# ....
misp.add_object(obj)

The alternative is to pass the arg strict=False to MISPObject and it won't try to validate the object (but that means that you need to pass a type to each attribute you add to the object.

[kovacsbalu]

Yes, when I pass type it works. But can I pass my definition.json after object read from event? I really don't want to pass every type for my attributes.

[Rafiot]

Riight, sorry, now I get your point. Let me add a functionality so you can do that.

[Rafiot]

Does it solve your problem: https://github.com/MISP/PyMISP/blob/master/tests/testlive_comprehensive.py#L969

[kovacsbalu]

@Rafiot Looks good. Thank you! :+1:

[Rafiot]

Excellent, closing then.