Vince147
commented
6 years ago The problem was discovered. There was a missing field in the server config file:
/var/www/MISP/app/Config/config.php
It seem like the MISP server is not adding that key by default.
Plugin.Import_my_module_import_enabled => true
By manually add it, its now working and i can see the module in Populate from menu.
I recommend that someone fix that issue in the MISP project because it not related to the MISP modules server.
iglocska
Work environment
Description
Inside an event, the "Populate from" menu is not displaying an import module. The misp-module server is running properly without any error message, the import module feature is activated from server settings, the related module config was entered in import module settings, the module is working and is sending the results only when using CURL.
Here is the steps I've accomplished so far to build the plugin and test it before writing this.
I downloaded a ZIP file of the MISP Modules project and deployed it in /usr/local/src/
I created an import module and place it at: /usr/local/src/misp-modules/misp-modules/modules/import_mod/my_module.py
I added "my_module" in the array of strings inside the init file of import modules /usr/local/src/misp-modules/misp-modules/modules/import_mod/init.py
Builted the modules from the directory /usr/local/src/misp-modules/
Changed the permission on all the import module Python file to the same level as the original MISP module files.
Started the MISP-modules server
I activated the import module and added my module configuration in the Server settings > Plugging settings
Tested the module with a curl command and that worked flawlessly. curl http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @body.json -X POST | jq .
I created an event and the "Populate from" is not showing the module...
Comment
The MISP server and the MISP module server are on the same host.
When I navigate in MISP, I can see (with the output of the misp-modules -d running) the requests made from the MISP server to the module server when I open an event webpage / when I navigate on the server settings page.
Also good to mention that the MISP server is located on a host that is not connected to the internet. All the modules were installed offline to the latest version available on Python3.
If someone have been in that situation, please let me know. I already consulted issues similar but not exactly the same. Thanks for your help.