MISP / misp-objects

Definition, description and relationship types of MISP objects
https://www.misp-project.org/objects.html
Other
91 stars 118 forks source link

MISP server doesn't add ip related object's attributes to an event. #414

Open vvozzy opened 5 months ago

vvozzy commented 5 months ago

I created my custom object template and placed it both into MISP server directory and PyMISP directory.

{ "attributes": { "fqdn": { "description": "Fully Qualified Domain Name", "misp-attribute": "domain", "ui-priority": 2 }, "tenant": { "description": "Name of an endpoint's owner", "misp-attribute": "text", "ui-priority": 0 }, "endpoint": { "description": "IP address of an endpoint", "misp-attribute": "ip-dst", "ui-priority": 1 }, "time": { "description": "Exact time of an alert", "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 } }, "description": "Alert metadata", "meta-category": "reputation", "name": "alert", "required": [ "fqdn", "tenant", "endpoint", "time" ], "uuid": "e2fbbb13-0723-4b6d-a4f1-00b13689078c", "version": 1 }

Then locally I created the object, added it to previously already created event and added event to MISP server.

misp = PyMISP(misp_url, misp_key, False)

event = MISPEvent()
event.set_date(i_dict['time']) 
event.info = f'DNS reputation: {i_dict['fqdn']}

obj = MISPObject('myobj') 
obj.add_attribute('fqdn', i_dict['fqdn'], type = 'domain')
obj.add_attribute('tenant', i_dict['tenant'], type = 'text') 
obj.add_attribute('endpoint', i_dict['endpoint], type = 'ip-dst') 
obj.add_attribute('time', i_dict['time'], type = 'text')  

event.add_object(obj, pythonify = True)

misp_event = misp.add_event(event, pythonify = True)

On MISP server side all object's attributtes are added to the created event EXCEPT the 'endpoint' with 'ip-dst' type of misp-attribute. I've already tried to change its type to 'text' (which worked) and 'ip-dst|port' (which didn't work).

I also tried to create an object with the default 'domain-ip' template. I added 'ip-dst' attribute to the object. Still, when I added the object to the event and added the event to MISP server there was no 'ip-dst' attribute shown on MISP server.

What could be the problem?