PaloAltoNetworks / minemeld-misp

MineMeld nodes for MISP
Apache License 2.0
18 stars 16 forks source link

Generating multiple redis errors on NoneType fields? #13

Open joydragon opened 5 years ago

joydragon commented 5 years ago

I'm using the minemeld-misp Miner, and it works somehow unstable. On the versions, I have the following:

Whenever I try to get the attributes from the events I get some of them, and not all that corresponds to the filters I put, for example I have the following on the configuration of the prototype:

config:
            age_out:
                default: null
                sudden_death: true
                interval: 1800
            attributes:
                confidence: 70
                share_level: red
            filters:
                datefrom: 90d
                published: 1
            indicator_types: null
            source_name: misp.anyEvent
            verify_cert: false
        description: Miner for MISP. This will extract any event and mark them as
            share level red
        development_status: EXPERIMENTAL
        indicator_types:
        - any
        node_type: miner
        tags:
        - extension
        - misp

But when I try to check the actual attributes that come with the Miner there are a lot missing, mainly the hashes that are stored in MISP.

And then, when I try to check the engine logs to see if there's anything weird I see a lot errors like this:

redis.filtered_update ERROR: scoring_attribute is not int: <type 'NoneType'>

How can I debug better the actual data that's being retrieved by the Miner? And what's that redis error all about?

Thanks in advance

joydragon commented 5 years ago

An update. There seems to be 2 problems in 1 on the previous post. I'm testing with PyMISP directly, and I guess the problem is with the fetching the last X days of attributes, because the attributes that area inside an object are not fetched. That's weird, I'll have to make some modifications to some part of the chain. The other error with the scoring_attribute I haven't got any new insights.