PaloAltoNetworks / minemeld-misp

MineMeld nodes for MISP
Apache License 2.0
18 stars 16 forks source link

Update node.py #26

Open davecabio opened 3 years ago

davecabio commented 3 years ago

Updated node.py to include objects attributes

Description

Currently the plugin doesn't get the attributes included as a Object in MISP. It's enough to change the following line in node.py attributes = event.get('Attribute', [])

with this:

attributes_object = map(lambda x: x['Attribute'], event.get('Object',[]))
attributes_standard = event.get('Attribute', [])
attributes = attributes_standard + attributes_object[0]

And then, mineme-misp will get event the IoC included in the objects list.

Motivation and Context

It's important that minemeld takes all the IoC from MISP.

How Has This Been Tested?

I've installed the plugin in my development environment with a Minemeld and a MISP instance and tested the API request. It works properly and it's in production in my environment.

Types of changes

Checklist

bcampru commented 1 year ago

Hello, I found that there is a little bug with this solution, if the event doesn't have any Object it will crash. To fix it you need to replace the lines proposed by @davecabio with those:

attributes_object = map(lambda x: x['Attribute'], event.get('Object', []))
attributes_standard = event.get('Attribute', [])
if len(attributes_object)>0:
    attributes_object=attributes_object[0]
attributes = attributes_standard + attributes_object