Open davecabio opened 3 years ago
Hello, I found that there is a little bug with this solution, if the event doesn't have any Object it will crash. To fix it you need to replace the lines proposed by @davecabio with those:
attributes_object = map(lambda x: x['Attribute'], event.get('Object', []))
attributes_standard = event.get('Attribute', [])
if len(attributes_object)>0:
attributes_object=attributes_object[0]
attributes = attributes_standard + attributes_object
Updated node.py to include objects attributes
Description
Currently the plugin doesn't get the attributes included as a Object in MISP. It's enough to change the following line in node.py
attributes = event.get('Attribute', [])
with this:
And then, mineme-misp will get event the IoC included in the objects list.
Motivation and Context
It's important that minemeld takes all the IoC from MISP.
How Has This Been Tested?
I've installed the plugin in my development environment with a Minemeld and a MISP instance and tested the API request. It works properly and it's in production in my environment.
Types of changes
Checklist