ibmresilient / resilient-community-apps

Source code for IBM SOAR Apps that are available on our App Exchange
https://ibm.biz/soar-apps-docs
MIT License
88 stars 96 forks source link

Fix create attribute Tag in fn_misp #63

Open grenierd opened 3 years ago

grenierd commented 3 years ago

Description

When I tried to add a tag to an attribute, I got this error :

Traceback (most recent call last): 
File "/opt/app-root/lib/python3.6/site-packages/fn_misp/components/misp_create_tag.py", line 68, in _misp_create_tag_function
tag_result = misp_helper.create_tag(misp_client, misp_attribute_value, misp_tag_type, misp_tag_name, misp_event_id) 
File "/opt/app-root/lib/python3.6/site-packages/fn_misp/lib/misp_3_helper.py", line 123, in create_tag object_uuid = get_attribute_uuid(misp_client, misp_attribute_value, misp_event_id) 
File "/opt/app-root/lib/python3.6/site-packages/fn_misp/lib/misp_3_helper.py", line 106, in get_attribute_uuid if not event_response['Event']['Attribute']: KeyError: 'Event' 

So it seems that the Event is not retrieved correctly in the function get_attribute_uuid. Indeed, the misp_client.get_event function get an event in parameter, which has to be initialized with the uuid. Setting event.id doesn't seems to work at all, so I just changed the event object creation and set the uuid.

Motivation and Context

It seems the function create tag doesn't work at all when the misp_tag_type is "attribute". (ok with "event" type)

How Has This Been Tested?

I tried the patch in a development environment (docker) in python 3. Did not tried to reproduce the bug in python2, but it seems to be likely the same. In that lib, I've also checked the function get_misp_sighting_list which behave the same way, with an event.id. And it works as expected, quite weird from the pymisp client.

Checklist:

Signed-off-by: grenierd