[BUG] option pipesplit=true returns an error with mispgetevent or mispfetch

[remg427]

Impacted version: MISP42 4.3.1

Problem

There is a error in code of the cutom command mispgetevent and mispfect and option pipesplit=true to process MISP combined attributes such as domain|ip and return 2 distinct fields (misp_domain and misp_ip in this example).

AttributeError at "/opt/splunk/etc/apps/misp42splunk/bin/mispgetevent.py", line 212 : 'dict' object has no attribute 'deepcopy'

The custom command mispgetioc is not impacted and works as expected with pipesplit=true.

Solution

• upgrade to MISP42 4.3.1.1
• keep option pipesplit unset or set to pipesplit=false and process the field in the SPL

| eval misp_domain=coalesce(misp_domain, mvindex(split(misp_domain_p_ip,"|"),0))
| eval misp_ip=coalesce(misp_ip, mvindex(split(misp_domain_p_ip,"|"),1))