search

remg427 / misp42splunk

A Splunk app to use MISP in background
GNU Lesser General Public License v3.0
109 stars 30 forks source link

Hash Query Error (MISP Tag) Version 4.4.0 #272

Open bigjohnmax opened 6 days ago

bigjohnmax commented 6 days ago

Each time I try running a hash query, I run into this error.

KeyError at "/opt/splunk/etc/apps/misp42splunk/bin/mispgetioc.py", line 696 : 'misp_tag'

Queries with this error:

| mispgetioc last=10d limit=0 misp_instance=default_misp type="md5" | mispgetioc last=10d limit=0 misp_instance=default_misp type="sha1" | mispgetioc last=10d limit=0 misp_instance=default_misp type="sha256"

remg427 commented 6 days ago

Hi

Thank you for reporting could you try with parameter geteventtag=true just to confirm the bug

bigjohnmax commented 6 days ago

The search is functioning properly with the specified parameter.

In this case, should the geteventtag=true command be added to the searches?

Apologies if my texts aren't very well put together; I struggle with English and use translators to communicate.

Thanks for your time and hard work on this app.

remg427 commented 2 hours ago

Hi, there is bug in the python code but by forcing getting event tags, it is mitigated. I will release a new minor version to fix it. thank you for reporting the bug; it helps me