From 73882e1ef6f7a15431ca226323aff23c31267b83 Mon Sep 17 00:00:00 2001
From: dhwanis-crest <72184556+dhwanis-crest@users.noreply.github.com>
Date: Wed, 27 Apr 2022 16:30:00 +0530
Subject: [PATCH 1/2] MISP: Bug fix for PAPP-25294 (#6)
* PAPP-25294: Bug fix for MISP app
* Misp: Developer checklist changes
* Misp: Targeting static test failures
* Misp: Targeting static test failures (get event action)
* Added pagination logic in run_query action
* Minor Changes
* Updated result keys
---
.pre-commit-config.yaml | 4 +-
LICENSE | 2 +-
misp.json | 709 +++++++++---------
misp_connector.py | 92 ++-
misp_consts.py | 3 +-
readme.html | 21 +
release_notes/unreleased.md | 1 +
tox.ini | 2 +-
...whl => setuptools-62.1.0-py3-none-any.whl} | Bin 1020564 -> 1144059 bytes
wheels/py3/soupsieve-2.3.1-py3-none-any.whl | Bin 37271 -> 0 bytes
wheels/py3/soupsieve-2.3.2-py3-none-any.whl | Bin 0 -> 37229 bytes
.../typing_extensions-4.0.1-py3-none-any.whl | Bin 22816 -> 0 bytes
.../typing_extensions-4.1.1-py3-none-any.whl | Bin 0 -> 26844 bytes
...linux_2_17_x86_64.manylinux2014_x86_64.whl | Bin 78222 -> 0 bytes
...linux_2_17_x86_64.manylinux2014_x86_64.whl | Bin 0 -> 74877 bytes
...linux_2_17_x86_64.manylinux2014_x86_64.whl | Bin 81354 -> 0 bytes
...linux_2_17_x86_64.manylinux2014_x86_64.whl | Bin 0 -> 77692 bytes
...hl => urllib3-1.26.9-py2.py3-none-any.whl} | Bin 138699 -> 138990 bytes
18 files changed, 441 insertions(+), 393 deletions(-)
rename wheels/py3/{setuptools-60.7.0-py3-none-any.whl => setuptools-62.1.0-py3-none-any.whl} (66%)
delete mode 100644 wheels/py3/soupsieve-2.3.1-py3-none-any.whl
create mode 100644 wheels/py3/soupsieve-2.3.2-py3-none-any.whl
delete mode 100644 wheels/py3/typing_extensions-4.0.1-py3-none-any.whl
create mode 100644 wheels/py3/typing_extensions-4.1.1-py3-none-any.whl
delete mode 100644 wheels/py36/wrapt-1.13.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
create mode 100644 wheels/py36/wrapt-1.14.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
delete mode 100644 wheels/py39/wrapt-1.13.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
create mode 100644 wheels/py39/wrapt-1.14.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl
rename wheels/shared/{urllib3-1.26.8-py2.py3-none-any.whl => urllib3-1.26.9-py2.py3-none-any.whl} (68%)
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 47da14c..6c54162 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,11 @@
repos:
- repo: https://github.com/phantomcyber/dev-cicd-tools
- rev: v1.10
+ rev: v1.12
hooks:
- id: org-hook
- id: package-app-dependencies
- repo: https://github.com/Yelp/detect-secrets
- rev: v1.1.0
+ rev: v1.2.0
hooks:
- id: detect-secrets
args: ['--no-verify', '--exclude-files', '^misp.json$']
diff --git a/LICENSE b/LICENSE
index 6af04d8..9a2c915 100644
--- a/LICENSE
+++ b/LICENSE
@@ -198,4 +198,4 @@
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
- limitations under the License.
\ No newline at end of file
+ limitations under the License.
diff --git a/misp.json b/misp.json
index eadd1dd..0e44549 100644
--- a/misp.json
+++ b/misp.json
@@ -7,12 +7,12 @@
"type": "threat intel",
"license": "Copyright (c) 2017-2022 Splunk Inc.",
"main_module": "misp_connector.py",
- "app_version": "2.1.7",
+ "app_version": "2.2.0",
"utctime_updated": "2022-02-03T21:33:46.000000Z",
"product_vendor": "MISP",
"product_name": "MISP",
"product_version_regex": ".*",
- "min_phantom_version": "5.1.0",
+ "min_phantom_version": "5.2.0",
"fips_compliant": true,
"python_version": "3",
"latest_tested_versions": [
@@ -84,19 +84,19 @@
},
{
"module": "soupsieve",
- "input_file": "wheels/py3/soupsieve-2.3.1-py3-none-any.whl"
+ "input_file": "wheels/py3/soupsieve-2.3.2-py3-none-any.whl"
},
{
"module": "typing_extensions",
- "input_file": "wheels/py3/typing_extensions-4.0.1-py3-none-any.whl"
+ "input_file": "wheels/py3/typing_extensions-4.1.1-py3-none-any.whl"
},
{
"module": "urllib3",
- "input_file": "wheels/shared/urllib3-1.26.8-py2.py3-none-any.whl"
+ "input_file": "wheels/shared/urllib3-1.26.9-py2.py3-none-any.whl"
},
{
"module": "wrapt",
- "input_file": "wheels/py36/wrapt-1.13.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+ "input_file": "wheels/py36/wrapt-1.14.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
},
{
"module": "zipp",
@@ -114,7 +114,6 @@
"verify_server_cert": {
"data_type": "boolean",
"description": "Verify server certificate",
- "required": true,
"order": 1,
"default": false
},
@@ -1042,7 +1041,7 @@
{
"action": "run query",
"description": "Run a query to find events or attributes",
- "verbose": "By setting max_results to 0, you can get every result. It is recommended you do not do this, as MISP can return a lot of data. The default is 10, and this will be the oldest 10 results.
The other field expects a json string, which can have the key value pairs of any field which the search API supports.
The MISP API doesn't support paging, but it is possible to work around this. By giving max results as a negative number, n, it will take the last n results from the query. From there, you can take the timestamp from the first object in the resulting list, then pass it in the other field like so: {\"timestamp\": <timestamp + 1>}. All the results will now be after that specified timestamp.
Also note that when searching for events, events with no attributes will not be returned.",
+ "verbose": "By setting max_results to 0, you can get every result. It is recommended you do not do this, as MISP can return a lot of data. The default is 10, and this will be the oldest 10 results.
The other field expects a json string, which can have the key value pairs of any field which the search API supports.
By giving max results as a negative number, n, it will take the last n results from the query. From there, you can take the timestamp from the first object in the resulting list, then pass it in the other field like so: {\"timestamp\": <timestamp + 1>}. All the results will now be after that specified timestamp.
Also note that when searching for events, events with no attributes will not be returned.",
"type": "investigate",
"identifier": "run_query",
"read_only": true,
@@ -1133,82 +1132,141 @@
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.distribution",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.category",
"data_type": "string",
"example_values": [
- "1"
+ "Network activity"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.id",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.comment",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.deleted",
+ "data_type": "numeric",
"example_values": [
- "2020"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.info",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.disable_correlation",
+ "data_type": "numeric",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.distribution",
"data_type": "string",
"example_values": [
- "Event created by test"
+ "5"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.org_id",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.event_id",
"data_type": "string",
"example_values": [
"1"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.orgc_id",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.first_seen",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.id",
"data_type": "string",
"example_values": [
- "1"
+ "4265"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Event.uuid",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.last_seen",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.object_id",
"data_type": "string",
"example_values": [
- "342c12ab-32ad-41d0-aea2-1c3dccc6ce09"
+ "0"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Object.distribution",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.object_relation",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.sharing_group_id",
"data_type": "string",
"example_values": [
- "5"
+ "0"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Object.id",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.timestamp",
"data_type": "string",
"example_values": [
- "10"
+ "1622191169"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.Object.sharing_group_id",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.to_ids",
+ "data_type": "numeric",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.type",
"data_type": "string",
"example_values": [
- "0"
+ "email-dst"
+ ],
+ "contains": [
+ "url"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.category",
+ "data_path": "action_result.data.*.*.Event.Attribute.*.uuid",
+ "data_type": "string",
+ "example_values": [
+ "03fa856e-b6f9-4e34-82ac-1e50dd058f37"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Attribute.*.value",
+ "data_type": "string",
+ "example_values": [
+ "abc@abc.com"
+ ],
+ "contains": [
+ "url",
+ "domain",
+ "ip",
+ "email",
+ "hash",
+ "md5",
+ "sha256",
+ "md1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.category",
"data_type": "string",
"example_values": [
- "Other",
"Payload delivery"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.comment",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.comment",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.Attribute.*.deleted",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.deleted",
"data_type": "numeric",
"example_values": [
true,
@@ -1216,103 +1274,98 @@
]
},
{
- "data_path": "action_result.data.*.Attribute.*.disable_correlation",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.disable_correlation",
"data_type": "numeric",
"example_values": [
- false,
- true
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.Attribute.*.distribution",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.distribution",
"data_type": "string",
"example_values": [
"5"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.event_id",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.event_id",
"data_type": "string",
"example_values": [
- "1"
- ],
- "contains": [
- "misp event id"
+ "2020"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.first_seen",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.first_seen",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.Attribute.*.id",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.id",
"data_type": "string",
"example_values": [
- "164201"
- ],
- "contains": [
- "misp attribute id"
+ "4953"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.last_seen",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.last_seen",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.Attribute.*.object_id",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.object_id",
"data_type": "string",
"example_values": [
- "0",
"10"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.object_relation",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.object_relation",
"data_type": "string",
"example_values": [
"filename"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.sharing_group_id",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.sharing_group_id",
"data_type": "string",
"example_values": [
"0"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.timestamp",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.timestamp",
"data_type": "string",
"example_values": [
- "1498505296"
+ "1623078296"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.to_ids",
- "data_type": "boolean",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.to_ids",
+ "data_type": "numeric",
"example_values": [
true,
false
]
},
{
- "data_path": "action_result.data.*.Attribute.*.type",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.type",
"data_type": "string",
"example_values": [
- "comment",
"filename"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.uuid",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.uuid",
"data_type": "string",
"example_values": [
- "56e96919-ad18-4f68-8aa1-539002de0b81"
+ "2fd53a9b-44fd-4ebc-af93-0e1605cf3b64"
]
},
{
- "data_path": "action_result.data.*.Attribute.*.value",
+ "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.value",
"data_type": "string",
+ "example_values": [
+ "6.43.3.2"
+ ],
"contains": [
"url",
"domain",
@@ -1322,99 +1375,114 @@
"md5",
"sha256",
"md1"
- ],
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Object.*.comment",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Object.*.deleted",
+ "data_type": "numeric",
"example_values": [
- "email1@gmail.com"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.id",
+ "data_path": "action_result.data.*.*.Event.Object.*.description",
"data_type": "string",
"example_values": [
- "1"
+ "File object describing a file with meta-information"
]
},
{
- "data_path": "action_result.data.*.*.Event.Org.id",
+ "data_path": "action_result.data.*.*.Event.Object.*.distribution",
"data_type": "string",
"example_values": [
- "1"
+ "5"
]
},
{
- "data_path": "action_result.data.*.*.Event.Org.name",
+ "data_path": "action_result.data.*.*.Event.Object.*.event_id",
"data_type": "string",
"example_values": [
- "ORGNAME"
+ "2020"
]
},
{
- "data_path": "action_result.data.*.*.Event.Org.uuid",
+ "data_path": "action_result.data.*.*.Event.Object.*.first_seen",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Object.*.id",
"data_type": "string",
"example_values": [
- "2af87aa3-a713-4ca5-83f7-03ae949c8459"
+ "10"
]
},
{
- "data_path": "action_result.data.*.*.Event.Org.local",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.*.Event.Object.*.last_seen",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.*.Event.Object.*.meta-category",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "file"
]
},
{
- "data_path": "action_result.data.*.*.Event.Orgc.id",
+ "data_path": "action_result.data.*.*.Event.Object.*.name",
"data_type": "string",
"example_values": [
- "1"
+ "file"
]
},
{
- "data_path": "action_result.data.*.*.Event.Orgc.name",
+ "data_path": "action_result.data.*.*.Event.Object.*.sharing_group_id",
"data_type": "string",
"example_values": [
- "ORGNAME"
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Orgc.uuid",
+ "data_path": "action_result.data.*.*.Event.Object.*.template_uuid",
"data_type": "string",
"example_values": [
- "2af87aa3-a713-4ca5-83f7-03ae949c8459"
+ "688c46fb-5edb-40a3-8273-1af7923e2215"
]
},
{
- "data_path": "action_result.data.*.*.Event.Orgc.local",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.*.Event.Object.*.template_version",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "24"
]
},
{
- "data_path": "action_result.data.*.*.Event.date",
+ "data_path": "action_result.data.*.*.Event.Object.*.timestamp",
"data_type": "string",
"example_values": [
- "2021-03-17"
+ "1623078296"
]
},
{
- "data_path": "action_result.data.*.*.Event.info",
+ "data_path": "action_result.data.*.*.Event.Object.*.uuid",
"data_type": "string",
"example_values": [
- "Event created by test"
+ "4b5cb238-9e55-40eb-b60e-b30f71cab6f6"
]
},
{
- "data_path": "action_result.data.*.*.Event.uuid",
+ "data_path": "action_result.data.*.*.Event.Org.id",
"data_type": "string",
"example_values": [
- "15483d56-fc32-4e54-a8b4-e9f56e7818bd"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.locked",
+ "data_path": "action_result.data.*.*.Event.Org.local",
"data_type": "numeric",
"example_values": [
true,
@@ -1422,162 +1490,109 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.org_id",
+ "data_path": "action_result.data.*.*.Event.Org.name",
"data_type": "string",
"example_values": [
- "1"
+ "ORGNAME"
]
},
{
- "data_path": "action_result.data.*.*.Event.orgc_id",
+ "data_path": "action_result.data.*.*.Event.Org.uuid",
"data_type": "string",
"example_values": [
- "1"
+ "2af87aa3-a713-4ca5-83f7-03ae949c8459"
]
},
{
- "data_path": "action_result.data.*.*.Event.analysis",
+ "data_path": "action_result.data.*.*.Event.Orgc.id",
"data_type": "string",
"example_values": [
- "0"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.id",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Orgc.local",
+ "data_type": "numeric",
"example_values": [
- "4265"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.type",
+ "data_path": "action_result.data.*.*.Event.Orgc.name",
"data_type": "string",
"example_values": [
- "email-dst"
- ],
- "contains": [
- "url"
+ "ORGNAME"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.uuid",
+ "data_path": "action_result.data.*.*.Event.Orgc.uuid",
"data_type": "string",
"example_values": [
- "03fa856e-b6f9-4e34-82ac-1e50dd058f37"
+ "2af87aa3-a713-4ca5-83f7-03ae949c8459"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.value",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.id",
"data_type": "string",
"example_values": [
- "abc@abc.com"
- ],
- "contains": [
- "url",
- "domain",
- "ip",
- "email",
- "hash",
- "md5",
- "sha256",
- "md1"
- ]
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.to_ids",
- "data_type": "numeric",
- "example_values": [
- true,
- false
- ]
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.comment",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.deleted",
- "data_type": "numeric",
- "example_values": [
- true,
- false
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.category",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.name",
"data_type": "string",
"example_values": [
- "Network activity"
+ "ORGNAME"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.event_id",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.uuid",
"data_type": "string",
"example_values": [
- "1"
+ "2af87aa3-a713-4ca5-83f7-03ae949c8459"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.last_seen",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.object_id",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.id",
"data_type": "string",
"example_values": [
- "0"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.timestamp",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.name",
"data_type": "string",
"example_values": [
- "1622191169"
+ "ORGNAME"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.first_seen",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.distribution",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.uuid",
"data_type": "string",
"example_values": [
- "5"
+ "2af87aa3-a713-4ca5-83f7-03ae949c8459"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.object_relation",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Attribute.*.sharing_group_id",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.analysis",
"data_type": "string",
"example_values": [
"0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Attribute.*.disable_correlation",
- "data_type": "numeric",
- "example_values": [
- true,
- false
- ]
- },
- {
- "data_path": "action_result.data.*.*.Event.published",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.date",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "2021-06-14"
]
},
{
- "data_path": "action_result.data.*.*.Event.timestamp",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.distribution",
"data_type": "string",
"example_values": [
- "1623657727"
+ "1"
]
},
{
@@ -1588,91 +1603,87 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.id",
- "data_type": "string",
- "example_values": [
- "1"
- ]
- },
- {
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.name",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.info",
"data_type": "string",
"example_values": [
- "ORGNAME"
+ "Event created by test"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Org.uuid",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.org_id",
"data_type": "string",
"example_values": [
- "2af87aa3-a713-4ca5-83f7-03ae949c8459"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.id",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.orgc_id",
"data_type": "string",
"example_values": [
"1"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.name",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.published",
+ "data_type": "numeric",
"example_values": [
- "ORGNAME"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.Orgc.uuid",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.threat_level_id",
"data_type": "string",
"example_values": [
- "2af87aa3-a713-4ca5-83f7-03ae949c8459"
+ "4"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.date",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.timestamp",
"data_type": "string",
"example_values": [
- "2021-06-14"
+ "1623645286"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.info",
+ "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.uuid",
"data_type": "string",
"example_values": [
- "Event created by test"
+ "f346cd43-ef47-4401-b725-a5f4f45a4ed3"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.uuid",
+ "data_path": "action_result.data.*.*.Event.Tag.*.colour",
"data_type": "string",
"example_values": [
- "f346cd43-ef47-4401-b725-a5f4f45a4ed3"
+ "#7ab870"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.org_id",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Tag.*.exportable",
+ "data_type": "numeric",
"example_values": [
- "1"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.orgc_id",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Tag.*.hide_tag",
+ "data_type": "numeric",
"example_values": [
- "1"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.analysis",
+ "data_path": "action_result.data.*.*.Event.Tag.*.id",
"data_type": "string",
"example_values": [
- "0"
+ "8"
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.published",
+ "data_path": "action_result.data.*.*.Event.Tag.*.is_custom_galaxy",
"data_type": "numeric",
"example_values": [
true,
@@ -1680,63 +1691,57 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.timestamp",
- "data_type": "string",
- "example_values": [
- "1623645286"
- ]
- },
- {
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.distribution",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Tag.*.is_galaxy",
+ "data_type": "numeric",
"example_values": [
- "1"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.RelatedEvent.*.Event.threat_level_id",
- "data_type": "string",
+ "data_path": "action_result.data.*.*.Event.Tag.*.local",
+ "data_type": "numeric",
"example_values": [
- "4"
+ 1
]
},
{
- "data_path": "action_result.data.*.*.Event.distribution",
+ "data_path": "action_result.data.*.*.Event.Tag.*.name",
"data_type": "string",
"example_values": [
- "1"
+ "test_1"
]
},
{
- "data_path": "action_result.data.*.*.Event.extends_uuid",
+ "data_path": "action_result.data.*.*.Event.Tag.*.numerical_value",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.*.Event.attribute_count",
+ "data_path": "action_result.data.*.*.Event.Tag.*.user_id",
"data_type": "string",
"example_values": [
- "7"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.threat_level_id",
+ "data_path": "action_result.data.*.*.Event.analysis",
"data_type": "string",
"example_values": [
- "4"
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.sharing_group_id",
+ "data_path": "action_result.data.*.*.Event.attribute_count",
"data_type": "string",
"example_values": [
- "0"
+ "7"
]
},
{
- "data_path": "action_result.data.*.*.Event.publish_timestamp",
+ "data_path": "action_result.data.*.*.Event.date",
"data_type": "string",
"example_values": [
- "0"
+ "2021-03-17"
]
},
{
@@ -1747,6 +1752,13 @@
false
]
},
+ {
+ "data_path": "action_result.data.*.*.Event.distribution",
+ "data_type": "string",
+ "example_values": [
+ "1"
+ ]
+ },
{
"data_path": "action_result.data.*.*.Event.event_creator_email",
"data_type": "string",
@@ -1758,50 +1770,47 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.proposal_email_lock",
- "data_type": "numeric",
- "example_values": [
- true,
- false
- ]
+ "data_path": "action_result.data.*.*.Event.extends_uuid",
+ "data_type": "string"
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.id",
+ "data_path": "action_result.data.*.*.Event.id",
"data_type": "string",
"example_values": [
- "8"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.name",
+ "data_path": "action_result.data.*.*.Event.info",
"data_type": "string",
"example_values": [
- "test_1"
+ "Event created by test"
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.local",
+ "data_path": "action_result.data.*.*.Event.locked",
"data_type": "numeric",
"example_values": [
- 1
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.colour",
+ "data_path": "action_result.data.*.*.Event.org_id",
"data_type": "string",
"example_values": [
- "#7ab870"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.user_id",
+ "data_path": "action_result.data.*.*.Event.orgc_id",
"data_type": "string",
"example_values": [
"1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.hide_tag",
+ "data_path": "action_result.data.*.*.Event.proposal_email_lock",
"data_type": "numeric",
"example_values": [
true,
@@ -1809,15 +1818,14 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.is_galaxy",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.*.Event.publish_timestamp",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.exportable",
+ "data_path": "action_result.data.*.*.Event.published",
"data_type": "numeric",
"example_values": [
true,
@@ -1825,235 +1833,226 @@
]
},
{
- "data_path": "action_result.data.*.*.Event.Tag.*.numerical_value",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Tag.*.is_custom_galaxy",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.*.Event.sharing_group_id",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.id",
+ "data_path": "action_result.data.*.*.Event.threat_level_id",
"data_type": "string",
"example_values": [
- "10"
+ "4"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.name",
+ "data_path": "action_result.data.*.*.Event.timestamp",
"data_type": "string",
"example_values": [
- "file"
+ "1623657727"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.uuid",
+ "data_path": "action_result.data.*.*.Event.uuid",
"data_type": "string",
"example_values": [
- "4b5cb238-9e55-40eb-b60e-b30f71cab6f6"
+ "15483d56-fc32-4e54-a8b4-e9f56e7818bd"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.comment",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Object.*.deleted",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.Attribute.*.Event.distribution",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.event_id",
+ "data_path": "action_result.data.*.Attribute.*.Event.id",
"data_type": "string",
"example_values": [
"2020"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.id",
+ "data_path": "action_result.data.*.Attribute.*.Event.info",
"data_type": "string",
"example_values": [
- "4953"
+ "Event created by test"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.type",
+ "data_path": "action_result.data.*.Attribute.*.Event.org_id",
"data_type": "string",
"example_values": [
- "filename"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.uuid",
+ "data_path": "action_result.data.*.Attribute.*.Event.orgc_id",
"data_type": "string",
"example_values": [
- "2fd53a9b-44fd-4ebc-af93-0e1605cf3b64"
+ "1"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.value",
+ "data_path": "action_result.data.*.Attribute.*.Event.uuid",
"data_type": "string",
"example_values": [
- "6.43.3.2"
- ],
- "contains": [
- "url",
- "domain",
- "ip",
- "email",
- "hash",
- "md5",
- "sha256",
- "md1"
+ "342c12ab-32ad-41d0-aea2-1c3dccc6ce09"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.to_ids",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.Attribute.*.Object.distribution",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "5"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.comment",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.deleted",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.Attribute.*.Object.id",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "10"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.category",
+ "data_path": "action_result.data.*.Attribute.*.Object.sharing_group_id",
"data_type": "string",
"example_values": [
- "Payload delivery"
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.event_id",
+ "data_path": "action_result.data.*.Attribute.*.category",
"data_type": "string",
"example_values": [
- "2020"
+ "Other",
+ "Payload delivery"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.last_seen",
+ "data_path": "action_result.data.*.Attribute.*.comment",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.object_id",
- "data_type": "string",
+ "data_path": "action_result.data.*.Attribute.*.deleted",
+ "data_type": "numeric",
"example_values": [
- "10"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.timestamp",
- "data_type": "string",
+ "data_path": "action_result.data.*.Attribute.*.disable_correlation",
+ "data_type": "numeric",
"example_values": [
- "1623078296"
+ false,
+ true
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.first_seen",
- "data_type": "string"
- },
- {
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.distribution",
+ "data_path": "action_result.data.*.Attribute.*.distribution",
"data_type": "string",
"example_values": [
"5"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.object_relation",
+ "data_path": "action_result.data.*.Attribute.*.event_id",
"data_type": "string",
"example_values": [
- "filename"
+ "1"
+ ],
+ "contains": [
+ "misp event id"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.sharing_group_id",
- "data_type": "string",
- "example_values": [
- "0"
- ]
+ "data_path": "action_result.data.*.Attribute.*.first_seen",
+ "data_type": "string"
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.Attribute.*.disable_correlation",
- "data_type": "numeric",
+ "data_path": "action_result.data.*.Attribute.*.id",
+ "data_type": "string",
"example_values": [
- true,
- false
+ "164201"
+ ],
+ "contains": [
+ "misp attribute id"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.last_seen",
+ "data_path": "action_result.data.*.Attribute.*.last_seen",
"data_type": "string"
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.timestamp",
+ "data_path": "action_result.data.*.Attribute.*.object_id",
"data_type": "string",
"example_values": [
- "1623078296"
+ "0",
+ "10"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.first_seen",
- "data_type": "string"
+ "data_path": "action_result.data.*.Attribute.*.object_relation",
+ "data_type": "string",
+ "example_values": [
+ "filename"
+ ]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.description",
+ "data_path": "action_result.data.*.Attribute.*.sharing_group_id",
"data_type": "string",
"example_values": [
- "File object describing a file with meta-information"
+ "0"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.distribution",
+ "data_path": "action_result.data.*.Attribute.*.timestamp",
"data_type": "string",
"example_values": [
- "5"
+ "1498505296"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.meta-category",
- "data_type": "string",
+ "data_path": "action_result.data.*.Attribute.*.to_ids",
+ "data_type": "boolean",
"example_values": [
- "file"
+ true,
+ false
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.template_uuid",
+ "data_path": "action_result.data.*.Attribute.*.type",
"data_type": "string",
"example_values": [
- "688c46fb-5edb-40a3-8273-1af7923e2215"
+ "comment",
+ "filename"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.sharing_group_id",
+ "data_path": "action_result.data.*.Attribute.*.uuid",
"data_type": "string",
"example_values": [
- "0"
+ "56e96919-ad18-4f68-8aa1-539002de0b81"
]
},
{
- "data_path": "action_result.data.*.*.Event.Object.*.template_version",
+ "data_path": "action_result.data.*.Attribute.*.value",
"data_type": "string",
+ "contains": [
+ "url",
+ "domain",
+ "ip",
+ "email",
+ "hash",
+ "md5",
+ "sha256",
+ "md1"
+ ],
"example_values": [
- "24"
+ "email1@gmail.com"
]
},
{
@@ -2435,7 +2434,7 @@
},
{
"module": "setuptools",
- "input_file": "wheels/py3/setuptools-60.7.0-py3-none-any.whl"
+ "input_file": "wheels/py3/setuptools-62.1.0-py3-none-any.whl"
},
{
"module": "six",
@@ -2443,16 +2442,16 @@
},
{
"module": "soupsieve",
- "input_file": "wheels/py3/soupsieve-2.3.1-py3-none-any.whl"
+ "input_file": "wheels/py3/soupsieve-2.3.2-py3-none-any.whl"
},
{
"module": "urllib3",
- "input_file": "wheels/shared/urllib3-1.26.8-py2.py3-none-any.whl"
+ "input_file": "wheels/shared/urllib3-1.26.9-py2.py3-none-any.whl"
},
{
"module": "wrapt",
- "input_file": "wheels/py39/wrapt-1.13.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+ "input_file": "wheels/py39/wrapt-1.14.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
}
]
}
-}
\ No newline at end of file
+}
diff --git a/misp_connector.py b/misp_connector.py
index 068724a..9a62314 100644
--- a/misp_connector.py
+++ b/misp_connector.py
@@ -59,13 +59,6 @@ def post(self, *args, **kwargs):
requests.Session.post = post
-def slice_list(lst, max_results):
- if max_results > 0:
- return lst[:max_results]
- else:
- return lst[max_results:]
-
-
class RetVal(tuple):
def __new__(cls, val1, val2):
return tuple.__new__(RetVal, (val1, val2))
@@ -108,10 +101,11 @@ def _get_error_message_from_exception(self, e):
:param e: Exception object
:return: error message
"""
- error_msg = MISP_ERR_MESSAGE
- error_code = MISP_ERR_CODE_MESSAGE
+ error_code = None
+ error_msg = MISP_ERR_MSG_UNAVAILABLE
+
try:
- if e.args:
+ if hasattr(e, "args"):
if len(e.args) > 1:
error_code = e.args[0]
error_msg = e.args[1]
@@ -120,7 +114,12 @@ def _get_error_message_from_exception(self, e):
except Exception:
pass
- return "Error Code: {0}. Error Message: {1}".format(error_code, error_msg)
+ if not error_code:
+ error_text = "Error Message: {}".format(error_msg)
+ else:
+ error_text = "Error Code: {}. Error Message: {}".format(error_code, error_msg)
+
+ return error_text
def _validate_ip(self, input_data):
ips = []
@@ -206,7 +205,7 @@ def initialize(self):
patch_requests()
config = self.get_config()
self._verify = config.get("verify_server_cert", False)
- self._misp_url = config.get("base_url")
+ self._misp_url = config.get("base_url").rstrip("/")
api_key = config.get("api_key")
self.save_progress("Creating MISP API session...")
@@ -226,15 +225,16 @@ def initialize(self):
def _test_connectivity(self):
action_result = self.add_action_result(ActionResult())
self.save_progress("Checking connectivity to your MISP instance...")
+ self.debug_print("Checking connectivity to your MISP instance...")
config = self.get_config()
auth = {"Authorization": config.get("api_key")}
ret_val, resp_json = self._make_rest_call('/servers/getPyMISPVersion.json', action_result, headers=auth)
if phantom.is_fail(ret_val):
- self.append_to_message('Test connectivity failed')
- return self.get_status()
+ action_result.append_to_message('Test connectivity failed')
+ return action_result.get_status()
else:
self.save_progress("Test Connectivity Passed")
- return self.set_status(phantom.APP_SUCCESS)
+ return action_result.set_status(phantom.APP_SUCCESS)
def _create_event(self, param):
@@ -504,6 +504,8 @@ def _do_search(self, action_result, **kwargs):
return RetVal(phantom.APP_SUCCESS, resp)
def _run_query(self, param):
+
+ self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
action_result = self.add_action_result(ActionResult(param))
query_dict = {}
controller = param['controller']
@@ -541,7 +543,6 @@ def _run_query(self, param):
query_dict.update(other)
max_results = param.get('max_results', 10)
-
try:
if not float(max_results).is_integer():
return action_result.set_status(phantom.APP_ERROR, MISP_INVALID_INT_ERR.format(msg='', param=MISP_INVALID_MAX_RESULT))
@@ -550,20 +551,44 @@ def _run_query(self, param):
except Exception:
return action_result.set_status(phantom.APP_ERROR, MISP_INVALID_INT_ERR.format(msg='', param=MISP_INVALID_MAX_RESULT))
- ret_val, response = self._do_search(action_result, **query_dict)
-
- if phantom.is_fail(ret_val):
- return action_result.get_status()
-
- if max_results:
- if controller == 'events':
- if response:
- response = slice_list(response, max_results)
- else:
- if response:
- response['Attribute'] = slice_list(response['Attribute'], max_results)
-
- action_result.add_data(response)
+ # pagination
+ response_list = []
+ page = 1
+ records_remaining = max_results
+ query_dict['limit'] = 1000
+ if 0 < max_results < 1000:
+ query_dict['limit'] = max_results
+ while True:
+ query_dict['page'] = page
+ ret_val, response = self._do_search(action_result, **query_dict)
+ if phantom.is_fail(ret_val):
+ return action_result.get_status()
+ page = page + 1
+ if response and controller == 'attributes':
+ response = response.get('Attribute')
+ response_size = len(response)
+ if response_size == 0:
+ break
+ # slice the response in case response size is larger than remaining records (for positive max_results)
+ if max_results > 0 and records_remaining < response_size:
+ response = response[:records_remaining]
+ response_list.extend(response)
+
+ # update the remaining records (for positive max_results)
+ if max_results > 0:
+ records_remaining = records_remaining - response_size
+ if records_remaining <= 0:
+ break
+
+ # slice the result in case of negative max_results value
+ if max_results < 0:
+ response_list = response_list[max_results:]
+
+ if controller == 'attributes':
+ action_result.add_data({"Attribute": response_list})
+ else:
+ action_result.add_data(response_list)
+ self.debug_print("Successfully ran query")
return action_result.set_status(phantom.APP_SUCCESS, "Successfully ran query")
def _download_malware_samples(self, action_result):
@@ -587,7 +612,9 @@ def _download_malware_samples(self, action_result):
return phantom.APP_SUCCESS
- def _get_attachments(self, param):
+ def _get_event(self, param):
+
+ self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, event_id = self._validate_integer(action_result, param.get("event_id"), MISP_INVALID_EVENT_ID)
if phantom.is_fail(ret_val):
@@ -625,6 +652,7 @@ def _get_attachments(self, param):
return action_result.get_status()
action_result.add_data(attachments)
+ self.debug_print("Successfully retrieved attributes")
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved attributes")
def _process_html_response(self, response, action_result):
@@ -732,7 +760,7 @@ def handle_action(self, param):
elif action_id == self.ACTION_ID_RUN_QUERY:
ret_val = self._run_query(param)
elif action_id == self.ACTION_ID_GET_EVENT:
- ret_val = self._get_attachments(param)
+ ret_val = self._get_event(param)
elif action_id == self.ACTION_ID_TEST_ASSET_CONNECTIVITY:
ret_val = self._test_connectivity()
diff --git a/misp_consts.py b/misp_consts.py
index f21388a..409d312 100644
--- a/misp_consts.py
+++ b/misp_consts.py
@@ -15,5 +15,4 @@
MISP_INVALID_INT_ERR = "Please provide a valid {msg} integer value in the {param}"
MISP_INVALID_EVENT_ID = "'event_id' action parameter"
MISP_INVALID_MAX_RESULT = "'max_result' action parameter"
-MISP_ERR_CODE_MESSAGE = "Error code unavailable"
-MISP_ERR_MESSAGE = "Unknown error occurred. Please check the asset configuration and|or action parameters."
+MISP_ERR_MSG_UNAVAILABLE = "Error message unavailable. Please check the asset configuration and|or action parameters"
diff --git a/readme.html b/readme.html
index d046b22..ee4fff9 100644
--- a/readme.html
+++ b/readme.html
@@ -92,3 +92,24 @@
+ The app uses HTTP/HTTPS protocol for communicating with the Misp Server. Below are the default ports used by Splunk SOAR. +
Service Name | +Transport Protocol | +Port | +
---|---|---|
http | +tcp | +80 | +
https | +tcp | +443 | +
?!dcGqfy%xBnlu+q0jS+ae~FmLd6;L^KB4#&Q6B4ka#6ZFR(Q
z&
wRbGUW{i_YgIvb)kd+Lr0gD2tqL~z*EQnEQ`S4yvqsDe^XkzYAK<6k+YU8E
zx8VJ3G51U%aQMBBQKv)g3k(5i8Rt`3@a?St*dfgq7wmFY)`gY-Os-U#Io&55K~M;b
zm0IbjscSi~?1a#bA7r0`vbmA2D!X1fPxA;ku4C^k;rnUaUbYc=KTOBm980J6!jexZ
zUG8YpM3dA1=P>L;tj=R)3HT?^P+ZGgwbT1#`M8=d+|9@4e~u!EQ4nD1%r+aG6{|S6
z5+T(p7#{FaYxa1ysT|&Mp&bSvhC>irrwLPWZ;jU%iCOvQhv)!(%sVh1
zmn^2uay!idhf!oH>3%V!C1=HOm
z@lP6=&7>
jb*}Kynv1E+2ekP@o$nB9B9SeperQ=
zuxL~T-Zs}1Eu=~FH4nX_`Bi6bf@Arod*YB}e8Ne2PWa&DR5ZaK4fxm@{I05%}hR}Tf~
zL93{DmGLhqqHGFlMqFNu@C`j~dROLtVVurUyuK??%_{u6jj&(