Avoiding issues with analyst data objects #1307
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…s on MISP standard format - Adding a note or an opinion will always add the new analyst data object to the list of notes or opinions at the parent data layer level - `from_dict` on a JSON blob is also able to parse properly analyst data and generate flat lists regardless of whether the given data described in the new flat or previously nested format
- Additional checks for parent to support both the standalone and attached analyst data objects - Standalone Analyst data objects with nested notes or opinions are defined with the nesting as they have no parent. When they are added to a parent data layer, the nested objects are then flattened
…ts lists back to the mixin parent class
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Using the different PyMISP helpers to add for instance an Attribute or an Object was causing issues when the given Attribute or Object was containing at least a Note, Opinion or Relationship. This was caused by the presence of the 'Note', 'Opinion' and 'Relationship' fields in every data layer inheriting from
AnalysDataBehaviorMixin(including Notes, Opinions or Relationships themselves)On the other hand, a Note, Opinion or Relationship information extracted from MISP is always contained in a 'Note', 'Opinion' or 'Relationship' fields, respectively.
A note extracted from MISP looks for instance like:
{ "Note": { "uuid": "848337f8-781c-4998-8575-4fa4661b2a90", "object_uuid": "dbb85655-ec62-42b6-b05e-7085ee7af504", "object_type": "Attribute", "authors": "[email protected]", "created": "2024-10-03 14:13:56", "modified": "2024-10-03 14:13:56", "note": "Some random note", "language": "en" } }This makes the test for the presence of such fields mandatory when we want to use our Analyst Data information from MISP to created the equivalent objects in PyMISP.
With this PR, we reconcile both use cases with an additional
containedparameter that is only used with thefrom_dictmethod of each Analyst Data object, set toTruewhen we useadd_note,add_opinionoradd_relationship, in which case the analyst data information is obviously attached to another data layer.This should fix #1306