CrowdStrike
unable to download pdf
MISP version: 2.5.2 Python version: 3.10
When importing reports, the tool successfully creates report entries in MISP, but the associated PDF files are not downloaded into the /var/www/MISP/app/files/ directory. the MISP event attributes contain links pointing to the CS site. The pdf can be viewed on the CS portal but on clicking the event attribute within MISP bring to the below
File '/var/www/MISP/app/files/123456/7891011' does not exist. Error: The requested address '/attributes/download/7891011' was not found on this server.
I have noticed the same thing. The current implementation does not follow the MISP definition for the report object. In the report object the report-file attribute is supposed to be an attachment file, i.e. the actual PDF file. If instead the developers want to document the URL to CS site then they should be using the link attribute.
As a fix I would recommend saving the actual PDF file to the report-file attribute and then separately saving the original URL to the link attribute.
