"The info field of the new event is required." returned when attempting to create a new event

[adamlevymandiant]

PyMISP Version: 2.4.165.1 MISP server version: 2.4.190

When creating new events in one instance of MISP that one of our customers is using we are hitting the following error:

Error occured: The info field of the new event is required.

Traceback (most recent call last):

File "/app/debug_app.py", line 28, in run

added = client.add_event(event, pythonify=True)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/usr/local/lib/python3.11/site-packages/pymisp/api.py", line 401, in add_event

e.load(new_event)

File "/usr/local/lib/python3.11/site-packages/pymisp/mispevent.py", line 1720, in load

self.from_dict(**event)

File "/usr/local/lib/python3.11/site-packages/pymisp/mispevent.py", line 1765, in from_dict

raise NewEventError('The info field of the new event is required.')

pymisp.exceptions.NewEventError: The info field of the new event is required.

This error is not reproducible in my development environment using the same PyMISP and MISP server versions.

The code below simulates the issue at the customer site.

Any guidance very much appreciated.

---

Sample Code

import traceback

from datetime import datetime
from pymisp import ExpandedPyMISP, MISPEvent


def create_pymisp_client() -> ExpandedPyMISP:
  print("Enter MISP server URL:")
  url = input()
  print("Enter MISP API Key:")
  api_key = input()

  return ExpandedPyMISP(url, api_key, ssl=False, debug=True)


def run():
  client = create_pymisp_client()

  event = MISPEvent()
  event.info = "This is a DEBUG Event"
  event.threat_level_id = 3
  event.analysis = 2
  event.distribution = 0
  event.date = datetime.now().strftime("%Y-%m-%d")

  print("Submitting event")
  try:
    added = client.add_event(event, pythonify=True)
    if isinstance(added, MISPEvent):
      print(f"Added event. Event ID: {added.id}")
    else:
      print(f"Error from MISP API: {str(added)}")
  except Exception as ex:
    print(f"Error occured: {str(ex)}")
    print(traceback.format_exc())


if __name__ == "__main__":
  run()

[Rafiot]

This version of PyMISP is way way outdated, please use a newer one.

Besides that, if I understand correctly, the sample code above works for you but somehow fails on your customer infrastructure but you cannot reproduce it on your test environment that uses the same version of MISP as the one failing at your customer?

AFAICT, the code above works fine, so I'm not sure what else I can do.

[CythSOC]

@adamlevymandiant @Rafiot

We were having this exact same issue (on version 2.4.198) before we happened to change our MISP API URL configuration from "http://" to the "https://" equivalent, and no longer get the "The info field of the new event is required." error

[Rafiot]

there will be another error somewhere, I bet, because I have no idea how else that could have changed.

Please share the code you're using if you want more details.