How to ignore case for keyword matching when using misp.search()

[A1oha]

For example, I have the following 2 events：

1. event1 info : APT actor Lazarus was focused on geopolitical agenda
2. event2 info : North Korea-linked lazarus APT group has targeted the defense industry

r = misp.search(eventinfo='%Lazarus%')

When I use the keyword "Lazarus" to match, only event1 can be matched. I want to know how to ignore case and match the above 2 events at the same time.

[Rafiot]

I don't think you can, but I might be wrong (cc @mokaddem @iglocska). The (not amazing) alternative is to search for %azarus%.

[A1oha]

@Rafiot Thank you very much, if it is "Cobalt Strike" & "cobalt strike" and "APT1" & "apt1", how should I describe it? I read the usage of misp.search() in the official documentation, and it seems that there are no parameters can control to ignore case in fuzzy query.

[Rafiot]

No, there are no options for that on PyMISP side because unless I'm mistaken, MISP doesn't support ignoring the case while searching.

[A1oha]

thanks again.

[chrisinmtown]

Is that search string just passed to the database as part of a LIKE query?

[Rafiot]

no, it's not directly passed, but the format is similar.