PyMISP
PyMISP copied to clipboard
Servers hits not included in get_event() response
Server feed hits are not present in the JSON response when querying an existing MISP event using get_event(). Server feed hits and regular feed hits appear to be treated the same in the MISP user interface. Example below using test data:
1 is a traditional MISP feed hit
S2:1 is a server feed hit

When querying the same event using pymisp get_event(), only the 1 is present anywhere in the response:
(json response is truncated & filtered)
{
"Event": {
"id": "1234",
"orgc_id": "2",
"org_id": "2",
"date": "some_date",
"threat_level_id": "4",
"info": "some_event_info",
"published": false,
"uuid": "some_event_uuid",
"attribute_count": "14",
"analysis": "0",
"timestamp": "some_timestamp",
"distribution": "0",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "0",
"sharing_group_id": "0",
"disable_correlation": false,
"extends_uuid": "",
"protected": null,
"Feed": [
{
"id": "1",
"name": "CIRCL OSINT Feed",
"url": "https://www.circl.lu/doc/misp/feed-osint",
"provider": "CIRCL",
"source_format": "misp",
"event_uuids": [
"some_event_uuid"
]
}
],
}