misp-modules icon indicating copy to clipboard operation
misp-modules copied to clipboard

Module creating object with previous template version

Open jeremiah-RENISAC opened this issue 3 months ago • 0 comments

I'm trying to make some updates to the greynoise.py enrichment module, and one of the things I've noticed is that, upon enrichment, it creates a greynoise-ip version 1 object in the event. Here's a snippet of the object in the event json:

"Object":[{"id":"251433","name":"greynoise-ip","meta-category":"network","description":"GreyNoise IP Information","template_uuid":"6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9","template_version":"1","event_id":"34","uuid":"3bfb23e9-f608-4c2e-8321-8f3494214feb","timestamp":"1758131476","distribution":"5","sharing_group_id":"0","comment":"8.8.8.8: Enriched via the greynoise2 module"

The MISP instance, however, is a fresh install on the latest build and only has greynoise-ip v2

Name	greynoise-ip
UUID	6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9
Version	2

The object is created and added to the event fine, but if you try and go to edit it, misp returns the following error: Object cannot be edited, no valid template found. Force update anyway

Any advice on why the module is pinning to v1 despite that version having never existed on this instance and how I could approach trying to fix this?

jeremiah-RENISAC avatar Sep 17 '25 18:09 jeremiah-RENISAC