connectors icon indicating copy to clipboard operation
connectors copied to clipboard

[MISP] hashes are not supported and inserted as `Text`

Open axelfahy opened this issue 2 years ago • 0 comments

Description

The misp connector inserts hashes (MD5, SHA-1, SHA-256) as Text, with a related-to relationships instead of updating the hashes in the existing File.

Environment

  1. OS (where OpenCTI server runs): kubernetes
  2. OpenCTI version: 5.2.4
  3. OpenCTI client: frontend
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Start the MISP connector with the option MISP_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT set to True
  2. Open a File created by MISP.
  3. The hashes are inserted as Text.

Expected Output

Hashes should not be considered unsupported observables and added directly in the hashes of the File.

Actual Output

Hashes inserted as Text, see screenshot:

image

Additional information

Screenshots (optional)

axelfahy avatar Jun 23 '22 10:06 axelfahy