connectors
connectors copied to clipboard
[MISP] hashes are not supported and inserted as `Text`
Description
The misp connector inserts hashes (MD5, SHA-1, SHA-256) as Text
, with a related-to
relationships instead of updating the hashes in the existing File
.
Environment
- OS (where OpenCTI server runs): kubernetes
- OpenCTI version: 5.2.4
- OpenCTI client: frontend
- Other environment details:
Reproducible Steps
Steps to create the smallest reproducible scenario:
- Start the MISP connector with the option
MISP_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT
set to True - Open a
File
created by MISP. - The hashes are inserted as
Text
.
Expected Output
Hashes should not be considered unsupported observables and added directly in the hashes of the File
.
Actual Output
Hashes inserted as Text
, see screenshot: