TheHive
TheHive copied to clipboard
[Bug] Export event to MISP
Request Type
Bug
Work Environment
Question | Answer |
---|---|
OS version (server) | Debian |
OS version (client) | Ubuntu |
Virtualized Env. | True |
Dedicated RAM | 4 GB |
vCPU | 2 |
TheHive version / git hash | 4.1.19-1 |
Package Type | DEB |
Database | Cassandra |
Index type | Lucene |
Problem Description
I have already exported several events on TheHive to MISP without problem. However, I changed my MISP server and had to delete all events. So I wanted to re-export the events, but it shows me the error on TheHive:
I even tried to export to another MISP server, but it does the same thing! As soon as an event is exported once, I can no longer export it a second time.
In log I have :
2022-07-20 13:24:48,354 [ERROR] from org.thp.scalligraph.ErrorHandler in application-akka.actor.default-dispatcher-11 [|3454b9fa] Internal error
play.api.libs.json.JsResultException: JsResultException(errors:List((,List(JsonValidationError(List('Event' is undefined on object: {"saved":false,"name":"Could not add Event","message":"Could not add Event","url":"/events/add","errors":{"Event":{"extends_uuid":["Invalid event ID provided."]}}}),WrappedArray())))))
at play.api.libs.json.JsReadable.$anonfun$as$2(JsReadable.scala:25)
Steps to Reproduce
- Choose a case event
- Export with MISP
Possible Solutions
I thought this was because MISP keeps a blocklist of deleted events, but that's not the case because I tried with a new, empty MISP server. So I think the problem comes from TheHive