otx_misp

otx_misp copied to clipboard

Description

MISP has been changing parts of the API and moving certain functions into ExpandedPyMISP, now when running otx-misp more deprecation warnings are occurring, including the warning about the package potentially breaking in early 2020. (Please use ExpandedPyMISP instead (requires Python 3.6+). This class will be an alias of ExpandedPyMISP early 2020 and your code will most probably fail.)

Versions

• otx-misp: 1.4.3
• PyMISP: 2.4.112
• MISP: v2.4.112
• Python: 3.6
• Operating system: Ubuntu 18.04.2 LTS

Traceback or error

/usr/local/lib/python3.6/dist-packages/otx_misp/__init__.py:177: DeprecationWarning: Call to deprecated method __init__. (Please use ExpandedPyMISP instead (requires Python 3.6+). This class will be an alias of ExpandedPyMISP early 2020 and your code will most probably fail.)
  misp = pymisp.PyMISP(server, key, ssl=False, out_type='json')
/usr/local/lib/python3.6/dist-packages/pymisp/api.py:106: DeprecationWarning: Call to deprecated method get_recommended_api_version. (Use ExpandedPyMISP.recommended_pymisp_version) -- Deprecated since version 2.4.110.
  response = self.get_recommended_api_version()
/usr/local/lib/python3.6/dist-packages/pymisp/api.py:123: DeprecationWarning: Call to deprecated method get_live_describe_types. (Use ExpandedPyMISP.describe_types_remote) -- Deprecated since version 2.4.110.
  self.describe_types = self.get_live_describe_types()

/usr/local/lib/python3.7/site-packages/pymisp/api.py:844: DeprecationWarning: Call to deprecated method add_named_attribute. (Use ExpandedPyMISP.add_attribute and MISPAttribute)
  return self.add_named_attribute(event, 'url', url, category, to_ids, comment, distribution, proposal, **kwargs)
/usr/local/lib/python3.7/site-packages/otx_misp/__init__.py:279: DeprecationWarning: Call to deprecated method search_index. (Use ExpandedPyMISP.search_index) -- Deprecated since versio 2.4.111.
  result = misp.search_index(eventinfo=event_name)
/usr/local/lib/python3.7/site-packages/otx_misp/__init__.py:85: DeprecationWarning: Call to deprecated method tag. (Use ExpandedPyMISP.tag) -- Deprecated since version 2.4.111.
  misp.tag(event['Event']['uuid'], tag)
/usr/local/lib/python3.7/site-packages/otx_misp/__init__.py:445: DeprecationWarning: Call to deprecated method publish. (Use ExpandedPyMISP.publish)
  misp.publish(event)
/usr/local/lib/python3.7/site-packages/pymisp/api.py:517: DeprecationWarning: Call to deprecated method fast_publish. (Use ExpandedPyMISP.publish)
  return self.fast_publish(event_id, alert)

Moreover, on the latest version of MISP ( v2.4.113), new events do not seem to be created. It's probably because of that:

/usr/local/lib/python3.5/dist-packages/wrapt/wrappers.py:603: DeprecationWarning: Call to deprecated method search_index. (Use Exp                                    andedPyMISP.search_index) -- Deprecated since version 2.4.111.
  args, kwargs)
/usr/local/lib/python3.5/dist-packages/wrapt/wrappers.py:603: DeprecationWarning: Call to deprecated method new_event. (Use Expand                                    edPyMISP.add_event)
  args, kwargs)
/usr/local/lib/python3.5/dist-packages/wrapt/wrappers.py:603: DeprecationWarning: Call to deprecated method add_event. (Use Expand                                    edPyMISP.add_event)
  args, kwargs)
Cannot import pulse SSH honeypot logs for 8/21/2019: 'Event'

Thanks for the report.

otx-misp needs a huge refactor in order to deal with newer versions of MISP API and PyMISP. I'll check that soon, but I'm stuck in olds versions of MISP in production for other reasons.

Will the code be moved to ExpandedPyMISP by 2019-Dec?