fix: [transform] Search in MISP works with object attributes

src/MISP_maltego/transforms/attributetoevent.py

@@ -84,10 +84,17 @@ class SearchInMISP(Transform):
         events_json = misp.search(controller='events', value=request.entity.value, with_attachments=False)
         # we need to do really rebuild the Entity from scratch as request.entity is of type Unknown
         for e in events_json:
+            # find the value as attribute
             attr = get_attribute_in_event(e, request.entity.value, substring=True)
             if attr:
                 for item in attribute_to_entity(attr, only_self=True):
                     response += item
+            # find the value as object, and return the object
+            if 'Object' in e['Event']:
+                for o in e['Event']['Object']:
+                    if get_attribute_in_object(o, attribute_value=request.entity.value, substring=True).get('value'):
+                        response += object_to_entity(o, link_label=link_label)
+
         return response
 
 # placeholder for https://github.com/MISP/MISP-maltego/issues/11

src/MISP_maltego/transforms/common/util.py

@@ -278,7 +278,7 @@ def get_object_in_event(uuid, e):
             return o
 
 
-def get_attribute_in_object(o, attribute_type=False, attribute_value=False, drop=False):
+def get_attribute_in_object(o, attribute_type=False, attribute_value=False, drop=False, substring=False):
     '''Gets the first attribute of a specific type within an object'''
     found_attribute = {'value': ''}
     for i, a in enumerate(o['Attribute']):
@@ -291,12 +291,53 @@ def get_attribute_in_object(o, attribute_type=False, attribute_value=False, drop
             found_attribute = a.copy()
             if drop:    # drop the attribute from the object
                 o['Attribute'].pop(i)
+            break
         if '|' in a['type'] or a['type'] == 'malware-sample':
             if attribute_value in a['value'].split('|'):
                 found_attribute = a.copy()
                 if drop:    # drop the attribute from the object
                     o['Attribute'].pop(i)
+                break
+        # TODO implement substring matching
+        if substring:
+            keyword = attribute_value.strip('%')
+            if attribute_value.startswith('%') and attribute_value.endswith('%'):
+                if attribute_value in a['value']:
+                    found_attribute = a.copy()
+                    if drop:    # drop the attribute from the object
+                        o['Attribute'].pop(i)
+                    break
+                if '|' in a['type'] or a['type'] == 'malware-sample':
+                    val1, val2 = a['value'].split('|')
+                    if attribute_value in val1 or attribute_value in val2:
+                        found_attribute = a.copy()
+                        if drop:    # drop the attribute from the object
+                            o['Attribute'].pop(i)
+                        break
+            elif attribute_value.startswith('%'):
+                if a['value'].endswith(keyword):
+                    found_attribute = a.copy()
+                    if drop:    # drop the attribute from the object
+                        o['Attribute'].pop(i)
+                    break
+                if '|' in a['type'] or a['type'] == 'malware-sample':
+                    val1, val2 = a['value'].split('|')
+                    if val1.endswith(keyword) or val2.endswith(keyword):
+                        found_attribute = a.copy()
+                        if drop:    # drop the attribute from the object
+                            o['Attribute'].pop(i)
+                        break
 
+            elif attribute_value.endswith('%'):
+                if a['value'].startswith(keyword):
+                    return a
+                if '|' in a['type'] or a['type'] == 'malware-sample':
+                    val1, val2 = a['value'].split('|')
+                    if val1.startswith(keyword) or val2.startswith(keyword):
+                        found_attribute = a.copy()
+                        if drop:    # drop the attribute from the object
+                            o['Attribute'].pop(i)
+                        break
     return found_attribute