MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: Use default category from template 

Fix #477
pull/485/head
Raphaël Vinot 2019-10-18 14:44:54 +02:00
parent fef328d395
commit 880fb300ea
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pymisp/mispevent.py
View File

@ -1070,6 +1070,9 @@ class MISPObjectAttribute(MISPAttribute):
self.type = kwargs.pop('type', None) self.type = kwargs.pop('type', None)
if self.type is None: if self.type is None:
self.type = self._definition.get('misp-attribute') self.type = self._definition.get('misp-attribute')
if 'category' not in kwargs and 'categories' in self._definition:
# Get first category in the list from the object template as default
self.category = self._definition['categories'][0]
self.disable_correlation = kwargs.pop('disable_correlation', None) self.disable_correlation = kwargs.pop('disable_correlation', None)
if self.disable_correlation is None: if self.disable_correlation is None:
# The correlation can be disabled by default in the object definition. # The correlation can be disabled by default in the object definition.
@ -1331,7 +1334,7 @@ class MISPObject(AbstractMISP):
logger.warning("The value of the attribute you're trying to add is None or empty string, skipping it. Object relation: {}".format(object_relation)) logger.warning("The value of the attribute you're trying to add is None or empty string, skipping it. Object relation: {}".format(object_relation))
return None return None
if self._known_template: if self._known_template:
if self._definition['attributes'].get(object_relation): if object_relation in self._definition['attributes']:
attribute = MISPObjectAttribute(self._definition['attributes'][object_relation]) attribute = MISPObjectAttribute(self._definition['attributes'][object_relation])
else: else:
# Woopsie, this object_relation is unknown, no sane defaults for you. # Woopsie, this object_relation is unknown, no sane defaults for you.

8
tests/mispevent_testfiles/event_obj_def_param.json
View File

@ -14,6 +14,14 @@
"to_ids": true, "to_ids": true,
"type": "filename", "type": "filename",
"value": "bar" "value": "bar"
},
{
"category": "Artifacts dropped",
"disable_correlation": false,
"object_relation": "pattern-in-file",
"to_ids": true,
"type": "pattern-in-file",
"value": "baz"
} }
], ],
"description": "File object describing a file with meta-information", "description": "File object describing a file with meta-information",

3
tests/test_mispevent.py
View File

@ -159,6 +159,9 @@ class TestMISPEvent(unittest.TestCase):
self.mispevent.add_object(name='file', strict=True) self.mispevent.add_object(name='file', strict=True)
a = self.mispevent.objects[0].add_attribute('filename', value='bar', Tag=[{'name': 'blah'}]) a = self.mispevent.objects[0].add_attribute('filename', value='bar', Tag=[{'name': 'blah'}])
del a.uuid del a.uuid
a = self.mispevent.objects[0].add_attribute('pattern-in-file', value='baz')
self.assertEqual(a.category, 'Artifacts dropped')
del a.uuid
self.mispevent.add_object(name='file', strict=False, default_attributes_parameters=self.mispevent.objects[0].attributes[0]) self.mispevent.add_object(name='file', strict=False, default_attributes_parameters=self.mispevent.objects[0].attributes[0])
a = self.mispevent.objects[1].add_attribute('filename', value='baz') a = self.mispevent.objects[1].add_attribute('filename', value='baz')
del a.uuid del a.uuid