MISP / MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Home Page:https://www.misp-project.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature Request: Allow access to attribute warninglist objects in workflows.

UFOSmuggler opened this issue · comments

Is your feature request related to a problem? Please describe.

If I try this:

image
image

It doesn't work. iglocska speculates that its because warnings are generated at the end of execution, and may not be attached when read back after saving.

It's also possible I'm just doing it wrong.

Describe the solution you'd like

I'd like to be able to access warninglist objects applied to attributes via hash paths in workflows, the use case like in my pictures would be mighty helpful for developing analyst workflows and procedures.

Describe alternatives you've considered

could just do it in a python script i guess. but this would be nicer.

Additional context

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct

I think you should use the "Attach Warninglist" module before accessing to warnings properties.

I think you should use the "Attach Warninglist" module before accessing to warnings properties.

Thanks Vincenzo, I did actually try that, but only on the "event after save" trigger, where it does not work. After your suggestion i retried it on the "attribute after save" trigger, with exactly the same configuration, and it does work.

Strange that it does not work on the event based trigger though, maybe I need to filter the scope or something before I can use that one.

Event Attribute
image image

The attribute trigger is good enough anyway, thank you very much for your advice.