Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug / Deficiency: get_sharing_group by name does NOT function as intended with "name" searches instead of ID/UUID searches #1028

Open
teward opened this issue Jul 13, 2023 · 1 comment

Comments

@teward
Copy link

teward commented Jul 13, 2023

The get_sharing_group function in PyMISP objects seems to not function as intended when searching by strings.

In an instance, we have a sharing group that is titled exactly "Tor Nodes Data". The get_sharing_group object suggests that it might be possible to use a sharing group name to get the sharing group by text search as such:

misp.get_sharing_group("Tor Nodes Data")

However, this returns a hard error when passed to the MISP API backend:

Something went wrong (405): {'name': 'Sharing group doesn't exist or you do not have permission to access it.', 'message': 'Sharing group doesn't exist or you do not have permission to access it.', 'url': '/sharing_groups/view/Tor%20Nodes%20Data'}

This suggests that abstract search of this form does not work. If this is not a usable search mechanism, it will not be easy/trivial to get data out from what sharing group(s) a user is part of in order to use it for filtration in a misp.search call later.

The only way I've discovered as a work around to do this would be akin to this:

def get_sharing_group(groupname: str):
    groups = misp.sharing_groups(pythonify=True)
    for group in groups:
        if group.name.lower() == groupname.lower():
            return group
    return None

It seems this type of search functionality should be part of get_sharing_group if we're accepting abstract strings in the code.

@teward teward changed the title Bug: get_sharing_group by name does NOT function as intended Bug / Deficiency: get_sharing_group by name does NOT function as intended Jul 13, 2023
@teward teward changed the title Bug / Deficiency: get_sharing_group by name does NOT function as intended Bug / Deficiency: get_sharing_group by name does NOT function as intended with "name" searches instead of ID/UUID searches Jul 13, 2023
@Rafiot
Copy link
Member

Rafiot commented Jul 19, 2023

This method is expecting the ID of the sharing group. It is possible to have multiple sharing groups with the same name on a MISP instance, so searching like that will require to either optionally return a list, or ignore any group after we found one, causing even more inconsistency.

If you know the group you're looking for (by ID), you can use the get_sharing_group method.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants