Skip to content

Commit

Permalink
Misp v3 delete attribute + local tag arg (#17742)
Browse files Browse the repository at this point in the history
* added new command delete attribute

* add to readme

* added new command to TBP

* add RN

* update RN

* fix RN
  • Loading branch information
abaumgarten authored Feb 20, 2022
1 parent c828855 commit ab8bf67
Show file tree
Hide file tree
Showing 7 changed files with 280 additions and 170 deletions.
18 changes: 17 additions & 1 deletion Packs/MISP/Integrations/MISPV3/MISPV3.py
Original file line number Diff line number Diff line change
Expand Up @@ -1105,8 +1105,9 @@ def add_tag(demisto_args: dict, is_attribute=False):
"""
uuid = demisto_args.get('uuid')
tag = demisto_args.get('tag')
is_local_tag = argToBoolean(demisto_args.get('is_local', False))
try:
PYMISP.tag(uuid, tag) # add the tag
PYMISP.tag(uuid, tag, local=is_local_tag) # add the tag
except PyMISPError:
raise DemistoException("Adding the required tag was failed. Please make sure the UUID exists.")
if is_attribute:
Expand Down Expand Up @@ -1446,6 +1447,19 @@ def update_attribute_command(demisto_args: dict) -> CommandResults:
)


def delete_attribute_command(demisto_args: dict) -> CommandResults:
"""
Gets an attribute id and deletes it.
"""
attribute_id = demisto_args.get('attribute_id')
response = PYMISP.delete_attribute(attribute_id)
if 'errors' in response:
raise DemistoException(f'Attribute ID: {attribute_id} has not found in MISP: \nError message: {response}')
else:
human_readable = f'Attribute {attribute_id} has been deleted'
return CommandResults(readable_output=human_readable, raw_response=response)


def main():
params = demisto.params()
malicious_tag_ids = argToList(params.get('malicious_tag_ids'))
Expand Down Expand Up @@ -1519,6 +1533,8 @@ def main():
return_results(add_generic_object_command(args))
elif command == 'misp-update-attribute':
return_results(update_attribute_command(args))
elif command == 'misp-delete-attribute':
return_results(delete_attribute_command(args))
except PyMISPError as e:
return_error(e.message)
except Exception as e:
Expand Down
31 changes: 31 additions & 0 deletions Packs/MISP/Integrations/MISPV3/MISPV3.yml
Original file line number Diff line number Diff line change
Expand Up @@ -1507,6 +1507,16 @@ script:
name: tag
required: true
secret: false
- auto: PREDEFINED
default: false
description: Whether to add the tag as a local tag.
isArray: false
name: is_local
predefined:
- 'true'
- 'false'
required: false
secret: false
deprecated: false
description: Adds a tag to the given UUID event .
execution: false
Expand Down Expand Up @@ -1627,6 +1637,16 @@ script:
name: tag
required: true
secret: false
- auto: PREDEFINED
default: false
description: Whether to add the tag as a local tag.
isArray: false
name: is_local
predefined:
- 'true'
- 'false'
required: false
secret: false
deprecated: false
description: Adds a tag to the given UUID attribute.
execution: false
Expand Down Expand Up @@ -2788,6 +2808,17 @@ script:
- contextPath: MISP.Attribute.Comment
description: Attribute comment.
type: string
- arguments:
- default: false
description: Attribute ID to delete.
isArray: false
name: attribute_id
required: true
secret: false
deprecated: false
description: Delete an attribute according to the given attribute ID.
execution: false
name: misp-delete-attribute
dockerimage: demisto/pymisp2:1.0.0.25484
feed: false
isfetch: false
Expand Down
29 changes: 26 additions & 3 deletions Packs/MISP/Integrations/MISPV3/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2515,9 +2515,10 @@ Adds a tag to the given UUID event .
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| uuid | UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the event. | Required |
| --- | --- |--------------|
| uuid | UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the event. | Required |
| is_local | Whether to add the tag as a local tag. | Optional |


#### Context Output
Expand Down Expand Up @@ -2630,6 +2631,7 @@ Adds a tag to the given UUID attribute.
| --- | --- | --- |
| uuid | UUID of the attribute. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the attribute. | Required |
| is_local | Whether to add the tag as a local tag. | Optional |


#### Context Output
Expand Down Expand Up @@ -3803,4 +3805,25 @@ Update an attribute of an existing MISP event.
>## MISP update attribute
>Attribute: c0ba7147-d99a-418a-a23a-d9be62590c33 was updated.
### misp-delete-attribute
***
Delete an attribute according to the given attribute ID.

#### Base Command

`misp-delete-attribute`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| attribute_id | Attribute ID to delete. | Required |


#### Context Output

There is no context output for this command.
#### Command example
```!misp-delete-attribute attribute_id=3f5917b3-100c-4e21-91c3-48b265337232```
#### Human Readable Output

>Attribute 3f5917b3-100c-4e21-91c3-48b265337232 has been deleted
3 changes: 2 additions & 1 deletion Packs/MISP/Integrations/MISPV3/command_examples
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,5 @@
!misp-add-events-from-feed limit=1 feed=Botvrij.eu
!misp-delete-event event_id=1655
!misp-add-file-object entry_id=${File.EntryID} event_id=1655
!misp-update-attribute attribute_uuid=c0ba7147-d99a-418a-a23a-d9be62590c33 last_seen=2030-06-84 category=Person
!misp-update-attribute attribute_uuid=c0ba7147-d99a-418a-a23a-d9be62590c33 last_seen=2030-06-84 category=Person
!misp-delete-attribute attribute_id=c0ba7147-d99a-418a-a23a-d9be62590c33
5 changes: 5 additions & 0 deletions Packs/MISP/ReleaseNotes/2_1_0.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#### Integrations
##### MISP v3
- Added the command ***misp-delete-attribute*** which allows users to delete an attribute according to a given attribute ID.
- Added the *is_local* argument to the **misp-add-tag-to-event** command.
- Added the *is_local* argument to the **misp-add-tag-to-attribute** command.
Loading

0 comments on commit ab8bf67

Please sign in to comment.