Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Misp v3 delete attribute + local tag arg #17742

Merged
merged 9 commits into from
Feb 20, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion Packs/MISP/Integrations/MISPV3/MISPV3.py
Original file line number Diff line number Diff line change
Expand Up @@ -1105,8 +1105,9 @@ def add_tag(demisto_args: dict, is_attribute=False):
"""
uuid = demisto_args.get('uuid')
tag = demisto_args.get('tag')
is_local_tag = argToBoolean(demisto_args.get('is_local', False))
try:
PYMISP.tag(uuid, tag) # add the tag
PYMISP.tag(uuid, tag, local=is_local_tag) # add the tag
except PyMISPError:
raise DemistoException("Adding the required tag was failed. Please make sure the UUID exists.")
if is_attribute:
Expand Down Expand Up @@ -1446,6 +1447,19 @@ def update_attribute_command(demisto_args: dict) -> CommandResults:
)


def delete_attribute_command(demisto_args: dict) -> CommandResults:
"""
Gets an attribute id and deletes it.
"""
attribute_id = demisto_args.get('attribute_id')
response = PYMISP.delete_attribute(attribute_id)
if 'errors' in response:
raise DemistoException(f'Attribute ID: {attribute_id} has not found in MISP: \nError message: {response}')
else:
human_readable = f'Attribute {attribute_id} has been deleted'
return CommandResults(readable_output=human_readable, raw_response=response)


def main():
params = demisto.params()
malicious_tag_ids = argToList(params.get('malicious_tag_ids'))
Expand Down Expand Up @@ -1519,6 +1533,8 @@ def main():
return_results(add_generic_object_command(args))
elif command == 'misp-update-attribute':
return_results(update_attribute_command(args))
elif command == 'misp-delete-attribute':
return_results(delete_attribute_command(args))
except PyMISPError as e:
return_error(e.message)
except Exception as e:
Expand Down
31 changes: 31 additions & 0 deletions Packs/MISP/Integrations/MISPV3/MISPV3.yml
Original file line number Diff line number Diff line change
Expand Up @@ -1507,6 +1507,16 @@ script:
name: tag
required: true
secret: false
- auto: PREDEFINED
default: false
description: Whether to add the tag as a local tag.
isArray: false
name: is_local
predefined:
- 'true'
- 'false'
required: false
secret: false
deprecated: false
description: Adds a tag to the given UUID event .
execution: false
Expand Down Expand Up @@ -1627,6 +1637,16 @@ script:
name: tag
required: true
secret: false
- auto: PREDEFINED
default: false
description: Whether to add the tag as a local tag.
isArray: false
name: is_local
predefined:
- 'true'
- 'false'
required: false
secret: false
deprecated: false
description: Adds a tag to the given UUID attribute.
execution: false
Expand Down Expand Up @@ -2788,6 +2808,17 @@ script:
- contextPath: MISP.Attribute.Comment
description: Attribute comment.
type: string
- arguments:
- default: false
description: Attribute ID to delete.
isArray: false
name: attribute_id
required: true
secret: false
deprecated: false
description: Delete an attribute according to the given attribute ID.
execution: false
name: misp-delete-attribute
dockerimage: demisto/pymisp2:1.0.0.25484
feed: false
isfetch: false
Expand Down
29 changes: 26 additions & 3 deletions Packs/MISP/Integrations/MISPV3/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2515,9 +2515,10 @@ Adds a tag to the given UUID event .
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| uuid | UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the event. | Required |
| --- | --- |--------------|
| uuid | UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the event. | Required |
| is_local | Whether to add the tag as a local tag. | Optional |


#### Context Output
Expand Down Expand Up @@ -2630,6 +2631,7 @@ Adds a tag to the given UUID attribute.
| --- | --- | --- |
| uuid | UUID of the attribute. For example, 59575300-4be8-4ff6-8767-0037ac110032. | Required |
| tag | Tag to add to the attribute. | Required |
| is_local | Whether to add the tag as a local tag. | Optional |


#### Context Output
Expand Down Expand Up @@ -3803,4 +3805,25 @@ Update an attribute of an existing MISP event.
>## MISP update attribute
>Attribute: c0ba7147-d99a-418a-a23a-d9be62590c33 was updated.

### misp-delete-attribute
***
Delete an attribute according to the given attribute ID.

#### Base Command

`misp-delete-attribute`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| attribute_id | Attribute ID to delete. | Required |


#### Context Output

There is no context output for this command.
#### Command example
```!misp-delete-attribute attribute_id=3f5917b3-100c-4e21-91c3-48b265337232```
#### Human Readable Output

>Attribute 3f5917b3-100c-4e21-91c3-48b265337232 has been deleted
3 changes: 2 additions & 1 deletion Packs/MISP/Integrations/MISPV3/command_examples
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,5 @@
!misp-add-events-from-feed limit=1 feed=Botvrij.eu
!misp-delete-event event_id=1655
!misp-add-file-object entry_id=${File.EntryID} event_id=1655
!misp-update-attribute attribute_uuid=c0ba7147-d99a-418a-a23a-d9be62590c33 last_seen=2030-06-84 category=Person
!misp-update-attribute attribute_uuid=c0ba7147-d99a-418a-a23a-d9be62590c33 last_seen=2030-06-84 category=Person
!misp-delete-attribute attribute_id=c0ba7147-d99a-418a-a23a-d9be62590c33
5 changes: 5 additions & 0 deletions Packs/MISP/ReleaseNotes/2_1_0.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#### Integrations
##### MISP v3
- Added the command ***misp-delete-attribute*** which allows users to delete an attribute according to a given attribute ID.
- Added the *is_local* argument to the **misp-add-tag-to-event** command.
- Added the *is_local* argument to the **misp-add-tag-to-attribute** command.
Loading