Export Events in STIX v1 in XML

[mohlcyber]

I am using MISP 2.4.121 and looking for a way to export events in stix v1 in xml format.

Before the release of 2.4.120 i was able to export events in stix version 1.x in xml. With the current version i am only able to export stix in json.

Is it correct that both return_formats (stix, stix-json) return a similar output? I was expecting to get stix in xml and stix-json in json.

Unfortunately I need an STIX v1 XML output to get our SIEM integration working.
If you need any further details please let me know.

All the best,
Martin

[RichieB2B]

Are you using the web interface or API? How exactly are you doing the export?

[mohlcyber]

Apologies forgot to mention. I am talking about the API.

https:///events/restSearch
{
"returnFormat": "stix",
"eventid": "1147"
}

Same applies to the PyMISP libraries. When I use a similar function like this:
self.misp.search(eventid=eid, tags=tags, return_format='stix')
I am receiving an JSON as an output.

Via the UI i can successfully export the event into a STIX XML file.
I just checked - when i use: https:///events/restSearch/stix/eventid:1147
I get the expected XML. Something strange.

[RichieB2B]

With the API you need to set the Accept header:

Accept: application/xml

[iglocska]

Interesting, that should work as before, sounds like a bug. For now until we fix it, could you try to append .xml at the end of the url?

…

On Tue, Feb 11, 2020, 20:46 Richie B2B ***@***.***> wrote: With the API you need to set the Accept header: Accept: application/xml — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#5618?email_source=notifications&email_token=AA37VQGIZFOPIGVH5IENRDTRCL6B7A5CNFSM4KTELVT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELNZVZI#issuecomment-584817381>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA37VQHBHN4VBMSR3PJHPKLRCL6B7ANCNFSM4KTELVTQ> .

[mohlcyber]

I used the PyMISP libraries and the accepted XML header.
I guess this might be more related to the PyMISP libraries.

Just seen in the change log of PyMISP the following.

v2.4.120 (2020-01-17)
.....
Search with the STIX output returns a json STIX. [Raphaël Vinot]
Was XML before.
.....
Is there any reason for this? Do you want me to create an issue on the PyMISP repo?
Might be more a question to Raphael why this has changed and if there is a way of exporting STIX1 in xml via the PyMISP libraries.