NewGalaxyClusterError: The field 'distribution' cannot be set on a default galaxy cluster

[mhpchaves]

After upgrading to 2.5.34.2, I get the error message described in the title, whenever I search for an event that has, for example, misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" as a tag.

A way to avoid the exception is to use misp.search() with pythonify=False. But my code is already prepared to use misp objects, not dictionaries.

I have the same issue if I use misp.add_event() or misp.update_event() after using misp.tag() method.

What's the right way of handling misp events that have clusters/galaxies after this update?

Thanks!

[gyanu2507]

This is PyMISP pythonify, not MISP refusing the event. In 2.5.34, MISPGalaxyCluster.from_dict() errors when default is true and distribution is present. Default galaxy clusters (MITRE tags and the rest) are not something you attach a distribution to. The REST payload still includes distribution on those objects, so pythonify=True blows up on search / add / update after tag().

pythonify=False works because you never build MISPGalaxyCluster.

Until PyMISP pops those fields on inbound default clusters instead of raising:

def _strip_default_cluster_distribution(d):
    if not isinstance(d, dict):
        return d
    # walk Event -> Galaxy -> GalaxyCluster (shape varies)
    ...

or catch NewGalaxyClusterError and retry that event with pythonify=False.

The check belongs on create/update of a cluster you own, not on parsing a default cluster the server already stored. A fix in from_dict is: if default, kwargs.pop("distribution", None) and kwargs.pop("sharing_group_id", None) and do not raise. Your misp.search(..., pythonify=True) path should survive that.

[mhpchaves]

Sorry if I coundn't get it, but where to place the _strip_default_cluster_distribution(d)? Can I run misp.search(pythonify=True) in 2.5.34.2?

This four lines trigger the exception:

import pymisp
from keys import misp_url, misp_key, misp_verifycert
misp = pymisp.PyMISP(misp_url, misp_key, misp_verifycert)
misp.search(eventid=myID, pythonify=True)

[Rafiot]

That's a bug, I'll package a new release later today or tomorrow.