Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] Hash observables are not correctly export to MISP #1644

Closed
To-om opened this issue Nov 12, 2020 · 0 comments
Closed

[Bug] Hash observables are not correctly export to MISP #1644

To-om opened this issue Nov 12, 2020 · 0 comments
Assignees
@To-om
Labels
bug TheHive4 TheHive4 related issues
Milestone
4.0.1

Comments

@To-om
Copy link
Contributor

To-om commented Nov 12, 2020

Request Type

Bug

Work Environment

TheHive 4.0.0

Problem Description

When a hash observable is exported to MISP, its type is chosen randomly among the hashes supported by MISP (x509-fingerprint-sha256, imphash, hassh-md5, ...). If the size of the data doesn't match the selected hash type, MISP reject the observable and attribute is not created.

The solution is to hardcode the hash type according the size of the data:

  • 32: md5
  • 40: sha1
  • 56: sha224
  • 64: sha256
  • 96: sha384
  • 128: sha512
@To-om To-om added bug TheHive4 TheHive4 related issues labels Nov 12, 2020
@To-om To-om added this to the 4.0.1 milestone Nov 12, 2020
@To-om To-om self-assigned this Nov 12, 2020
To-om added a commit that referenced this issue Nov 12, 2020
@To-om
#1644 Fix MISP export for hash observables
a3b98d7
@To-om To-om closed this as completed Nov 12, 2020
To-om added a commit that referenced this issue Nov 12, 2020
@To-om
#1644 Fix type comparison
98180ee
To-om added a commit that referenced this issue Nov 13, 2020
@To-om
#1644 Fix MISP export for hash observables
87fcd20
To-om added a commit that referenced this issue Nov 13, 2020
@To-om
#1644 Fix type comparison
a0868a9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@To-om To-om

Labels
bug TheHive4 TheHive4 related issues
Projects
None yet
Milestone
4.0.1
Development

No branches or pull requests
1 participant
@To-om