Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[IRIS] Remove empty IOC in alerts that are not accepted by the API #1374

Merged
merged 6 commits into from
Feb 17, 2024

Conversation

gregorywychowaniec-zt
Copy link
Contributor

@gregorywychowaniec-zt gregorywychowaniec-zt commented Feb 15, 2024

Description

The IRIS API does not accept a null ioc_value for new alerts : marshmallow.exceptions.ValidationError: {2: {'ioc_value': ['Field may not be null.']}}.

The modification removes IOCs that have no values before send the alert to IRIS.

Checklist

  • I have reviewed the contributing guidelines.
  • I have included unit tests for my changes or additions.
  • I have successfully run make test-docker with my changes.
  • I have manually tested all relevant modes of the change in this PR.
  • I have updated the documentation.
  • I have updated the changelog.

Questions or Comments

@jertel
Copy link
Owner

jertel commented Feb 15, 2024

Thanks for the submission. We need a unit test showing that the new None check works and then we can get this merged. You can modify test_iris_make_iocs_records and add a third item to the iris_iocs list, where the ioc_value doesn't exist in the match object defined on line 77. That should take care of it.

@gregorywychowaniec-zt
Copy link
Contributor Author

Sorry, I forgot to add the unit tests. I've added them and tested.

@jertel jertel merged commit b274f7d into jertel:master Feb 17, 2024
1 check passed
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 20, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants