events/edit API readds deleted attributes already returned by a search about pymisp

[Rafiot]

I'll work on a fix asap. Expect it to be fixed early next year.

[Rafiot]

Just to make sure you use the same path I'd be using (pseudocode):

misp = PyMISP(...)
e = misp.search('foobar')
# delete attributes from e 
misp.add_named_attribute(e, ...)

You're right, all the deleted attributes will be back. I think the easy and clean fix is to set the attributes list to [] in add_named_attribute.

Never mind, this pseudo code should work (https://github.com/MISP/PyMISP/blob/master/pymisp/api.py#L379). How do you delete the attributes?

[mike1703]

I am deleting them with misp.delete_attribute(attribute_id).
The problem is that the following code in _send_attributes just takes your event event = misp.search('foobar'), parses it (so it is based on the event MISP returned to me as a result for the search, adds my new attributes and updates the event. Old attributes are still sent with the event. e.attributes = attributes would be a fix. I just don't know if it will break something else.
https://github.com/MISP/PyMISP/blob/master/pymisp/api.py#L378

e = MISPEvent(self.describe_types)
            e.load(event)
            e.attributes += attributes
            response = self.update_event(event['Event']['id'], json.dumps(e, cls=EncodeUpdate))

[Rafiot]

Current master let you mark an attribute as deleted. This is the cleanest way to do it.

Can you give a try and tell me if it is fine for you.