Setting published=True on PyMISP.new_event() does not work about pymisp

[FloatingGhost]

what, like doing

n = pymisp.new_event(info="test")
# add attribs
pymisp.publish(n)

doesn't work?

[kralca]

Can we do it as follows? n = pymisp.new_event(published=True) # add attributes Thanks

[FloatingGhost]

p = PyMISP(...)
event = p.new_event(info="some published event", published=True)

Works as intended. Publishes event upon creation.

OH I get you, I get what you mean

It unpublishes after you add a new thing

[kralca]

Sorry. I will test again and confirm.

[FloatingGhost]

I think this is a MISP-side bug, lemme go check that :)

[FloatingGhost]

Ok yep, pretty sure this is a MISP-side bug
Have raised it on the main repo - give it a little while :)

[kralca]

I wonder if this behaviour in MISP (i.e. 'unpublish' after adding new attributes) is intended so that there needs to be a conscious decision to publish the new attributes.

Perhaps it is better to use PyMISP as follows (for example):

p = PyMISP(...)
event = p.new_event(info="some published event", published=False)
p.add_filename(event, 'some_file_name')
p.publish(event)

This seems to work.

Note there is a bug in PyMISP with the above approach when you set 'published=True' in the call to new_event() and later call p.publish(event) PyMISP thinks the event is already published and doesn't update the event in MISP.

[iglocska]

That is indeed correct, adding any attributes to an event should unpublish the event.

…

On Sat, May 20, 2017 at 1:48 PM, kralca ***@***.***> wrote: I wonder if this behaviour in MISP (i.e. 'unpublish' after adding new attributes) is intended so that there needs to be a concsious decision to publish the new attributes. Perhaps it is better to use PyMISP as follows (for example): p = PyMISP(...) event = p.new_event(info="some published event", published=False) p.add_filename(event, 'some_file_name') p.publish(event) This seems to work. Note there is a bug in PyMISP with the above approach when you set 'published=True' in the call to new_event() and later call p.publish(event) PyMISP thinks the event is already published and doesn't update the event in MISP. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#86 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADf6wP-bEKL66wX3MhYz-h2nLyPEk15Yks5r7tMbgaJpZM4NgJBv> .

[Rafiot]

I added a method that will solve your problem and doesn't expect you to have the whole MISP event in memory to publish.