Skip to content

Skip MISP search results without an IntelMQ object when updating timestamps - #2730

Open
Mirochill wants to merge 1 commit into
certtools:developfrom
Mirochill:fix-misp-missing-intelmq-object
Open

Mirochill wants to merge 1 commit into
certtools:developfrom
Mirochill:fix-misp-missing-intelmq-object

Conversation

@Mirochill

Copy link
Copy Markdown

A MISP search can return an event with matching attributes or tags but no intelmq_event object. _update_misp_event() indexes the empty object list and raises IndexError, preventing the output bot from processing later results or acknowledging the message.

Return without updating such an event. Preserve the existing first-object matching and timestamp update behavior. Replace the test stub with five local regression and control cases, including a process call with an unrelated result followed by a matching event, and document the fix in the changelog.

Validation: two new cases fail with IndexError and three controls pass on unmodified develop. After the fix, the MISP, message and harmonization suites report 192 passed and 17 skipped on Python 3.12.14. Project source pycodestyle, test-file pycodestyle, REUSE license validation and git diff --check pass.

A full basic-suite run reports 355 passed, 336 skipped, one failure and 523 setup errors. The same run against a clean develop worktree reports 350 passed, 336 skipped and the identical 524 failing/error test identifiers: the controller refuses to run as root, and bot fixtures require a local Redis service unavailable here. The five additional passing tests account for the difference. Service-backed and live MISP integration tests require the upstream CI environment.

Prepared with assistance from OpenAI Codex; behavior, style, licensing and regression results were verified locally.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant