-
Notifications
You must be signed in to change notification settings - Fork 250
Description
I'm trying to make some updates to the greynoise.py enrichment module, and one of the things I've noticed is that, upon enrichment, it creates a greynoise-ip version 1 object in the event. Here's a snippet of the object in the event json:
"Object":[{"id":"251433","name":"greynoise-ip","meta-category":"network","description":"GreyNoise IP Information","template_uuid":"6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9","template_version":"1","event_id":"34","uuid":"3bfb23e9-f608-4c2e-8321-8f3494214feb","timestamp":"1758131476","distribution":"5","sharing_group_id":"0","comment":"8.8.8.8: Enriched via the greynoise2 module"
The MISP instance, however, is a fresh install on the latest build and only has greynoise-ip v2
Name greynoise-ip
UUID 6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9
Version 2
The object is created and added to the event fine, but if you try and go to edit it, misp returns the following error:
Object cannot be edited, no valid template found. Force update anyway
Any advice on why the module is pinning to v1 despite that version having never existed on this instance and how I could approach trying to fix this?