Open
Conversation
…ssic python-requests that caused 429 stanfrbd#169
Dev - Remove support of secrets.json and other improvements stanfrbd#166
Updated instructions for restarting the gunicorn process to include using supervisord.
Add environment variables for MISP-feedback service: - MISP_FEEDBACK_SERVER_URL: The URL of the MISP-feedback service - MISP_FEEDBACK_TOKEN: Optional token for Basic authentication Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add MispFeedbackEngine class that: - Supports MD5, SHA1, SHA256 hashes, IPv4, IPv6, and FQDN observables - Queries the MISP-feedback service /lookup endpoint - Supports optional Basic authentication via token - Returns HIT status with list of matching warninglists or CLEAN status - Formats results for CSV/Excel export Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add 28 test cases covering: - HIT/CLEAN analysis scenarios for all supported observable types - Basic authentication with optional token - HTTP error handling (400, 401, 403, 404, 500, 502, 503) - Network timeout handling (connection and read timeouts) - Invalid JSON response handling - Multiple matches and edge cases - Export row formatting for CSV/Excel - Engine properties and supported types All tests pass with mocked API responses and integration tested with running service. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add MISP-feedback engine to the UI: - Added engine to index.html with icon and filter options - Added table column header and data display in display_table.html - Added card view in display_cards.html - Created misp_feedback_table.html layout showing status and warninglists - Created misp_feedback_card.html layout for card view display The engine now appears in the UI as a selectable option with: - Free (no API key required) indicator - Support for hashes, IPs, and domains - Visual status indicator (red for HIT, green for CLEAN) - List of matched warninglists Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add MISP-feedback configuration to Docker Compose: - MISP_FEEDBACK_SERVER_URL: URL of the MISP-feedback service - MISP_FEEDBACK_TOKEN: Optional authentication token for Basic Auth These environment variables are now available to the Cyberbro container when running via docker-compose. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Register MispFeedbackEngine in utils/load_engines.py: - Import: from engines.misp_feedback import MispFeedbackEngine - Instantiate: MispFeedbackEngine(secrets, proxies, ssl_verify) This ensures the MISP-feedback engine is loaded and available for use in the analysis pipeline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The config parser was not converting single-value strings to lists, causing GUI_ENABLED_ENGINES to be a string instead of an array when set to a single engine name (e.g., 'misp_feedback'). This led to JavaScript's .includes() method performing substring matching instead of exact string matching, incorrectly displaying engines with substring-matching names. Fixed by ensuring gui_enabled_engines is always a list, regardless of whether the input string contains commas. Verified with: - All 1217 existing tests still pass - Config parsing correctly converts single values to list - JavaScript filtering now uses exact string matching Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added MISP_FEEDBACK_SERVER_URL and MISP_FEEDBACK_TOKEN configuration variables to the .env.sample file for users to configure the MISP-feedback service integration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added support for copying MISP-feedback analysis results to clipboard by formatting the engine output in the plain text export. The formatting includes the status (HIT/CLEAN) and any matched warninglists. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added MISP-feedback engine support to the graph visualization with: - Two node group colors: misp_feedback_hit (red) and misp_feedback_clean (green) - Node creation for MISP-feedback results showing the status - Edge labels displaying status and matched warninglists if present - Warning icon for visual identification Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Created comprehensive documentation describing: - Optional HTTP Basic Authentication setup - Configuration without authentication (default) - Configuration with authentication (reverse proxy/gateway) - Example deployments for local and remote setups - Testing and troubleshooting guide - Note about private infrastructure deployment The documentation is generic to support various deployment scenarios (reverse proxy, API gateway, SSO, etc.). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added entry for Get MISP-Feedback Authentication Token documentation in the API Key Guides section, maintaining alphabetical order. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added MISP-Feedback engine entry to the API usage and engine names documentation with: - Engine name: misp_feedback - Supported observable types: hash, IP, domain - Feature flags: free_no_key - Description of functionality Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Owner
|
How cool! 🥳 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This adds integration with the MISP-Feedback service to lookup observables against MISP warninglists.
To get a quick way to identify possible false positives, the MISP-Feedback service is a fast way to achieve that.
See also Identify poorly qualified IoCs with MISP warning lists #172
Scope
Validation (required)
Test evidence
List exact commands you ran and the outcome.
AI-assisted contribution disclosure
If AI was used, briefly describe what parts were AI-assisted:
The AI has written most code and documentation. I have instructed it through a PLAN and to have it read AGENTS.md and Contributions.md. And also verified the final output.
Maintainer merge policy acknowledgement
devfirst for additional validation.mainis kept clean/stable for releases and tags.New engine checklist (only if applicable)
Engine Implementation
engines/engine_name.py(using existing engines as template).engines/__init__.py.utils/config.py(if relevant).Configuration & Secrets
.env.sample.docker-compose.yml.UI & Frontend
static/format_results.js.templates/engines_layouts/for card/table rendering.templates/display_cards.htmlandtemplates/display_table.html.templates/index.htmlwith description (alphabetic order).templates/graph.html.Documentation
docs/api-keys/Get-Engine-API-key.md(if relevant).docs/index.md(if relevant).docs/quick-start/API-usage-and-engine-names.md.mkdocs.ymlsidebar.docs/quick-start/Quick-start-&-Installation.mdand.envexamples.docs/quick-start/Advanced-options-for-deployment.md(docker composeexample).README.mdreferences (env vars and API/services section).Risk and rollback
Additional notes
GUI_ENABLED_ENGINES=misp_feedbackdid this also include the MISP service. The reason for this was Python making it a string instead of a list when there was only one engine selected in theGUI_ENABLE_ENGINES. Since MISP is a substring of the name MISP_FEEDBACK, this caused it to also be shown as engine on the main page.The fix is in 027c9b5 and is believed to not affect cause any side effects.
Example images:
