mattcarothers / stix-to-misp Goto Github PK

One of the things that the stiximport module doesn't have yet (but I think it's on their minds) is converting STIX objects to MISP ones. I'll take a crack at building the conversion into your xsiparser modules

The JSON exported from a MISP event includes more tag metadata than just the name like below:

	# If we were given a tag, add it here
	# "Tag": [
	# {
	#     "id": "60",
	#     "name": "tlp:white",
	#     "colour": "#ffffff",
	#     "exportable": true,
	#     "hide_tag": false,
	#     "user_id": "0"
	# },
	for tag_name in args.tags:
		event['Tag'].append({ 'name' : tag_name })

I think we'd have to query the MISP server for the specific tag info for each tag in args.tags