From a3b98d75faca4fa65fd52a0fbc76f9b54ed0d279 Mon Sep 17 00:00:00 2001 From: To-om Date: Thu, 12 Nov 2020 15:54:48 +0100 Subject: [PATCH] #1644 Fix MISP export for hash observables --- .../misp/services/MispExportSrv.scala | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/misp/connector/src/main/scala/org/thp/thehive/connector/misp/services/MispExportSrv.scala b/misp/connector/src/main/scala/org/thp/thehive/connector/misp/services/MispExportSrv.scala index ee69a055e2..5b5d08d496 100644 --- a/misp/connector/src/main/scala/org/thp/thehive/connector/misp/services/MispExportSrv.scala +++ b/misp/connector/src/main/scala/org/thp/thehive/connector/misp/services/MispExportSrv.scala @@ -37,8 +37,22 @@ class MispExportSrv @Inject() ( observable.tags.map(t => MispTag(None, t.toString, Some(t.colour), None)) ++ tlpTags.get(observable.tlp) else tlpTags.get(observable.tlp).toSeq - connector - .attributeConverter(observable.`type`) + + observable + .data + .collect { + case data if observable.`type` == "hash" => data.data.length + } + .collect { + case 32 => "md5" + case 40 => "sha1" + case 56 => "sha224" + case 64 => "sha256" + case 96 => "sha384" + case 128 => "sha512" + } + .map("Payload delivery" -> _) + .orElse(connector.attributeConverter(observable.`type`)) .map { case (cat, tpe) => Attribute(