How to mimic the 'misp-download-sample' functionality in the new PyMISP version?

[nostripe]

Hey people,

I am currently using MISP v3 in Cortex XSOAR and trying to extend the functionality of my instance to download just the uploaded malware sample of a given event.
In MISP v2 I had the 'misp-download-sample' functionality, how could I mimic it in v3?

I tried to do a get-request via the requests package, but that doesn't work. Instead of a zip file, I get a HTML file.

And apart from that.. why would you anyone even remove that future!?

Glad for any help, thanks :)

[Rafiot]

Can you share the code you're using? I have no memory changing anything related to that in the last couple of years. You can (of course) download a malware sample associated to a specific attribute, or a list of samples in an event. Depending on where you're starting from, the code will vary.

[nostripe]

See: https://xsoar.pan.dev/docs/reference/integrations/misp-v3#the-following-commands-were-removed-in-this-version

I didn't get a proper solution using the get_object either, as it just returns a MISP.Object and not the very file.

[Rafiot]

yeah, an object is not a file. If it is a file object, you may (or may not, it is not required) have a malware sample.

I do not have the slightest idea how Cortex XSOAR works, but this a way to get a malware sample with PyMISP so you probably want to talk to your vendor so they figure out how to use it:

1. Search, with the with_attachments flag set to True: https://pymisp.readthedocs.io/en/latest/modules.html#pymisp.PyMISP.search. The response will be either a list of events, objects, or attributes. If you also pass pythonify=True, it will give you MISPEvent, MISPObject, or MISPAttribute objects.
2. If you search for events, iterate over the attributes and find the ones of type malware-sample
3. If you search for objects, same thing
4. If you search for attributes, you got a list of MISPAttribute

From a MISPAttribute of type malware-sample, use malware_binary https://pymisp.readthedocs.io/en/latest/modules.html#pymisp.MISPAttribute.malware_binary.

Alternatively, you have the attribute UUID, use the get_attribute method (https://pymisp.readthedocs.io/en/latest/modules.html#pymisp.PyMISP.get_attribute) , with pythonify to True, and call malware_binary on the response.

Again, that's something you want to bubble up to your vendor, this approach always existed and I have no idea what they used that went away (but it was at least 3 years ago).

[nostripe]

Thanks a lot! I will implement that logic tomorrow and tell you about the outcome :)