[Bug] Hash observables are not correctly export to MISP

[To-om]

Request Type

Bug

Work Environment

TheHive 4.0.0

Problem Description

When a hash observable is exported to MISP, its type is chosen randomly among the hashes supported by MISP (x509-fingerprint-sha256, imphash, hassh-md5, ...). If the size of the data doesn't match the selected hash type, MISP reject the observable and attribute is not created.

The solution is to hardcode the hash type according the size of the data:

• 32: md5
• 40: sha1
• 56: sha224
• 64: sha256
• 96: sha384
• 128: sha512