Skip to content

[Bug] Hash observables are not correctly export to MISP #1644

Closed
@To-om

Description

@To-om

Request Type

Bug

Work Environment

TheHive 4.0.0

Problem Description

When a hash observable is exported to MISP, its type is chosen randomly among the hashes supported by MISP (x509-fingerprint-sha256, imphash, hassh-md5, ...). If the size of the data doesn't match the selected hash type, MISP reject the observable and attribute is not created.

The solution is to hardcode the hash type according the size of the data:

  • 32: md5
  • 40: sha1
  • 56: sha224
  • 64: sha256
  • 96: sha384
  • 128: sha512

Metadata

Metadata

Assignees

Labels

TheHive4TheHive4 related issuesbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions