PYMisp.search return empty list with the eventinfo argument.

[Corbax91]

Hello,

I am trying to get events and attributs of WannaCry. For this, i wanted to use the search function to get events where the word "WannaCry" is on the "info" label like we see in the screen :

When i try to use the Pymisp.search like this :

events = misp.search(eventinfo='WannaCry').

My Object "events" is empty. I already tryed with the parameter "controller='events'" and with a limit.

Thank you for reading this issue.

[Rafiot]

Just checking if it makes a difference: have you tried searching *wannacry* (with "*")?

[Corbax91]

Just checking if it makes a difference: have you tried searching *wannacry* (with "*")?

Thank you for your reply, unfortunately even after several tests I get an empty list (trying with the info or eventinfo argument, with a limit, with the controller or with another search keyword).

Maybe it is on my point, I got the MISP 2.5 installed with the provided installation script on a Ubuntu server 24.04 (I installed 3 server with MISP on different computers and i got the same problem).

Thank you again.

[Rafiot]

My bad, it should be %wannacry%

[Corbax91]

My bad, it should be %wannacry%

Also not workingsorry

[Rafiot]

So I'm slightly confused, because events = misp.search(eventinfo="%Wannacry%", page=1, limit=10) works for me.

Which version of MISP are you on? And PyMISP? Is there any other message?

[Corbax91]

So I'm slightly confused, because events = misp.search(eventinfo="%Wannacry%", page=1, limit=10) works for me.

Which version of MISP are you on? And PyMISP? Is there any other message?

Oh, only when giving the page as parameter is working. Sorry about that, i did not checked with this arguments. I was on MISP 2.5.10 and python 3.12. Thank you for the respond and the time giving to me.

[Rafiot]

I added the page and limit keys because I was getting too many responses and it timed out. It should also work without it.

I'll play with it a bit more.

[Corbax91]

I added the page and limit keys because I was getting too many responses and it timed out. It should also work without it.

I'll play with it a bit more.

That actually working for me too, thank you for your respond 😃.