Fix observable tagging for MISP export

thehive-misp/app/connectors/misp/JsonFormat.scala

@@ -82,7 +82,7 @@ object JsonFormat {
       "type"     → attribute.tpe,
       "value"    → attribute.value.fold[String](identity, _.name),
       "comment"  → attribute.comment,
-      "Tag"      → Json.arr(Json.obj("name" → tlpWrites.writes(attribute.tlp)))
+      "Tag" → JsArray((attribute.tags.map(JsString.apply) :+ tlpWrites.writes(attribute.tlp)).map(t ⇒ Json.obj("name" -> t)))
     )
   }
 

thehive-misp/app/connectors/misp/MispConfig.scala

@@ -59,7 +59,8 @@ class MispConfig(val interval: FiniteDuration, val connections: Seq[MispConnecti
         excludedTags,
         whitelistTags,
         purpose,
-        exportCaseTags
+        exportCaseTags,
+        exportAttributeTags
       )
     )
 

thehive-misp/app/connectors/misp/MispConnection.scala

@@ -29,7 +29,8 @@ case class MispConnection(
     excludedTags: Set[String],
     whitelistTags: Set[String],
     purpose: MispPurpose.Value,
-    exportCaseTags: Boolean
+    exportCaseTags: Boolean,
+    exportAttributeTags: Boolean
 ) {
 
   private[MispConnection] lazy val logger = Logger(getClass)

thehive-misp/app/connectors/misp/MispExport.scala

@@ -115,7 +115,7 @@ class MispExport @Inject()(
 
   def exportAttribute(mispConnection: MispConnection, eventId: String, attribute: ExportedMispAttribute): Future[Artifact] = {
     val mispResponse = attribute match {
-      case ExportedMispAttribute(_, _, _, _, Right(attachment), comment) ⇒
+      case ExportedMispAttribute(_, _, _, _, _, Right(attachment), comment) ⇒
         attachmentSrv
           .source(attachment.id)
           .runReduce(_ ++ _)
@@ -138,11 +138,19 @@ class MispExport @Inject()(
       case response if response.status / 100 == 2 ⇒
         // then add tlp tag
         // doesn't work with file artifact (malware sample attribute)
-        (response.json \ "Attribute" \ "id")
+        (response.json \ "Attribute" \ "uuid")
           .asOpt[String]
           .foreach { attributeId ⇒
-            mispConnection("/attributes/addTag")
-              .post(Json.obj("attribute" → attributeId, "tag" → tlpWrites.writes(attribute.tlp)))
+            val attrib_tlp=tlpWrites.writes(attribute.tlp)
+            mispConnection(s"/tags/attachTagToObject/$attributeId/$attrib_tlp")
+              .post("")
+            if (mispConnection.exportAttributeTags){
+                for (tag <- attribute.tags){
+                    logger.debug(s"Sending POST request for ${tag}")
+                    mispConnection(s"/tags/attachTagToObject/$attributeId/$tag")
+                      .post("")
+            }
+            }
           }
         attribute.artifact
       case response ⇒

thehive-misp/app/connectors/misp/MispModel.scala

@@ -40,6 +40,7 @@ case class ExportedMispAttribute(
     artifact: Artifact,
     tpe: String,
     category: String,
+    tags: Seq[String],
     tlp: Long,
     value: Either[String, Attachment],
     comment: Option[String]

thehive-misp/app/connectors/misp/MispSrv.scala

@@ -109,7 +109,7 @@ class MispSrv @Inject()(
             logger.error(s"Artifact $artifact has neither data nor attachment")
             sys.error("???")
         }
-        ExportedMispAttribute(artifact, tpe, category, artifact.tlp(), value, artifact.message())
+        ExportedMispAttribute(artifact, tpe, category, artifact.tags(), artifact.tlp(), value, artifact.message())
       }
       .runWith(Sink.seq)
   }