From 53dd49102cc2ec14a5542cfd99cc1e57c8f56c6a Mon Sep 17 00:00:00 2001 From: elhoim Date: Mon, 31 Aug 2026 00:58:04 +0000 Subject: [PATCH] fix: [lastline_api] fix MITRE ATT&CK galaxy tag operand order _get_mitre_techniques() built the misp-galaxy:mitre-attack-pattern tag as "{id} - {name}" from (id, name) tuples, whereas the established convention used elsewhere in the codebase (joe_parser.py) and by the MISP galaxy cluster values themselves is "{name} - {id}". With the operands reversed, every MITRE technique tag Lastline produces fails to match any galaxy cluster, so the tag is imported as a plain string rather than resolving to the corresponding ATT&CK pattern. Verified with py_compile and the full pytest suite against a live modules server on port 6763: 160 passed, 4 skipped, 5 subtests passed, 1 failed (test_macvendors, HTTP 429 rate limit from the third-party MacVendors API, unrelated to this change and reproduced in isolation as a pass when run alone). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8 --- misp_modules/lib/lastline_api.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misp_modules/lib/lastline_api.py b/misp_modules/lib/lastline_api.py index 619762bc..a38d9769 100644 --- a/misp_modules/lib/lastline_api.py +++ b/misp_modules/lib/lastline_api.py @@ -734,7 +734,7 @@ def __init__(self): @staticmethod def _get_mitre_techniques(result): return [ - 'misp-galaxy:mitre-attack-pattern="{} - {}"'.format(w[0], w[1]) + 'misp-galaxy:mitre-attack-pattern="{} - {}"'.format(w[1], w[0]) for w in sorted( set( [