Some fixes to misp.py

Added origdata and test option to to_idea.
Fixed CreateTime conversion, when publish_timestamp = 0.
Fixed DetectTime converstion, when there are no Attributes or Objects in MISP event.

idea/misp.py

@@ -6,6 +6,7 @@
 from uuid import uuid4
 import time
 import itertools
+from _datetime import datetime
 
 misp_to_idea_dictionary = {}
 
@@ -221,18 +222,19 @@ def process_misp_object(misp_object, attach_counter):
         return None, None
 
 
-def to_idea(misp_event, idea_id=None):
+def to_idea(misp_event, idea_id=None, test=False, origdata=False):
     """
     Creates whole IDEA message from MISP event
     :param misp_event: the misp event
     :param idea_id: uuid of IDEA message (when needs to be preset)
+    :param test: add Test into IDEA['Category']
+    :param origdata: add original data to attachment
     :return: new converted IDEA message
     """
     idea_event = {
         'Format': "IDEA0",
         'ID': str(idea_id) if idea_id is not None else str(uuid4()),
         'Category': [],
-        'CreateTime': convert_epoch_to_utc(misp_event['publish_timestamp']),
         'Description': misp_event['info'],
         'Source': [],
         'Target': [],
@@ -251,15 +253,24 @@ def to_idea(misp_event, idea_id=None):
     # cannot determine IDEA Category, cannot convert
     if not idea_event['Category']:
         return None
+    if test:
+        idea_event['Category'].append("Test")
+
+    if not int(misp_event['publish_timestamp']):
+        idea_event['CreateTime'] = datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
+    else:
+        idea_event['CreateTime'] = convert_epoch_to_utc(misp_event['publish_timestamp'])
 
     attach_counter = 0
 
     timestamps = itertools.chain(find('timestamp', misp_event['Attribute']),
                                  find('timestamp', misp_event['Object']))
+    try:
         oldest_timestamp = min(map(int, timestamps))
-
-    # fill it to IDEA
         idea_event['DetectTime'] = convert_epoch_to_utc(oldest_timestamp)
+    except ValueError:
+        # no object and attributes --> min() ValueError for empty sequence
+        idea_event['DetectTime'] = misp_event['date'] + "T00:00:00Z"
 
     # fill in info about organizations
     idea_event['Node'] = [
@@ -287,4 +298,12 @@ def to_idea(misp_event, idea_id=None):
             if key == "Attach":
                 attach_counter += 1
 
+    if origdata:
+        idea_event['Attach'].append({
+            'Handle': "att" + str(attach_counter),
+            'Note': "original data",
+            'Content': misp_event
+        })
+        attach_counter += 1
+
     return idea_event