Only return attributes that contain the tag specified in search or that belong to an event that contains that tag

[josephtillman11]

I am using the following to filter for specific events:

from pymisp import PyMISP
...
misp = PyMISP(config.misp_domain, config.misp_key, config.misp_verifycert, False)
result = misp.search(controller='events', return_format='json', **config.misp_event_filters)

my config.misp_event_filters is the following JSON:

{
  "published": 1,
  "publish_timestamp": "7d",
  "tags":["tag1","tag2"],
  "includeEventTags": True
}

I am expecting it to return attributes that have either 'tag1' or 'tag2' or attributes that belong to an event where the event contains either 'tag1' or 'tag2'.

I am seeing some attributes returned that do not contain either "tag1" or "tag2" in the MISP GUI, nor does the event they belong contain either of those tags. I have noticed that there is another attribute belonging to the same event that does have one of those tags. Is this why these are being returned as well? Does it work like:

Any event will be returned if either:

1. The event itself is tagged with tag1 or tag2, or
2. Any attribute in the event is tagged with tag1 or tag2.

[Rafiot]

If I'm not mistaken, it is expected: you're searching on the events controller, so you get all the events that are either tagged with said tag, or have attributes with the tag.

If you only want to get attributes with the tag (or part of an event tagged), you need to use the attributes controller.