Repository: OpenCTI-Platform/connectors

Issue:
[MISP] ERROR:root:search() keywords must be strings
## Description
I want to integrate MISP with OpenCTI. The connector errors and doesn't import events.
How do I debug this?

## Environment

1. OS (where OpenCTI server runs): https://github.com/OpenCTI-Platform/docker host: Debian 10
2. OpenCTI version: 4.3.0
3. OpenCTI client: 4.3.0? not sure and think it's irrelevant
4. Other environment details:
MISP: Latest commit on git, commit id 4474dcc, so probably version 2.4.140
misp-connector: 4.3.0

## Reproducible Steps

Steps to create the smallest reproducible scenario:
1. Setup OpenCTI using docker
2. Setup MISP connector in docker-compose.yml with correct MISP URL, MISP API KEY and following settings
```
      - OPENCTI_URL=${OPENCTI_URL} # I confirm this is correct
      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN} # I confirm this is correct
      - CONNECTOR_ID=${CONNECTOR_MISP_ID} # 1d67ffcf-5741-467f-844f-96f436440775
      - CONNECTOR_TYPE=EXTERNAL_IMPORT
      - CONNECTOR_NAME=MISP
      - CONNECTOR_SCOPE=misp
      - CONNECTOR_CONFIDENCE_LEVEL=3
      - CONNECTOR_UPDATE_EXISTING_DATA=false
      - CONNECTOR_LOG_LEVEL=info
      - MISP_URL=${CONNECTOR_MISP_URL} # I confirm this is correct
      - MISP_KEY=${CONNECTOR_MISP_API} # I confirm this is correct
      - MISP_SSL_VERIFY=False
      - MISP_CREATE_REPORTS=True
      - MISP_REPORT_CLASS=MISP Event
      - MISP_IMPORT_FROM_DATE=2000-01-01
      - MISP_IMPORT_TAGS=opencti:import,type:osint
      - MISP_INTERVAL=1
```
3. Create event in MISP with opencti:import or type:osint tag, won't get imported

## Expected Output

`INFO:root:MISP returned 1 events.`

## Actual Output

```
INFO:root:Fetching MISP events with args: {"tags": {"OR": ["opencti:import", "type:osint"]}, "null": 1616075539, "limit": 50, "page": 1}
ERROR:root:search() keywords must be strings
ERROR:root:search() keywords must be strings
INFO:root:MISP returned 0 events.
INFO:root:Connector successfully run (0 events have been processed), storing last_run as 1616075599
INFO:root:Reporting work update_received opencti-work--c1bc4bd2-4101-4430-95f4-da9e33c134b8
INFO:root:Initiate work for 1d67ffcf-5741-467f-844f-96f436440775
INFO:root:Connector last run: 2021-03-18 13:53:19
```
 
## Additional information

https://github.com/OpenCTI-Platform/connectors/blob/master/misp/src/misp.py#L215
I'm positive the error is from here, referencing the PyMISP api here:
https://github.com/MISP/PyMISP/blob/main/pymisp/api.py#L2207

the function gets called as
`events = self.misp.search("events", **kwargs)`
where json.dumps(kwargs) is:
```json
{"tags": {"OR": ["opencti:import", "type:osint"]}, "null": 1616075539, "limit": 50, "page": 1}
```

but when trying the following script inside the connector-misp container:
```python

import json
from pymisp import ExpandedPyMISP

misp = ExpandedPyMISP(url="MISP_URL", key="MISP_API_KEY", ssl=False, debug=False)
kwargs = json.loads('{"tags": {"OR": ["opencti:import", "type:osint"]}, "null": 1616075539, "limit": 50, "page": 1}')
events = misp.search("events", **kwargs)
print(events)
```

everything works correctly

This is is my temporary fix:
https://github.com/OpenCTI-Platform/connectors/blob/master/misp/src/misp.py#L215
will be
```python
self.helper.log_info(
    "Fetching MISP events with args: " + json.dumps(kwargs)
)
kwargs = json.loads(json.dumps(kwargs))
events = []
try:
    events = self.misp.search("events", **kwargs)
except Exception as e:
    self.helper.log_error(str(e))
    try:
        events = self.misp.search("events", **kwargs)
    except Exception as e:
        self.helper.log_error(str(e))
```


Discussion:

Resolving patch:
diff --git a/misp/src/misp.py b/misp/src/misp.py
--- a/misp/src/misp.py
+++ b/misp/src/misp.py
@@ -206,6 +206,7 @@ def run(self):
                 self.helper.log_info(
                     "Fetching MISP events with args: " + json.dumps(kwargs)
                 )
+                kwargs = json.loads(json.dumps(kwargs))
                 events = []
                 try:
                     events = self.misp.search("events", **kwargs)


Test patch: