Does the REST search for attributes include event tags just like on GUI screen?

[chrisinmtown]

Greetings to the MISP team.

Please tell me how to invoke the PyMISP client to get the same behavior as the GUI search attribute screen when searching by tag. On that screen, the tags text box has the explanation "Having tag or being an attribute of an event having the tag". It's the latter part I can't seem to figure out: "being an attribute of an event having the tag". Or maybe someone can just confirm, is this the default behavior?

Basically I need to search for attributes by event tag. Stated differently, the attributes don't have the tag, only the parent events. If I enter that tag on the GUI search attribute page, the result has attributes as I expect. However in my initial attempts with the PyMISP client (maybe I should say REST API?), I got no results when setting parameters controller='attributes' and tags=['my-special-tag']. I tried setting the search-function parameter include_event_tags but that shot in the dark didn't work out.

I hope I'm not doing something silly, or missing something that's right in front of me. Thanks in advance!

[Rafiot]

I think the test suite is doing what you want:
https://github.com/MISP/PyMISP/blob/main/tests/testlive_comprehensive.py#L412

Have you tried with tags='my-special-tag'? There might be an issue with a list containing a single entry.

[chrisinmtown]

Thanks for the reply @Rafiot. That test seems to focus on user permissions; i.e., who can see what. Is there an easy to know whether the tags used in the search like tlp:white___test are attribute or event tags?

[Rafiot]

Attributes are (supposed to be) inheriting events tags, so if you have that tag either at event or at attribute level, it should be in the response. If it is not, it is most probably a bug.

The other thing to make sure is that the tag is not limited to a specific user/org on MISP side, and the API key you're using is another user/org.