fix: attach pdfs to reports

cs_misp_import/intel_client.py

@@ -52,7 +52,11 @@ def __init__(self,
         self.valid_report_types = [x.name.lower() for x in ReportType]
         self.request_size_limit = api_request_max
         self.log = logger
-
+
+    def get_report_pdf(self, report_id):
+        return self.falcon.get_report_pdf(report_id)
+
+
     def get_reports(self, start_time, report_filter: str = None):
         """Get all the reports that were updated after a certain moment in time (UNIX).
 

cs_misp_import/report_type.py

@@ -15,6 +15,8 @@ class ReportType(Enum):
     CSMR = "Monthly Report"
     CSTA = "Threat Assessment"
     CSWR = "Weekly Report"
+    CSECR = "Courtesy Report"
+    CSID = "Intrusion Digest"
     NOTICE = "Notice"
     GTAC = "Unmapped"
     TEST = "Test Report"

cs_misp_import/reports.py

@@ -15,6 +15,7 @@
 from logging import Logger
 import os
 import time
+from io import BytesIO 
 import concurrent.futures
 try:
     from pymisp import MISPObject, MISPEvent, MISPAttribute, ExpandedPyMISP, PyMISPError
@@ -523,22 +524,34 @@ def add_victim_detail(self, report: dict, event: MISPEvent) -> MISPEvent:
         return event
 
     def add_report_content(self, report: dict, event: MISPEvent, details: dict, report_id: str, seen: dict) -> MISPEvent:
-        attributes: list[MISPAttribute] = []
         rpt_cat = "Internal reference"
         short_desc = details.get("short_description")
         if not short_desc:
             short_desc = report.get("short_description")
-        if short_desc:
-            rpt = MISPObject("report")
-            if report_id:
-                attributes.append(rpt.add_attribute("case-number", report_id, category=rpt_cat, disable_correlation=True, **seen))
-            attributes.append(rpt.add_attribute("type", "Report", category=rpt_cat, disable_correlation=True, **seen))
-            attributes.append(rpt.add_attribute("summary", short_desc, category=rpt_cat, disable_correlation=True, **seen))
-            attributes.append(rpt.add_attribute("link", report.get("url"), disable_correlation=True, **seen))
-            if details.get("attachments"):
-                for attachment in details.get("attachments"):
-                    attributes.append(rpt.add_attribute("report-file", attachment.get("url"), disable_correlation=True, **seen))
-            event.add_object(rpt)
+
+        rpt = MISPObject("report")
+        rpt.add_attribute("case-number", report_id, category=rpt_cat, disable_correlation=True, **seen)
+        rpt.add_attribute("type", "Report", category=rpt_cat, disable_correlation=True, **seen)
+        rpt.add_attribute("summary", short_desc, category=rpt_cat, disable_correlation=True, **seen)
+        rpt.add_attribute("link", report.get("url"), disable_correlation=True, **seen)
+
+        pdfreport = self.intel_api_client.get_report_pdf(report.get('id'))
+
+        attachments = details.get("attachments",[]) #CSA CSIT
+        if not attachments:
+            attachments = report.get("attachments",[]) #CSECR CSDR CSID
+
+        if len(attachments) == 1:
+            pdfreport = self.intel_api_client.get_report_pdf(report.get('id'))
+            if isinstance(pdfreport, bytes):
+                rpt.add_attribute("report-file", attachments[0].get("url"), data=BytesIO(pdfreport), disable_correlation=True, **seen)
+            else:
+                self.log.error("Failed to download attachment for report id: %s", report.get('id'))
+        else:
+            for attachment in details.get("attachments", []):
+                rpt.add_attribute("report-file", attachment.get("url"), disable_correlation=True, **seen)
+
+        event.add_object(rpt)
 
         # Report Annotation and full text
         rich_desc = details.get("rich_text_description", None)
@@ -547,15 +560,14 @@ def add_report_content(self, report: dict, event: MISPEvent, details: dict, repo
         if long_desc or rich_desc:
             # Moving over to just using the event report for the MD formatted content
             if rich_desc:
-                rich_desc = rich_desc
-            md_version = markdownify(rich_desc)
+                md_version = markdownify(rich_desc)
             if not md_version:
                 md_version = long_desc
             if not md_version:
                 md_version = reg_desc
 
             md_version = md_version.replace("\t", "").replace("        ", "").replace("   ", "")
-            
+
             event.add_event_report(report.get("name"), md_version)
 
         return event
@@ -615,4 +627,4 @@ def create_event_from_report(self, report, report_details, indicator_list) -> MI
         else:
             self.log.warning("Report %s missing name field.", report.get('id'))
 
-        return event
+        return event