Merge pull request #348 from MISP/fix-misp-exports-first-last-seen

fix: export first_seen, last_seen in ISO format, drop null attributes

Author: righel

api/app/repositories/exports.py

@@ -283,14 +283,46 @@ def _strip_ids(obj: dict) -> None:
         obj.pop("uuid", None)
         obj.pop("id", None)
 
+    # first_seen/last_seen are stored as epoch seconds; MISP serializes them as
+    # microsecond-precision ISO-8601 strings (e.g. "2026-06-19T00:00:00.000000+00:00").
+    def _format_seen(obj: dict) -> None:
+        for field in ("first_seen", "last_seen"):
+            value = obj.get(field)
+            if value is None:
+                continue
+            try:
+                obj[field] = datetime.fromtimestamp(
+                    int(value), tz=timezone.utc
+                ).isoformat(timespec="microseconds")
+            except (ValueError, TypeError, OverflowError) as exc:
+                logger.debug(
+                    "Unable to format %s value %r as timestamp in MISP export: %s",
+                    field,
+                    value,
+                    exc,
+                )
+
     event = payload.get("Event", {})
     _strip_ids(event)
     for attribute in event.get("Attribute", []):
         _strip_ids(attribute)
+        _format_seen(attribute)
     for misp_object in event.get("Object", []):
         _strip_ids(misp_object)
+        _format_seen(misp_object)
         for attribute in misp_object.get("Attribute", []):
             _strip_ids(attribute)
+            _format_seen(attribute)
+
+    # Drop keys with null values so the exported MISP JSON stays compact.
+    def _drop_nulls(obj):
+        if isinstance(obj, dict):
+            return {k: _drop_nulls(v) for k, v in obj.items() if v is not None}
+        if isinstance(obj, list):
+            return [_drop_nulls(v) for v in obj]
+        return obj
+
+    payload = _drop_nulls(payload)
 
     content = json.dumps(payload, default=str, indent=2).encode("utf-8")
     return content, "json", "application/json", len(attributes)

api/app/tests/api/test_exports.py

@@ -351,13 +351,15 @@ def test_run_export_misp_format(
 
         # Two attributes from two different misp-workbench events — they should
         # be merged into a single MISP event named after the export.
+        first_seen_epoch = int(datetime(2026, 6, 19, tzinfo=timezone.utc).timestamp())
         hits = [
             {
                 "uuid": "11111111-1111-4111-8111-111111111111",
                 "type": "ip-dst",
                 "value": "1.2.3.4",
                 "category": "Network activity",
                 "event_uuid": "aaaaaaaa-1111-4111-8111-111111111111",
+                "first_seen": first_seen_epoch,
             },
             {
                 "uuid": "22222222-2222-4222-8222-222222222222",
@@ -396,6 +398,17 @@ def test_run_export_misp_format(
             assert "uuid" not in event and "id" not in event
             for attr in event["Attribute"]:
                 assert "uuid" not in attr and "id" not in attr
+                # null-valued fields are dropped from the MISP output.
+                assert None not in attr.values()
+            # first_seen is emitted as a microsecond ISO-8601 string.
+            seen = {
+                a["value"]: a.get("first_seen") for a in event["Attribute"]
+            }
+            assert seen["1.2.3.4"] == "2026-06-19T00:00:00.000000+00:00"
+            # the attribute without first_seen has it dropped entirely.
+            assert "first_seen" not in next(
+                a for a in event["Attribute"] if a["value"] == "5.6.7.8"
+            )
         finally:
             db.delete(export)
             db.commit()

docs/features/exports.md

@@ -36,7 +36,10 @@ can always fetch the same URL for the latest results.
     different misp-workbench events. It requires a **distribution** level and
     keeps correlation enabled. The `uuid` and `id` fields are stripped from the
     event and its attributes, so importing the file always creates fresh
-    records rather than colliding with existing ones.
+    records rather than colliding with existing ones. `first_seen`/`last_seen`
+    are emitted as microsecond ISO-8601 strings
+    (e.g. `2026-06-19T00:00:00.000000+00:00`), and any field with a `null`
+    value is omitted to keep the output compact.
 
 !!! note "STIX limits"
     STIX 2.1 conversion is CPU-intensive, so STIX exports are capped at