Skip to content

Bug: send_analysis_batch defaults TLP to "WHITE" instead of "CLEAR" #277

@mannubaveja007

Description

@mannubaveja007

Description

In send_analysis_batch (pyintelowl.py, line 457), the TLP field defaults to "WHITE":

obj.get("tlp", "WHITE"),

However, all other methods in the codebase (such as send_file_analysis_request and send_observable_analysis_request) default the TLP value to "CLEAR".

This creates inconsistent behavior:

  • A batch job submitted without specifying a tlp gets WHITE.
  • A direct CLI request defaults to CLEAR.

Steps to Reproduce

  1. Create a batch JSON file without a tlp field.
  2. Run:
pyintelowl analyse batch <file>
  1. Observe that the submitted job is assigned TLP WHITE instead of CLEAR.

Expected Behavior

The default TLP value should be "CLEAR" to maintain consistency with other request methods.


Proposed Fix

Update line 457 in pyintelowl.py.

# Before
obj.get("tlp", "WHITE"),

# After
obj.get("tlp", "CLEAR"),

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions