MISPWarningLists Service

This Assemblyline service runs in the REVIEW stage and checks submission tag values against PyMISPWarningLists.

Service Details

Execution

The service inspects incoming review-stage tags and performs warning list lookups on tag values. It is intended for contextual triage and does not require file content.

When a value matches one or more warning lists, the service creates one ResultTableSection per matched value with the title:

Warning list hits for <tag_key>: <tag_value> (score: <tag_score>)

The result table includes:

• Type
• Name
• Version
• Description

The service applies a low-impact heuristic to indicate the value is likely expected/noisy context rather than a direct malicious signal.

Runtime Behavior

• Runs in REVIEW stage.
• Uses tags from request.task.tags (uses_tags: true).
• Reads tag scores when present (uses_tag_scores: true).
• Does not require file content (file_required: false).
• Disables result caching because behavior depends on submission context (disable_cache: true).

Current Limitations

• Matching attributes from PyMISPWarningLists are not currently displayed.
• The matched tag value is not currently added back as a regular result tag.

Configuration

Configuration is defined in service_manifest.yml.

Service Configuration

Name	Description
slow_search	Use slower but more complete matching behavior in PyMISPWarningLists.
check_tag_keys	Wildcard patterns of tag keys to include. Empty list means all keys are eligible.
ignore_tag_keys	Wildcard patterns of tag keys to skip. Empty list means no keys are excluded.
min_tag_score	Minimum score required for a tag value to be checked.
max_tag_value_length	Maximum tag value length accepted for lookup. Longer values are skipped.
max_hits_per_value	Maximum warning-list hits shown for a single tag value.

Image variants and tags

Assemblyline services are built from the Assemblyline service base image, which is based on Debian 11 with Python 3.11.

Assemblyline services use the following tag definitions:

Tag Type	Description	Example Tag
latest	The most recent build (can be unstable).	latest
build_type	The type of build used. dev is the latest unstable build. stable is the latest stable build.	stable or dev
series	Complete build details, including version and build type: version.buildType.	4.5.stable, 4.5.1.dev3

Running this service

This is an Assemblyline service. It is designed to run as part of the Assemblyline framework.

If you would like to test this service locally, you can run the Docker image directly from a shell:

docker run \
	--name MISPWarningLists \
	--env SERVICE_API_HOST=http://`ip addr show docker0 | grep "inet " | awk '{print $2}' | cut -f1 -d"/"`:5003 \
	--network=host \
	ghcr.io/tkcert/assemblyline-service-misp-warninglists

To add this service to your Assemblyline deployment, follow this guide.

Documentation

General Assemblyline documentation can be found at: https://cybercentrecanada.github.io/assemblyline4_docs/