pymisp 2.5.12__tar.gz → 2.5.17.1__tar.gz

{pymisp-2.5.12 → pymisp-2.5.17.1}/PKG-INFO

@@ -1,8 +1,9 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: pymisp
-Version: 2.5.12
+Version: 2.5.17.1
 Summary: Python API for MISP.
-License: BSD-2-Clause
+License-Expression: BSD-2-Clause
+License-File: LICENSE
 Author: Raphaël Vinot
 Author-email: raphael.vinot@circl.lu
 Requires-Python: >=3.9.2,<4.0
@@ -11,13 +12,13 @@ Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: Science/Research
 Classifier: Intended Audience :: Telecommunications Industry
-Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Internet
 Classifier: Topic :: Security
 Provides-Extra: brotli
@@ -29,22 +30,22 @@ Provides-Extra: pdfexport
 Provides-Extra: url
 Provides-Extra: virustotal
 Requires-Dist: RTFDE (>=0.1.2.1) ; (python_version <= "3.9") and (extra == "email")
-Requires-Dist: beautifulsoup4 (>=4.13.4) ; extra == "openioc"
+Requires-Dist: beautifulsoup4 (>=4.13.5) ; extra == "openioc"
 Requires-Dist: deprecated (>=1.2.18)
-Requires-Dist: docutils (>=0.21.2) ; (python_version >= "3.11") and (extra == "docs")
-Requires-Dist: extract_msg (>=0.54.1) ; extra == "email"
-Requires-Dist: lief (>=0.16.5) ; extra == "fileobjects"
+Requires-Dist: docutils (<0.22) ; (python_version >= "3.11") and (extra == "docs")
+Requires-Dist: extract_msg (>=0.55.0) ; extra == "email"
+Requires-Dist: lief (>=0.17.0) ; extra == "fileobjects"
 Requires-Dist: myst-parser (>=4.0.1) ; (python_version >= "3.11") and (extra == "docs")
 Requires-Dist: oletools (>=0.60.2) ; extra == "email"
 Requires-Dist: pydeep2 (>=0.5.1) ; extra == "fileobjects"
 Requires-Dist: pyfaup (>=1.2) ; extra == "url"
 Requires-Dist: python-dateutil (>=2.9.0.post0)
 Requires-Dist: python-magic (>=0.4.27) ; extra == "fileobjects"
-Requires-Dist: reportlab (>=4.4.0) ; extra == "pdfexport"
-Requires-Dist: requests (>=2.32.3)
+Requires-Dist: reportlab (>=4.4.3) ; extra == "pdfexport"
+Requires-Dist: requests (>=2.32.5)
 Requires-Dist: sphinx (>=8.2.3) ; (python_version >= "3.11") and (extra == "docs")
 Requires-Dist: sphinx-autodoc-typehints (>=3.2.0) ; (python_version >= "3.11") and (extra == "docs")
-Requires-Dist: urllib3 (>=2.4.0) ; extra == "brotli"
+Requires-Dist: urllib3 (>=2.5.0) ; extra == "brotli"
 Requires-Dist: validators (>=0.35.0) ; extra == "virustotal"
 Project-URL: Documentation, https://pymisp.readthedocs.io
 Project-URL: Repository, https://github.com/MISP/PyMISP

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/__init__.py

@@ -77,7 +77,7 @@ __all__ = ['PyMISP', 'register_user', 'AbstractMISP', 'MISPTag',
            'MISPOrganisationBlocklist', 'MISPEventReport', 'MISPCorrelationExclusion',
            'MISPDecayingModel', 'MISPGalaxy', 'MISPGalaxyCluster', 'MISPGalaxyClusterElement',
            'MISPGalaxyClusterRelation', 'MISPNote', 'MISPOpinion', 'MISPRelationship',
-           'PyMISPError', 'NewEventError', 'NewAttributeError',
+           'PyMISPError', 'NewEventError', 'NewAttributeError', 'MISPServerError',
            'NoURL', 'NoKey', 'InvalidMISPObject', 'UnknownMISPObjectTemplate', 'PyMISPInvalidFormat',
            'Distribution', 'ThreatLevel', 'Analysis', 'ExpandedPyMISP'
            ]

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/abstract.py

@@ -383,7 +383,7 @@ class MISPTag(AbstractMISP):
 
     def from_dict(self, **kwargs) -> None:  # type: ignore[no-untyped-def]
         if kwargs.get('Tag'):
-            kwargs = kwargs.get('Tag')  # type: ignore[assignment]
+            kwargs = kwargs.get('Tag')
         super().from_dict(**kwargs)
 
     def _set_default(self) -> None:

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/api.py

@@ -129,10 +129,10 @@ def brotli_supported() -> bool:
     # urllib >= 1.25.1 includes brotli support
     version_splitted = version('urllib3').split('.')  # noqa: F811
     if len(version_splitted) == 2:
-        major, minor = version_splitted  # type: ignore
+        major, minor = version_splitted
         patch = 0
     else:
-        major, minor, patch = version_splitted  # type: ignore
+        major, minor, patch = version_splitted
     major, minor, patch = int(major), int(minor), int(patch)
     urllib3_with_brotli = (major == 1 and ((minor == 25 and patch >= 1) or (minor >= 26))) or major >= 2
 
@@ -1050,7 +1050,7 @@ class PyMISP:
             # At this point, we assume the user tried to add an attribute on an event they don't own
             # Re-try with a proposal
             if isinstance(attribute, (MISPAttribute, dict)):
-                return self.add_attribute_proposal(event_id, attribute, pythonify)  # type: ignore
+                return self.add_attribute_proposal(event_id, attribute, pythonify)
         if not (self.global_pythonify or pythonify) or 'errors' in new_attribute:
             return new_attribute
         a = MISPAttribute()
@@ -1563,7 +1563,7 @@ class PyMISP:
             if isinstance(warninglist_id, list):
                 query['id'] = warninglist_id
             else:
-                query['id'] = [warninglist_id]  # type: ignore
+                query['id'] = [warninglist_id]
         if warninglist_name is not None:
             if isinstance(warninglist_name, list):
                 query['name'] = warninglist_name
@@ -3032,7 +3032,7 @@ class PyMISP:
         if return_format == 'csv':
             normalized_response_text = self._check_response(response)
             if (self.global_pythonify or pythonify) and not headerless:
-                return self._csv_to_dict(normalized_response_text)  # type: ignore
+                return self._csv_to_dict(normalized_response_text)
             else:
                 return normalized_response_text
         elif return_format not in ['json', 'yara-json']:
@@ -3060,7 +3060,7 @@ class PyMISP:
                     to_return.append(me)
             elif controller == 'attributes':
                 # FIXME: obvs, this is hurting my soul. We need something generic.
-                for a in normalized_response['Attribute']:  # type: ignore[call-overload]
+                for a in normalized_response['Attribute']:
                     ma = MISPAttribute()
                     ma.from_dict(**a)
                     if 'Event' in ma:

{pymisp-2.5.12/pymisp/data/misp-objects/objects/flowintel-cm-case → pymisp-2.5.17.1/pymisp/data/misp-objects/objects/flowintel-case}/definition.json

@@ -88,9 +88,9 @@
       "ui-priority": 1
     }
   },
-  "description": "A case as defined by flowintel-cm.",
+  "description": "A case as defined by flowintel.",
   "meta-category": "misc",
-  "name": "flowintel-cm-case",
+  "name": "flowintel-case",
   "uuid": "19df57c7-b315-4fd2-84e5-d81ab221425e",
-  "version": 3
+  "version": 4
 }

{pymisp-2.5.12/pymisp/data/misp-objects/objects/flowintel-cm-task → pymisp-2.5.17.1/pymisp/data/misp-objects/objects/flowintel-task}/definition.json

@@ -78,9 +78,9 @@
       "ui-priority": 0
     }
   },
-  "description": "A task as defined by flowintel-cm.",
+  "description": "A task as defined by flowintel.",
   "meta-category": "misc",
-  "name": "flowintel-cm-task",
+  "name": "flowintel-task",
   "uuid": "2f525f6e-d3f2-4cb9-9ca0-f1160d99397d",
-  "version": 4
+  "version": 5
 }

{pymisp-2.5.12/pymisp/data/misp-objects/objects/flowintel-cm-task-note → pymisp-2.5.17.1/pymisp/data/misp-objects/objects/flowintel-task-note}/definition.json

@@ -27,9 +27,9 @@
       "ui-priority": 2
     }
   },
-  "description": "A task's note as defined by flowintel-cm.",
+  "description": "A task's note as defined by flowintel.",
   "meta-category": "misc",
-  "name": "flowintel-cm-task-note",
+  "name": "flowintel-task-note",
   "uuid": "2c6f6aba-48b6-482f-a810-81934d29be9a",
-  "version": 1
+  "version": 2
 }

pymisp-2.5.17.1/pymisp/data/misp-objects/objects/flowintel-task-resource/definition.json

@@ -0,0 +1,35 @@
+{
+  "attributes": {
+    "origin-url": {
+      "description": "Origin of the task",
+      "disable_correlation": true,
+      "misp-attribute": "url",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "resource": {
+      "description": "Resources of the task",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 0
+    },
+    "resource-uuid": {
+      "description": "UUID of the resource",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 2
+    },
+    "task-uuid": {
+      "description": "UUID of the parent task",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 2
+    }
+  },
+  "description": "A task's note as defined by flowintel.",
+  "meta-category": "misc",
+  "name": "flowintel-task-resource",
+  "uuid": "dc1d5bae-3611-499c-bbd6-1ca3ad4048dd",
+  "version": 1
+}

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/data/misp-objects/objects/greynoise-ip/definition.json

@@ -4,59 +4,107 @@
       "description": "GreyNoise Actor",
       "disable_correlation": true,
       "misp-attribute": "text",
+      "ui-priority": 4
+    },
+    "asn": {
+      "description": "GreyNoise ASN",
+      "disable_correlation": true,
+      "misp-attribute": "AS",
+      "ui-priority": 3
+    },
+    "bot": {
+      "description": "GreyNoise Is Bot Flag",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
       "ui-priority": 1
     },
     "classification": {
       "description": "GreyNoise Classification",
       "disable_correlation": true,
       "misp-attribute": "text",
-      "ui-priority": 1
+      "ui-priority": 6
+    },
+    "domain": {
+      "description": "GreyNoise Domain",
+      "disable_correlation": false,
+      "misp-attribute": "domain",
+      "ui-priority": 6
     },
     "first-seen": {
       "description": "First Seen",
       "disable_correlation": true,
       "misp-attribute": "datetime",
-      "ui-priority": 2
+      "ui-priority": 5
     },
     "ip-src": {
       "description": "Source IP address of the network connection.",
       "misp-attribute": "ip-src",
-      "ui-priority": 1
+      "ui-priority": 7
     },
     "last-seen": {
       "description": "Last Seen",
       "disable_correlation": true,
       "misp-attribute": "datetime",
-      "ui-priority": 1
+      "ui-priority": 5
     },
     "link": {
       "description": "GreyNoise Visualizer Link",
       "disable_correlation": true,
       "misp-attribute": "link",
-      "ui-priority": 2
+      "ui-priority": 4
     },
     "noise": {
       "description": "GreyNoise Internet Scanning Flag",
       "disable_correlation": true,
       "misp-attribute": "text",
-      "ui-priority": 1
+      "ui-priority": 4
     },
     "provider": {
       "description": "GreyNoise Service Provider",
       "disable_correlation": true,
       "misp-attribute": "text",
-      "ui-priority": 1
+      "ui-priority": 4
+    },
+    "rdns": {
+      "description": "GreyNoise Reverse DNS Hostname",
+      "disable_correlation": false,
+      "misp-attribute": "hostname",
+      "ui-priority": 2
+    },
+    "rdns_parent": {
+      "description": "GreyNoise Reverse DNS Domain",
+      "disable_correlation": true,
+      "misp-attribute": "domain",
+      "ui-priority": 2
     },
     "riot": {
       "description": "GreyNoise Common Business Service Flag",
       "disable_correlation": true,
       "misp-attribute": "text",
+      "ui-priority": 4
+    },
+    "source_country": {
+      "description": "GreyNoise Source Country",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 3
+    },
+    "tor": {
+      "description": "GreyNoise Is Tor Flag",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
       "ui-priority": 1
     },
     "trust-level": {
       "description": "GreyNoise RIOT Trust Level",
       "disable_correlation": true,
       "misp-attribute": "text",
+      "ui-priority": 4
+    },
+    "vpn": {
+      "description": "GreyNoise Is VPN Flag",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
       "ui-priority": 1
     }
   },
@@ -67,5 +115,5 @@
     "ip-src"
   ],
   "uuid": "6B14A94A-46E4-4B82-B24D-0DBF8E8B3FD9",
-  "version": 1
+  "version": 2
 }

pymisp-2.5.17.1/pymisp/data/misp-objects/objects/network-data/definition.json

@@ -0,0 +1,167 @@
+{
+  "attributes": {
+    "counter": {
+      "description": "counter (ex.: bytes, packets, flows, events, etc)",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "multiple": true,
+      "ui-priority": 3
+    },
+    "data": {
+      "description": "network traffic (ex.: payload, log lines, etc)",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 0
+    },
+    "description": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "describe type/content of the network data",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 15
+    },
+    "dst_ASN": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "destination autonomous system number",
+      "disable_correlation": true,
+      "misp-attribute": "AS",
+      "multiple": true,
+      "ui-priority": 8
+    },
+    "dst_CC": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "destination country code",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 9
+    },
+    "dst_IP": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "destination IP address",
+      "misp-attribute": "ip-dst",
+      "multiple": true,
+      "ui-priority": 7
+    },
+    "dst_hostname": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "destination hostname",
+      "misp-attribute": "hostname",
+      "multiple": true,
+      "ui-priority": 5
+    },
+    "dst_port": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "destination port",
+      "disable_correlation": true,
+      "misp-attribute": "port",
+      "multiple": true,
+      "ui-priority": 6
+    },
+    "first_seen": {
+      "description": "timestamp of the first data seen",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 2
+    },
+    "last_seen": {
+      "description": "timestamp of the last data seen",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 1
+    },
+    "protocol": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "protocol (ex.: TCP, UDP, ICMP, TLS, HTTP, HTTPS, SIP, etc)",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 4
+    },
+    "src_ASN": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "source autonomous system number",
+      "disable_correlation": true,
+      "misp-attribute": "AS",
+      "multiple": true,
+      "ui-priority": 13
+    },
+    "src_CC": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "source country code",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 14
+    },
+    "src_IP": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "source IP address",
+      "misp-attribute": "ip-src",
+      "multiple": true,
+      "ui-priority": 12
+    },
+    "src_hostname": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "source hostname",
+      "misp-attribute": "hostname",
+      "multiple": true,
+      "ui-priority": 10
+    },
+    "src_port": {
+      "categories": [
+        "Network activity",
+        "External analysis"
+      ],
+      "description": "source port",
+      "disable_correlation": true,
+      "misp-attribute": "port",
+      "multiple": true,
+      "ui-priority": 11
+    }
+  },
+  "description": "network data, including payloads/logs, relevant timestamps, data volume and enrichment of the TCP/IP 5-tuple connection information.",
+  "meta-category": "network",
+  "name": "network-data",
+  "requiredOneOf": [
+    "src_IP",
+    "data"
+  ],
+  "uuid": "64d5949b-98ac-459d-83b8-4688f45795de",
+  "version": 2
+}

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/data/misp-objects/objects/original-imported-file/definition.json

@@ -9,6 +9,7 @@
         "STIX 1.1",
         "STIX 1.2",
         "STIX 2.0",
+        "STIX 2.1",
         "OpenIOC"
       ],
       "ui-priority": 1

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/data/misp-objects/objects/query/definition.json

@@ -27,7 +27,9 @@
         "Google search query",
         "Ariel Query Language (qradar)",
         "Grep",
-        "Devo LINQ"
+        "Devo LINQ",
+        "Microsoft Defender XDR",
+        "Sentinel Advanced Security Information Model"
       ],
       "ui-priority": 0
     },
@@ -49,5 +51,5 @@
     "query"
   ],
   "uuid": "006539b3-f68a-4a02-a213-e600762d39b5",
-  "version": 3
+  "version": 4
 }

{pymisp-2.5.12 → pymisp-2.5.17.1}/pymisp/mispevent.py

@@ -2,9 +2,9 @@ from __future__ import annotations
 
 from datetime import timezone, datetime, date
 import copy
+from dateutil.parser import parse
 import os
 import base64
-import sys
 from io import BytesIO, BufferedIOBase, TextIOBase
 from zipfile import ZipFile
 import uuid
@@ -111,12 +111,6 @@ class AnalystDataBehaviorMixin(AbstractMISP):
             self.add_relationship(**relationship)
 
 
-try:
-    from dateutil.parser import parse
-except ImportError:
-    logger.exception("Cannot import dateutil")
-
-
 def _make_datetime(value: int | float | str | datetime | date) -> datetime:
     if isinstance(value, (int, float)):
         # Timestamp
@@ -126,7 +120,7 @@ def _make_datetime(value: int | float | str | datetime | date) -> datetime:
             # faster
             value = datetime.fromisoformat(value)
         except Exception:
-            value = parse(value)  # type: ignore[arg-type]
+            value = parse(value)
     elif isinstance(value, datetime):
         pass
     elif isinstance(value, date):  # NOTE: date has to be *after* datetime, or it will be overwritten
@@ -399,7 +393,7 @@ class MISPAttribute(AnalystDataBehaviorMixin):
         if self.type == 'malware-sample':
             try:
                 # Ignore type, if data is None -> exception
-                with ZipFile(self.data) as f:  # type: ignore
+                with ZipFile(self.data) as f:
                     if not self.__is_misp_encrypted_file(f):
                         raise PyMISPError('Not an existing malware sample')
                     for name in f.namelist():
@@ -415,7 +409,12 @@ class MISPAttribute(AnalystDataBehaviorMixin):
 
     def __setattr__(self, name: str, value: Any) -> None:
         if name in ['first_seen', 'last_seen']:
-            _datetime = _make_datetime(value)
+            try:
+                _datetime = _make_datetime(value)
+            except Exception:
+                if value is not None:
+                    logger.warning(f'Invalid value ({value}) for {name}, skipping.')
+                return None
 
             # NOTE: the two following should be exceptions, but there are existing events in this state,
             # And we cannot dump them if it is there.
@@ -488,7 +487,7 @@ class MISPAttribute(AnalystDataBehaviorMixin):
             return self._malware_binary
         elif hasattr(self, 'malware_filename'):
             # Have a binary, but didn't decrypt it yet
-            with ZipFile(self.data) as f:  # type: ignore
+            with ZipFile(self.data) as f:
                 for name in f.namelist():
                     if not name.endswith('.filename.txt'):
                         with f.open(name, pwd=b'infected') as unpacked:
@@ -585,18 +584,13 @@ class MISPAttribute(AnalystDataBehaviorMixin):
         if self.type == 'datetime' and isinstance(self.value, str):
             try:
                 # Faster
-                if sys.version_info >= (3, 7):
-                    self.value = datetime.fromisoformat(self.value)
-                else:
-                    if '+' in self.value or '-' in self.value:
-                        self.value = datetime.strptime(self.value, "%Y-%m-%dT%H:%M:%S.%f%z")
-                    elif '.' in self.value:
-                        self.value = datetime.strptime(self.value, "%Y-%m-%dT%H:%M:%S.%f")
-                    else:
-                        self.value = datetime.strptime(self.value, "%Y-%m-%dT%H:%M:%S")
+                self.value = datetime.fromisoformat(self.value)
             except ValueError:
                 # Slower, but if the other ones fail, that's a good fallback
-                self.value = parse(self.value)
+                try:
+                    self.value = parse(self.value)
+                except Exception:
+                    raise NewAttributeError(f'{self.value} is not a valid datetime, the attribute is broken.')
 
         # Default values
         self.category = kwargs.pop('category', type_defaults['default_category'])
@@ -862,7 +856,12 @@ class MISPObject(AnalystDataBehaviorMixin):
 
     def __setattr__(self, name: str, value: Any) -> None:
         if name in ['first_seen', 'last_seen']:
-            value = _make_datetime(value)
+            try:
+                value = _make_datetime(value)
+            except Exception:
+                if value is not None:
+                    logger.warning(f'Invalid value ({value}) for {name}, skipping.')
+                return None
 
             if name == 'last_seen' and hasattr(self, 'first_seen') and self.first_seen > value:
                 logger.warning(f'last_seen ({value}) has to be after first_seen ({self.first_seen})')
@@ -1855,7 +1854,10 @@ class MISPEvent(AnalystDataBehaviorMixin):
                     # faster
                     value = date.fromisoformat(value)
                 except Exception:
-                    value = parse(value).date()
+                    try:
+                        value = parse(value).date()
+                    except Exception as e:
+                        raise NewEventError(f'Invalid format for the date: {e} - {type(value)} - {value}')
             elif isinstance(value, (int, float)):
                 value = date.fromtimestamp(value)
             elif isinstance(value, datetime):
@@ -1871,7 +1873,7 @@ class MISPEvent(AnalystDataBehaviorMixin):
         :param ignore_invalid: if True, assigns current date if d is not an expected type
         """
         if isinstance(d, (str, int, float, datetime, date)):
-            self.date = d  # type: ignore
+            self.date = d
         elif ignore_invalid:
             self.date = date.today()
         else:
@@ -1938,7 +1940,7 @@ class MISPEvent(AnalystDataBehaviorMixin):
             for rel_event in kwargs.pop('RelatedEvent'):
                 sub_event = MISPEvent()
                 sub_event.load(rel_event)
-                self.RelatedEvent.append({'Event': sub_event})  # type: ignore[arg-type]
+                self.RelatedEvent.append({'Event': sub_event})
         if kwargs.get('Tag'):
             [self.add_tag(tag) for tag in kwargs.pop('Tag')]
         if kwargs.get('Object'):