[elakkuvan-r]

Fixes #930

What

• poetry.lock: whisper-misp 0.0.1 -> 0.0.2. The unpinned whisper-misp entries in the minimal and all extras of pyproject.toml are unchanged.
• misp_modules/modules/expansion/whisper.py:
  • moduleinfo["version"] 0.0.1 -> 0.0.2, so the module reports the package version it runs with.
  • DEFAULT_API_URL moves from https://graph.whisper.security to https://graph.whisper.online, the Whisper graph API's own front door since 2026-08-22. Installs that leave the api_url module setting empty reach the current host; an explicit api_url is still honoured as before.
  • handler() backfills an attribute uuid when a direct POST /query omits one. MISP always sends the uuid, and the module's misp_standard output references its objects against it, so hand-crafted calls without one produced object references to a missing id.

Why

whisper-misp 0.0.1 sends every request to the Whisper graph API as python-requests/<version> and posts bound query values under params, a key the API ignores (it binds parameters). 0.0.2 identifies the client (User-Agent: whisper-misp/<version>, X-Whisper-Client: whisper-misp, X-Whisper-Client-Version: <version>, the version read from the installed package metadata) and sends values under parameters. Value inlining and everything the module returns to MISP are unchanged, so analysts see no difference; operators who allow-list egress by User-Agent can now single out MISP. The default host and the uuid backfill bring the in-tree module file level with the maintained module.

Testing

• poetry update whisper-misp --lock resolves and poetry check --lock passes with the bumped entry; the module file is formatted with this repository's black and isort settings and flake8 with its configuration is clean.
• The package's own CI stages this module into a checkout of this repository and runs your flake8, a server boot with a /modules registration check, and your pytest suite on Python 3.10 and 3.14.
• Full analyst loop on a MISP 2.5.44 / misp-modules 3.0.9 docker stack (enrichEvent for ip-src, domain and AS seeds, plus the hover endpoint): every request the module sent carried the new headers and the parameters key, and the enrichment results ingested as before; a direct /query without a uuid returns objects whose references resolve.

🤖 Generated with Claude Code