**Public chatroom** - MISP Dev. Developer room. For developers and development related questions. For any non-development (e.g. support) related questions, please go to MISP/Support. General information sharing topics can be discussed in MISP/Sharing. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq
Looked a bit on the "prefessional services" - virtual training is the same (multiple participants) as the on-site/Luxemburg trainings, only virtual and for support contract holders?
Also, the "MISP/Sharing"-room is not on Matrix?
It’s the same, we simply do virtual trainings to avoid physical contact during the pandemic
It is!
Yeah indeed he created it before we saw the light and started using matrix 😄
Weird, if I search for "#MISP_Sharing:gitter.im" I get a result, but no "Join" button
They are unique on a single MISP instance and won't be reused if you delete an event
if you synchronize your events, an other instance can have an event ID you deleted on your own instance.
What will always be unique is the UUID of an event
Oh now, there was a typo in my first commit to MISP 😢
(weird, i am sure i copied it directly from a running instance that was working)
it happens ;)
Hi team! Trying to use import STIX via the UI. Get presented with 'Could not import STIX document' which seems to be a non syntax related issue as any errors in the JSON would normally return 'Could not import STIX document: Issues executing the ingestion script or invalid input. Please check whether the dependencies for STIX are met via the diagnostic tool.'. Nothing at all within exec-errors.log. I validated the STIX files with the STIX2Validator too and no issues. Any ideas? Was working fine until recently, so I've probably messed around with the wrong thing! Diagnostic tool reports no issues either
1 reply
(loved the birtday logo in .143 btw)
To bad my users didn't see it since we don't use the login form
yeah that's a bummer :(
Is there a reason why creating a MISP feed with pyMISP (https://github.com/MISP/PyMISP/tree/main/examples/feed-generator) creates a file called
hashes.csv? How is that file used? My understanding is that it keeps a mapping between hash of each attribute and the event. What is the reason for that?
it will only ingest that file
rather than parsing the manifest -> then each individual event.json
and hashing all attribute values
it front-loads that task rather than letting all clients ingesting the feed calculate the hashes
private function getOrDef($variable, $default) {
if (Configure::check($variable)) {
return Configure::read($variable);
}
return $default;
}
I wronte the following wrapper as part of my code, to be able the read config variables with a default value. Does a function like this exsists already that i did not find ?
sorry ServersController*
public function getSetting($setting_name)
{
$setting = $this->Server->getSettingData($setting_name);
if (!empty($setting["redacted"])) {
throw new MethodNotAllowedException(__('This setting is redacted.'));
}
if (Configure::check($setting_name)) {
$setting['value'] = Configure::read($setting_name);
}
return $this->RestResponse->viewData($setting);
}