Ok by looking at https://www.circl.lu/doc/misp/feed-osint/0e887f03-5aa2-4a7b-b0f7-66208c6c657b.json and https://www.circl.lu/doc/misp/feed-osint/5a3a5924-eddc-4d5c-9d5e-4de7950d210f.json for source format "MISP Feed", it is based on what is in the event (the first event is published and the other event is unpublished). I think doco confirms that too.
The feeds can be in three different formats:
MISP standardized format which is the preferred format to benefit from all the MISP functionalities.
CSV format, allowing you to pick the columns that are to be imported.
freetext format which allows automatic ingestion and detection of indicator/attribute by parsing any unstructured text.
Currently we are conducting testing, visa vi sharing groups. During testing it was revealed that when creating a sharing group from a local instance (MISP Instance 1) and giving access to an organisation in a remote instance (MISP Instance 2) if an Admin or sync user is in that remote organisation, they have the right to edit the sharing group and add other organisations to that sharing group. This is done without ticking the extend checkmark which is contradictory to what is written in the MISP manual, in which it states that this option needs to be ticked in order to do so.
Could you kindly guide us whether we are missing any configuration or other details to help us work around this issue.
Hi Andras, understood. I have two more questions which I would like to run by you.
1) Will the original instance (local) from which the sharing group was created, be notified if any modifications are done to the sharing group on the secondary instance (remote)?
2) From testing it was revealed that if a remote organisation which has an admin in it is added to a sharing group, synced and received events, if the creator of the local instance decides to remove that particular organistaion form the list, the admin can still schedule a pull request and receive any new events which are created. Is this still supposed to happen after removing the organisation in the sharing group list of the creator of the sharing group?