so with tag based flow control you're just controlling the flow of data going through your instance
an example:
you set up a sync filter on a tag to not share anything tagged t1 to C
you share the data with distribution set to all communities
with t1 set
it reaches B
and B will happily share it with C
if they sync with each other
;)
yeah gotcha
So you want to be trusting your sync partners, or only sharing TLPwhite / stuff you're happy could end up anywhere
good to know.
yep!
Community only is a good solution
(as long as you rely on the other party pulling rather than you pushing)
as C wouldnt be in my community, even though its in theirs
Thanks guys. Some good points and considerations i've noted to look into more
the community stuff is confusing
for all intents and puroses
replace the name "community" with server
you can connect more than one server to act as a community
using the internal server sync setting
that blocks the downgrade of distribution levels during the sync
so community only on internal instance A will become community only on internal instance B
Has anyone used the Crowdstrike integration module with their instance? I inputted my query API key and user, created a hash of a known file, and input it as an event. I have the IDS checked for the event, but I am not receiving any feedback from MISP or Crowdstrike that it sees the hash. Can anyone help?
How can I add it as sync server with my instance, any insight ??
Hi! I'm trying to have MISP integrated with our AWS S3 through API. The issue is bulky metadata has not been received yet through API. Weโre receiving data depend upon the particular (manually inputting) event id and collecting back passing from lambda function to S3. Can anyone share any reference or suggestions here?
Hi everybody,
I am having some issue with the synchronization between two misp instances.
Is it possible to:
- create an event1 with an attribute1 on a MISP_A (done)
- pull this event1 from the MISP_B (done)
- add an attribute2 to this event1 on the MISP_B (done)
- push this event1 back to the MISP_A (done)
- see attribute1 and attribute2 in the event1 on the MISP_A (PROBLEM: we do not see the attribute2 in this event)
I have read on MISP/MISP#5570 that "A MISP server where an event originated (either by hand or API or import) will not accept changes made to that event by another MISP server. This is by design to avoid remote servers to mess with local data."
But is there no way at all to synchronize two MISP instances?