The ultimate support channel for all things MISP. Please come prepared. Bring log files and turn off SELinux. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq Error logs: /var/www/MISP/app/tmp/logs/error.log
But not sure i understood the question
It should be for everything
You mean via feed/server caching?
Generally it should ignore objects altogether and fetch all attribute values
Meaning it flattens the event first
Object attributes and normal ones alike
Unless i completely missed the point
The problem is the ETL task of consuming the premium data feed and munging it into events and attributes;
It loops the remote through the ingestion that you would normally use for a fetch operation
Extracts the values from the derived attributes
Hashes them
And throws them into Redis
When it comes to misp format feeds/misp servers
It does something different
oh boy, format. Some XML, some JSON
If you convert them to misp format already
You’re half way there
Generate a misp feed out of them
If we have a source in a format misp can’t cope with
We generate a misp feed out of it with a simple pymisp script + our own conversion logic
Indeed
What you said
That way we can interact with the feed’s content as if it was a misp instance
Not sure. Think you folks have some pretty specific use cases that might not fit. If you see any obvious limitations holler maybe we have some ideas
Yeah duplicate management can be tough especially for sources that don’t contain unique identifiers