The ultimate support channel for all things MISP. Please come prepared. Bring log files and turn off SELinux. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq Error logs: /var/www/MISP/app/tmp/logs/error.log
"name": "Could not add Event",
"message": "Could not add Event",
"url": "\/events\/add",
"errors": {
"Event": {
"info": [
"valueNotEmpty"
]
}
}
3 replies
that JSON is invalid, the response key must be removed. the payload should be:
{
"Event": {
"id": "xx",
"orgc_id": "xx",
...or:
{
"id": "xx",
"orgc_id": "xx",
...but NOT with response key:
{
"response":[{ <--- NO
"Event": {
...
"Event": {
"id": "xxxxx",
"orgc_id": "xxxxx",
"org_id": "xxxxx",
"date": "2021-08-10",
"threat_level_id": "3",
"info": "Ixxxxx",
"published": true,
"uuid": "xxxxx",
"attribute_count": "21",
"analysis": "2",
"timestamp": "xxxxx",
"distribution": "2",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "xxxxx",
"sharing_group_id": "0",
"disable_correlation": false,
"extends_uuid": "",
"saved": false,
"name": "Could not add Event",
"message": "Could not add Event",
"url": "\/events\/add",
"errors": []
}
"id": "xx",
"orgc_id": "xx",
"org_id": "xx", }
"saved": false,
"name": "Could not add Event",
"message": "Could not add Event",
"url": "\/events\/add",
"errors": []
}
1) i run this --> curl -d "@2343038.json" --insecure -H "Authorization: KEY" -H "Accept: application/json" -H "Content-type: application/json" -X POST https://172.x.x.x/events/add
2) this is the json file called 2343038.json:
{
"id": "xxxx",
"orgc_id": "xxx",
"org_id": "xxx",
"date": "2021-08-10",
"threat_level_id": "3",
"info": "xxx",
"published": true,
"uuid": "xxx",
"attribute_count": "21",
"analysis": "2",
"timestamp": "1628675907",
"distribution": "2",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1628675971",
"sharing_group_id": "0",
"disable_correlation": false,
"extends_uuid": "",
"Org": {
"id": "xxx",
"name": "xxx",
"uuid": "xxx"
},
"Orgc": {
"id": "xxx",
"name": "xxx",
"uuid": "xxx"
},
"Attribute": [
{
"id": "xxx",
"type": "link",
"category": "External analysis",
"to_ids": false,
"uuid": "xxx",
"event_id": "2343038",
"distribution": "5",
"timestamp": "1628610665",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"disable_correlation": false,
"object_id": "0",
"object_relation": null,
"value": "xxx",
"ShadowAttribute": []
},
{
"id": "139562452",
"type": "filename",
"category": "Payload delivery",
"to_ids": false,
"uuid": "",
"event_id": "2343038",
"distribution": "5",
"timestamp": "1628611134",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"disable_correlation": false,
"object_id": "0",
"object_relation": null,
"value": "cache.dll",
"ShadowAttribute": []
}
hello... I just stood up my own misp instance. I installed it on a ubuntu system, following the instructions as best as I could. I ran the INSTALL.SH -c, as per the instructions. I am not sure if I need to install modules or other components.
When I try to add a feed, I get a "feed not added" banner at the top. I don't see any errors in the logs. I am guessing that something might not be writable.
PLEASE! Any help or pointers would be greatly appreciated!!!!
1 reply
5 replies
if i use "timestamp" to export events that i have imported on the last 24 hours is correct? I want to export just events that i have imported on my SIEM on the last 24 hours
this is my curl:
curl --insecure -H "Authorization: KEY " -H "Content-type: application/json" -H "Accept: application/json" -X "POST" https://MYIP/events/restSearch -d '{"returnFormat": "stix", "publish_timestamp": "24h"}'
IF I RUN THIS CURL query gives me also events that i imported on 13/08/2021 not ONLY the events imported on the last 24 hours
2 replies
