The ultimate support channel for all things MISP. Please come prepared. Bring log files and turn off SELinux. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq Error logs: /var/www/MISP/app/tmp/logs/error.log
can you sand me a json file to import, i can try so change the file, so if is the file the problem it will be ok and will be work
You had a working file and modified something. Since then it doesn’t work.
hello... I just stood up my own misp instance. I installed it on a ubuntu system, following the instructions as best as I could. I ran the INSTALL.SH -c, as per the instructions. I am not sure if I need to install modules or other components.
When I try to add a feed, I get a "feed not added" banner at the top. I don't see any errors in the logs. I am guessing that something might not be writable.
PLEASE! Any help or pointers would be greatly appreciated!!!!
1 reply
this is my curl:
curl --insecure -H "Authorization: KEY " -H "Content-type: application/json" -H "Accept: application/json" -X "POST" https://MYIP/events/restSearch -d '{"returnFormat": "stix", "publish_timestamp": "24h"}'
IF I RUN THIS CURL query gives me also events that i imported on 13/08/2021 not ONLY the events imported on the last 24 hours
5 replies
r = misp.search_index(attribute='info' ) it fetching all attributes of event ...i just need info and threat level
@lucatrabalza
if i use "timestamp" to export events that i have imported on the last 24 hours is correct? I want to export just events that i have imported on my SIEM on the last 24 hours
this is my curl:
curl --insecure -H "Authorization: KEY " -H "Content-type: application/json" -H "Accept: application/json" -X "POST" https://MYIP/events/restSearch -d '{"returnFormat": "stix", "publish_timestamp": "24h"}'
IF I RUN THIS CURL query gives me also events that i imported on 13/08/2021 not ONLY the events imported on the last 24 hours
if i use "timestamp" to export events that i have imported on the last 24 hours is correct? I want to export just events that i have imported on my SIEM on the last 24 hours
this is my curl:
curl --insecure -H "Authorization: KEY " -H "Content-type: application/json" -H "Accept: application/json" -X "POST" https://MYIP/events/restSearch -d '{"returnFormat": "stix", "publish_timestamp": "24h"}'
IF I RUN THIS CURL query gives me also events that i imported on 13/08/2021 not ONLY the events imported on the last 24 hours
how can i change timestamp to Published ??
i'd like export events published on the last 24 h
2 replies
Also: diagnostics show that expected_db version is: 72, but the MYSQL.sql included inserts db_version to: 61
And finally: I cannot (hotfix-)update the installed MISP via git, because the underlying OS does not have internet connection. Therefore I've just packaged the MISP elsewhere beforehand, created an archive out of it and just unarchived that on top of the old installation, saving the old config file (and not deleting stuff created there after previous installation). Is it possble that I run into poblems with this approach?
I am running MISP v 2.4.141
I can build and docker-compose up my local version of misp just fine
But I am getting these weird message constantly being spamed
misp_web | 2021-08-18 17:53:38,764 INFO success: master entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
misp_web | 2021-08-18 17:53:38,773 INFO exited: master (exit status 1; not expected)
misp_web | 2021-08-18 17:53:39,781 INFO spawned: 'master' with pid 185Any idea why and how I might be able to fix this?
Further, when I visit my local host I am being redirected to this url
https://gearssdk.opswat.com? Is this normal? Any clarity would be greatly appreciated!!
really dumb question. I'm on MISP 2.4.110 (I know, a little old, looking at updating soon) but is there a fix for searching events with the rest client? I expect using event.date to only get the user supplied date of the event, but when I do lets say event date 2021/08/20, I get an event from 2021/08/06 that was updated on 2021/08/20.
1 reply
I would think event.date would let me just search by user supplied event date, event.last would be any events modified in the last X time, and then event.published_date and event.timestamp would let me filter based on published dates and timestamp (maybe first change?) respectfully.
Hi guys, I hope u're good & enjoining the weekend.. I've one doubt about the setting "MISP.external_baseurl" .. this have to be a domain name of the server where MISP is installated (? I finished the MISP installation & initial feeds configuration .. I really appreciatte any suggestion . Best Regards
and if you knowns how to push out the downside-banner ("This is an initial install Powered by MISP 2.4.148") please tell me .. will help me too..
hello, i had installed the MISP application on my azure cloud account. the install went smooth. and i am able to access the application. but the application freezes whenever i try to make any changes for example when i try to enable the feeds it freezes? also whenever i make an change in the Server Settings and Maintenance page , like the MISP.email to my company id, i get an error " Request failed for an unknown reason". i get the same error when i try to enable the enrichment as well. how do i solve this issue?
hello, i import feed with Scheduled Tasks (fetch_feeds ) every day, but all events have the Published attribute set no, how can i set Published: Yes ? I want this cause to export events in stix format i use the attribute publish_timestamp. This is the comand: curl --insecure -H "Authorization: APY KEY" -H "Content-type: application/json" -H "Accept: application/json" -X "POST" https://myip/events/restSearch -d '{"returnFormat": "stix", "publish_timestamp": "24h"}'
Hi all! My cron jobs to cache and fetch feeds have suddenly stopped working. Below you can see the command Im running, and its seen in MISP, but it refuses to complete. Any idea on whats going on and what I can do to correct this?
