Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • May 14 11:39

    rommelfs on main

    added microsoftgraph repo (compare)

  • Apr 29 07:45
    adulau commented #275
  • Apr 29 07:45

    adulau on main

    new: update add feed docs with … Merge pull request #275 from ri… (compare)

  • Apr 29 07:45
    adulau closed #275
  • Apr 29 07:13
    righel edited #275
  • Apr 29 07:11
    righel opened #275
  • Apr 26 10:19
    cvandeplas commented #15
  • Apr 26 10:19

    cvandeplas on master

    Update README.md Removed dupli… Merge pull request #15 from vpi… (compare)

  • Apr 26 10:19
    cvandeplas closed #15
  • Apr 26 09:59
    vpiserchia opened #15
  • Mar 04 16:03

    righel on main

    chg: add decomission step for s… (compare)

  • Jan 05 15:11

    righel on main

    fix: add flag to update deps as… (compare)

  • Dec 23 2021 15:06
    adulau commented #274
  • Dec 23 2021 15:06

    adulau on main

    add: SimpleBackgroundJobs migra… Merge pull request #274 from ri… (compare)

  • Dec 23 2021 15:06
    adulau closed #274
  • Dec 23 2021 14:53
    righel opened #274
  • Nov 30 2021 13:08

    cvandeplas on main

    chg: [feeds] added inherit from… (compare)

  • Nov 29 2021 15:33
    besendorf opened #273
  • Oct 26 2021 09:39

    adulau on main

    chg: [types and categories] ssh… Merge branch 'main' of github.c… (compare)

  • Oct 13 2021 20:04
    adulau commented #272
andras
@andras:matrix.circl.lu
[m]
how does the CPU load look while that is happening?
1 reply
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
just now it returns me to the events page , it's normal to delaying 10 minutes ? or I've something bad configured ?
andras
@andras:matrix.circl.lu
[m]
definitely doesn't sound normal
interesting, could you fire up your mysql cli?
1 reply
luciano (righel)
@luciano:matrix.circl.lu
[m]
You could check log in into the database via cli and run show processlist; while the login is loading after submit
andras
@andras:matrix.circl.lu
[m]
exactly ;)
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
Sure guys , let me do it again
andras
@andras:matrix.circl.lu
[m]
mysql -u misp -p misp
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
I tried with mysql -u misp -p misp
jhaaja but didn't work
andras
@andras:matrix.circl.lu
[m]
what did it say?
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
imagen.png
andras
@andras:matrix.circl.lu
[m]
sounds like you've got the wrong pw ;)
cat /var/www/MISP/app/Config/database.php | grep password
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
thanks for troubleshooting this with me , you're the best , please if you've get me the link to buy you a coffe/beer , you win it !
andras
@andras:matrix.circl.lu
[m]
haha! No worries at all
1 reply
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
imagen.png
this is the output when I'm loged in .. so i will try the same , but at the login page
Here is the output from show processlist; when I'm trying to login to WebUI
imagen.png
andras
@andras:matrix.circl.lu
[m]
ok bummer, that's indeed something that's been plaguing us recently. Working on a fix for it for a while but temporarily it's on hold. As a quick remedy:
edit your /var/www/MISP/app/Config/config.php
you should have a setting called showCorrelationsOnIndex
1 reply
set that to 0
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
Great ! I come to do it .. I need to restart any service ?
andras
@andras:matrix.circl.lu
[m]
nah, just changing the value should be enough
though restarting mysql should kill the running queries
(service mysql restart)
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
Really thank you guys !
Now login inmediately !
thanks Andras
if you have a coffee link , please send me bro !
thanks to luciano too !!
andras
@andras:matrix.circl.lu
[m]
😎 Great news, expect a more permanent fix for this in the near future
bl4ckm4mb4
@bl4ckm4mb4:matrix.org
[m]
Awesome !! Have a good week !!
abruce
@abruce:matrix.org
[m]

Hi all, I'm having some issues implementing a custom decay model in MISP and would appreciate any insight. I've attempted to create JSON files based on the default decay models stored in the misp-decay-model directory and have tried to update the models in the GUI however they are not appearing. (I attempted the same way I did with uploading a custom taxonomy). I've also tried uploading the file from the GUI however it tells me that I do not have proper permissions to upload.

Still having some issues with this if anyone has any expertise with decay models

Andras Iklody
@iglocska
@abruce:matrix.org - best is to ping @mokaddem - he's currently enjoying a week of holidays, but should be back next week\
GV-007
@GV-007
I try to setup MISP auth using oidcauth, anyone has experience / docs ? I miss URL's for auth provider: Login URL ; Redirect URL
GV-007
@GV-007
Getting following error for now:
[Error] Class 'Jumbojett\OpenIDConnectClient' not found
3 replies
luciano (righel)
@luciano:matrix.circl.lu
[m]
just to be sure, have you done the following steps?
https://github.com/MISP/MISP/tree/2.4/app/Plugin/OidcAuth#usage
5 replies
luciano (righel)
@luciano:matrix.circl.lu
[m]
could you try changing this?
'roles_property' => 'Groups',
to this:
'roles_property' => array('Groups')
1 reply
luciano (righel)
@luciano:matrix.circl.lu
[m]
hm, sorry i can't help, i'm not that familiar with this plugin, seems the $roles variable gets overwritten around here:
https://github.com/MISP/MISP/blob/2.4/app/Plugin/OidcAuth/Controller/Component/Auth/OidcAuthenticate.php#L47-L52
1 reply
maybe you can add some debug lines around there to check what's happening on your instance
cac0ns3c
@cac0ns3c
My MISP machine is 8vCPU, 80Gb RAM and the API results are taking for ever, is there something to do about it ?
Is there a way to export Suricata rules by event?
As my exported misp.rules grow to 1.7Gb trying to find a solution for ingesting the events to SecurityOnion one by one
Rambatla Venkat Rao
@RamboV
Hello There, I am trying to have a dropdown menu in the Expansion module settings , how can I achieve this functionality, like I have moduleconfig = ['server', 'port'], I want one more configuration option "service", which has a pre-defined set of values.
noname0521
@noname0521
Hi ,
I am finding difficulty in uninstalling MISP on ubuntu. Can't find something specific which can help in completely removing MISP from server. Is there some documentation around it. Please help.
Luca
@lucacyber
hi, how can i search if an ip is present on my MISP using openApi?
7 replies
luciano (righel)
@luciano:matrix.circl.lu
[m]
welcome 👍️
mryayap
@mryayap

Hi all,
I had a synchronization issue on my MISP instances.
quick explanation on what happened :

An instance A (external organization) have created an event, let's say event #1 with 100 attributes.
I have Two instance on my side : B and C.
The instance B is synchronized with the instance A and the instance C synchronized with B.

To summerize :

C --> B --> A
(not push, just pull)

Until yesterday the event was well synchronized between all the instances.
Since the instance A has updated the Event #1 yesterday by adding fews attributes.

All the attributes was well synchronized on instance B but not on C. To solve the issue,I had to remove the event on C and re-run a synchronization to get the new attributes.

(I hope that my explanations are clear :) )

Any idea what happened ? i didn't find relevant logs on my servers :(