The ultimate support channel for all things MISP. Please come prepared. Bring log files and turn off SELinux. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq Error logs: /var/www/MISP/app/tmp/logs/error.log
1 reply
Hi all, I'm having some issues implementing a custom decay model in MISP and would appreciate any insight. I've attempted to create JSON files based on the default decay models stored in the misp-decay-model directory and have tried to update the models in the GUI however they are not appearing. (I attempted the same way I did with uploading a custom taxonomy). I've also tried uploading the file from the GUI however it tells me that I do not have proper permissions to upload.
Still having some issues with this if anyone has any expertise with decay models
https://github.com/MISP/MISP/tree/2.4/app/Plugin/OidcAuth#usage
5 replies
'roles_property' => 'Groups',to this:
'roles_property' => array('Groups')
1 reply
https://github.com/MISP/MISP/blob/2.4/app/Plugin/OidcAuth/Controller/Component/Auth/OidcAuthenticate.php#L47-L52
1 reply
As my exported misp.rules grow to 1.7Gb trying to find a solution for ingesting the events to SecurityOnion one by one
Hi all,
I had a synchronization issue on my MISP instances.
quick explanation on what happened :
An instance A (external organization) have created an event, let's say event #1 with 100 attributes.
I have Two instance on my side : B and C.
The instance B is synchronized with the instance A and the instance C synchronized with B.
To summerize :
C --> B --> A
(not push, just pull)
Until yesterday the event was well synchronized between all the instances.
Since the instance A has updated the Event #1 yesterday by adding fews attributes.
All the attributes was well synchronized on instance B but not on C. To solve the issue,I had to remove the event on C and re-run a synchronization to get the new attributes.
(I hope that my explanations are clear :) )
Any idea what happened ? i didn't find relevant logs on my servers :(
Did some debugging today on the OidcAuthenticate plugin (with OneLogin as provider). I added some logging in the PHP script:
if (empty($roles)) {
$this->log($roleProperty, "roleproperty_log");
$roles = $oidc->requestUserInfo($roleProperty);
$this->log($roles, "roles_log");it seems $roles stays empty
2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – Trying login
2021-09-24 11:36:04 Info: OIDC: User `roles` – roleproperty_log
2021-09-24 11:36:04 Info: OIDC: User `` – roles_log
2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – User organisation `NSOC` found with ID 1.Any suggestions ?
