The ultimate support channel for all things MISP. Please come prepared. Bring log files and turn off SELinux. Please contribute your new knowledge to https://github.com/MISP/misp-book/tree/master/faq Error logs: /var/www/MISP/app/tmp/logs/error.log
Hi all, I'm having some issues implementing a custom decay model in MISP and would appreciate any insight. I've attempted to create JSON files based on the default decay models stored in the misp-decay-model directory and have tried to update the models in the GUI however they are not appearing. (I attempted the same way I did with uploading a custom taxonomy). I've also tried uploading the file from the GUI however it tells me that I do not have proper permissions to upload.
Still having some issues with this if anyone has any expertise with decay models
https://github.com/MISP/MISP/tree/2.4/app/Plugin/OidcAuth#usage
5 replies
'roles_property' => 'Groups',to this:
'roles_property' => array('Groups')
1 reply
https://github.com/MISP/MISP/blob/2.4/app/Plugin/OidcAuth/Controller/Component/Auth/OidcAuthenticate.php#L47-L52
1 reply
As my exported misp.rules grow to 1.7Gb trying to find a solution for ingesting the events to SecurityOnion one by one
Hi all,
I had a synchronization issue on my MISP instances.
quick explanation on what happened :
An instance A (external organization) have created an event, let's say event #1 with 100 attributes.
I have Two instance on my side : B and C.
The instance B is synchronized with the instance A and the instance C synchronized with B.
To summerize :
C --> B --> A
(not push, just pull)
Until yesterday the event was well synchronized between all the instances.
Since the instance A has updated the Event #1 yesterday by adding fews attributes.
All the attributes was well synchronized on instance B but not on C. To solve the issue,I had to remove the event on C and re-run a synchronization to get the new attributes.
(I hope that my explanations are clear :) )
Any idea what happened ? i didn't find relevant logs on my servers :(
Did some debugging today on the OidcAuthenticate plugin (with OneLogin as provider). I added some logging in the PHP script:
if (empty($roles)) {
$this->log($roleProperty, "roleproperty_log");
$roles = $oidc->requestUserInfo($roleProperty);
$this->log($roles, "roles_log");it seems $roles stays empty
2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – Trying login
2021-09-24 11:36:04 Info: OIDC: User `roles` – roleproperty_log
2021-09-24 11:36:04 Info: OIDC: User `` – roles_log
2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – User organisation `NSOC` found with ID 1.Any suggestions ?
Try configuring a push on instance one. So sync actions -> list servers -> new server
Put the URL to the instance 2 server and a name
Then under instance ownership and credentials select new external orgnaisation and fill in the info - you'll need to go on to instance 2 and find the UUID of the orgnisation you want events to be entered into.
You then just need a sync user creating on instance 2 and grab that users auth key.
Enter the authkey of the instance 2 sync user into the authkey section back on instance 1 where you are adding your new server
Then select the sync methods. Probably try a push to start with.
What may be good (and what i did) was to create a TAG - something like TestSync on instance 1. Then when adding your new server you can select push rules and then select that TestSync tag. That way, you can just create an event or tag an existing event with your TestSync tag to test if it works
sync actions -> list servers and select the push all (up arrow icon) at the far right of the server you've created
Did some debugging today on the OidcAuthenticate plugin (with OneLogin as provider). I added some logging in the PHP script:
if (empty($roles)) { $this->log($roleProperty, "roleproperty_log"); $roles = $oidc->requestUserInfo($roleProperty); $this->log($roles, "roles_log");it seems $roles stays empty
2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – Trying login 2021-09-24 11:36:04 Info: OIDC: User `roles` – roleproperty_log 2021-09-24 11:36:04 Info: OIDC: User `` – roles_log 2021-09-24 11:36:04 Info: OIDC: User `geert.verstrepen@nsoc.works` – User organisation `NSOC` found with ID 1.Any suggestions ?
Nobody has used the OIDC plugin ?