search

MISP / MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform
https://www.misp-project.org/
GNU Affero General Public License v3.0
5.25k stars 1.38k forks source link

Deleted attributes in "RelatedAttribute" #6278

Open NailBash opened 4 years ago

NailBash commented 4 years ago

Hello, I have a question about attributes in MISP. I am using feeds, that download to my MISP every day. In feeds settings I enabled "Delta Merge" option that should, I think rewrite all attributes at each download. изображение But not long time ago I started search in attributes and found that: изображение It should be deleted attributes, but when I make search in pymisp with something like that:

result=misp.search(controller='attributes',include_context=1,include_correlations=1,eventid=14)

I see this: изображение So I suppose, that this is deleted attributes.But in correlation I want to see ONLY actual correlations, not correlations with deleted attributes. P.S. If I use RESTful search I recieve same result - deleted attributes in correlations.

JakubOnderka commented 4 years ago

Hello, can you describe more? I don't see any deleted attribute in your screenshots.

NailBash commented 4 years ago

image When I request correlations using pymisp I don't want to see this "soft deleted atrributes", just actual attributes.

NailBash commented 3 years ago

Why you thing that there no deleted attributes?

JakubOnderka commented 3 years ago

Sorry, maybe I should describe more. I see deleted attributes in event view and there deleted attributes don't have correlations and thats correct. But from your screenshot I don't see deleted attributes in RelatedAttribute JSON array.

NailBash commented 3 years ago

Event with id 18 have only one not deleted attribute with value '51.77.135.89'. You can see it at first screenshot. So attribute from another event with same value should have only one reletad attribute in event 18.But on screenshot 2 we can see that attribute have more than one correlation in event 18.

NailBash commented 3 years ago

Again: Event 14, attribute "185.100.87.206" изображение Event 35, attribute "185.100.87.206" изображение Values in RelatedAttribute: изображение Timestamp 1: 1596105253 (07/30/2020 @ 10:34am) Timestamp 2: 1598419411 (08/26/2020 @ 5:23am)