Open NailBash opened 4 years ago
Hello, can you describe more? I don't see any deleted attribute in your screenshots.
When I request correlations using pymisp I don't want to see this "soft deleted atrributes", just actual attributes.
Why you thing that there no deleted attributes?
Sorry, maybe I should describe more. I see deleted attributes in event view and there deleted attributes don't have correlations and thats correct. But from your screenshot I don't see deleted attributes in RelatedAttribute JSON array.
Event with id 18 have only one not deleted attribute with value '51.77.135.89'. You can see it at first screenshot. So attribute from another event with same value should have only one reletad attribute in event 18.But on screenshot 2 we can see that attribute have more than one correlation in event 18.
Again:
Event 14, attribute "185.100.87.206"
Event 35, attribute "185.100.87.206"
Values in RelatedAttribute:
Timestamp 1: 1596105253 (07/30/2020 @ 10:34am)
Timestamp 2: 1598419411 (08/26/2020 @ 5:23am)
Hello, I have a question about attributes in MISP. I am using feeds, that download to my MISP every day. In feeds settings I enabled "Delta Merge" option that should, I think rewrite all attributes at each download.
But not long time ago I started search in attributes and found that:
It should be deleted attributes, but when I make search in pymisp with something like that:
result=misp.search(controller='attributes',include_context=1,include_correlations=1,eventid=14)
I see this:
So I suppose, that this is deleted attributes.But in correlation I want to see ONLY actual correlations, not correlations with deleted attributes.
P.S. If I use RESTful search I recieve same result - deleted attributes in correlations.