search

MISP / MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform
https://www.misp-project.org/
GNU Affero General Public License v3.0
5.36k stars 1.4k forks source link

Adding local tagging to sync server data #7328

Open eCrimeLabs opened 3 years ago

eCrimeLabs commented 3 years ago

Is your feature request related to a problem? Please describe. When you sync data from various MISP instances the only way to identify that data came from a specific MISP instance you will have to have on the local MISP instance individual users for each.

A nice feature would be if you could similar to feeds set a specific local tag that is added to the event.

This could also be used if you want to automate data the comes in from the specific external MISP instances.

I know there is a "pain point" in the case where the external instance is allowed to push data, and I don't know if the solution could be to add the local tag to the API key distributed.

image

This could allow a bi-directional local tags to be added, I don't know how complex this would be.

Felix83000 commented 2 years ago

Hello, I confirmed, it would be great to automatically add a tag on EVENTS from a specific MISP server.