[Feature Request] Allow setting 'published' to 'true' for MISP event exporter

[jnahorny]

Allow setting 'published' to 'true' for MISP event exporter.

Request Type

Feature Request

Problem Description

At the moment, in ./thehive-misp/app/connectors/misp/MispExport.scala we have published hardcoded to be false for mispEvent JSON object. This is in line with the documentation, which says:

(…) The exported cases will not be published automatically though as they need to be reviewed prior to publishing. We strongly advise you to review the categories and types of attributes at least, before publishing the corresponding MISP events.

That's fine. But I'd like to add a possibility to 'publish' the event automatically. This could help to avoid the scenario, where an analyst needs to go to MISP to do just a single thing: publish the event.

I'm thinking about two ways of implementing this, and actually they both could even be used the same time:

1. Allow to change the behavior in the configuration file (the misp block of the application.conf file), naturally, leaving false as the default.
2. Adding a checkbox in the export dialog. IMHO it should by default do what is declared in the application.conf. So, if you have false in the config, the checkbox is blank; if you changed to true, it is checked (but possible to un-check, to allow a decision on per-event basis).

I'd like to work on that, but first I wanted to check out with you, if there's a chance for this feature to be then merged into TheHive. I want to avoid maintaining my own patch / fork, as this is super annoying in long run.

[jnahorny]

I have no idea why this has been labelled as 'bug'. I can't figure that out. Nor how to change it. Sorry :(

[jnahorny]

@nadouani Hi, could you please let me know what are your thoughts / plans regarding this? Do you think this should be implemented ~ like I've described it? Or you have some other idea? Also, are you willing to do it yourself (and if yes, how do you estimate the timeline for that), or should I do it, and send a pull-request? Thanks!

[nadouani]

The FR is meaningful and I think you have correctly described the way it should be implemented:

• Have a setting in every MISP server defined in the config file (let's say autoPublish)
• Have that autoPublish flag returned by the /api/status API
• Use that flag on the MISP export dialog to (un)check a checkbox before hitting Export
• Take that option into account when calling MISP

Feel free to submit a PR for it, and we will take it.