search

TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.39k stars 618 forks source link

[Bug]max-attributes param not working for MISP #2338

Open Shraddha10rathor opened 2 years ago

Shraddha10rathor commented 2 years ago

Request Type

Bug

Work Environment

Question Answer
OS version (server) Ubuntu,
Dedicated RAM 16 GB
vCPU 4
TheHive version / git hash 4.1.9
Package Type Docker
Database Cassandra
Index type Elasticsearch
MISP Version 2.4.150

Problem Description

At least max-attributes config setting is not working as stated here.

Steps to Reproduce

Wait until you receive a MISP alert with more than max-attributes setting. Filter didn't work

able to see the alerts with more than 1000 attribute in the TheHive

Complementary information

play.modules.enabled += org.thp.thehive.connector.misp.MispModule misp { interval: 1 hour servers: [ { name = "CCM" # MISP name url = "https://xxxx/" # URL or MISP auth { type = key key = "xxx" # MISP API key } max-attributes = 1000 wsConfig { ssl { loose { acceptAnyCertificate: true } } } } ] }