export to a removed event in MISP

[garanews]

Request Type

Bug / Feature Request

Problem Description

Sometime it happened that someone deleted an event in MISP that was previously exported from The Hive. If someone other adds a new observable in the same case and try to export again in MISP an error appears.

Steps to Reproduce

1) create a case in The Hive, add some observable and mark as ioc 2) export in MISP 3) go in MISP and remove the event 4) return in The Hive, add a new observable in the same case and mark as ioc 5) try to export in MISP again 6) receive an error in The Hive: "Failed to export the following observables" (with the list of the observables)

Possible Solutions

When an user delete an event in MISP this event will go under blacklisted event (in order to doesn't return again). Is it possible to remove from blacklist but from The Hive export the issue remains. Would be useful to implement the send it again feature in case the event is removed from the blacklist. Any thoughts?

[nadouani]

Nice catch! We will ask our friends from MISP, what they think about this use case ;)

cc @adulau @iglocska

[garanews]

Any update about this topic?

[SunnyLu1337]

2020. any updates? the "problem" still exists unfortunately :|