search

TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.39k stars 617 forks source link

MISP Filters / Configurations are not correctly applied #785

Open crackytsi opened 5 years ago

crackytsi commented 5 years ago

Request Type

Bug

Work Environment

Question Answer
OS version (server) Debian
OS version (client) Seven
TheHive version / git hash 3.1.3
Package Type DEB

Problem Description

I tried the configuration parameter purpose = ExportOnly but it did not work as expected. Instead of just offering me the possibility to export to a MISP instance, it imported all Events as new alerts. The documentation unforunately does not clearly describe on which level this parameter needs to be set (MISP instance or global for all MISP instances), so I tried both without success.

It would be nice, if the status of the parameter would also occoure in application.log file.

BTW if you touch this lines of code: If you have 2 Tags exclusions configured (my alternative way, as the mentioned parameter did not work) tags = ["test:OSINT","test:INTERNAL"] results to the following log-entry in application log (note the missing separator...) excluded tags: test:OSINTtest:INTERNAL

nadouani commented 5 years ago

The purpose is related to a MISP instance. it's not global to all the MISP instances.

The ExportOnly thing works for sure, but some other users already raised the fact that TH imports alerts even if purpose = ExportOnly but we cannot reproduce it. If you can help us find how to reproduce it, we can take a look.

crackytsi commented 5 years ago

Ok, that it is related to the MISP instance was also my assumption. Actually I did set it up on 2 different TH instances, and then the alerts were regenerated. I deleted all alerts without a case (on ES Level), then pulled some new Events on MISP Level. After the next "auto-refresh" the alerts were generated again.