Closed Mudamara closed 5 years ago
Try to change the "max-age = 7 days" and verify if there are events published in the misp server in the last 7 days. Check if you have correctly published an event in MISP.
Hi, Sorry for delay in replying. I have changed the "max-age" as suggested, and have used a time period long enough to incorporate every single event in MISP and have used more sensible time periods like 30/60/90 days etc. I have many correctly published events and still nothing.
Perhaps put this question on hold/closed for now, I plan to do a ground up rebuild of everything to see if there is something simple I have missed along the way.
Wish me luck and thanks for you suggestion. I am sure Ill be back in contact soon!
MISP Synchronization completed - but nothing happens
Help requested /Bug
Work Environment
Problem Description
I have installed HIVE, MISP and Cortex according to the latest documents available on GitHub. I am new-ish to this but not a total buffoon. (we shall see) I have used both the 'DEB' and 'From Source' options to install and have come come to this point both times (suggesting that this is truly a meat-ware problem). No matter what I change, MISP will simply not send Alerts to HIVE.
I have attempted to broaden the filters in various ways.
The MISP instance is the very latest version, and is completely working with a wide variety of ingests and export capabilities with the exception of HIVE.
I have connections between MISP and CORTEX in both directions. I have connections between CORTEX and HIVE.
The most annoying part of this is that the log for HIVE says : update starting, update complete.
Any assistance would be most welcome. This is such a great set of tools. I don't want to be stuck.
Complementary information
latest log output since latest changes to application.conf (file follows
Latest version of application.conf