search

cudeso / misp2sentinel

MISP to Sentinel integration
MIT License
60 stars 20 forks source link

valid_until question #108

Open blvrkr opened 1 month ago

blvrkr commented 1 month ago

Is there any way to set arbitrary valid_until values for attributes in MISP, which will be respected by misp2sentinel?

I have last_seen attributes but they are corresponding to the date, when the indicator was seen for the last time, so don't serve valid_until purpose. Tried to set Expiration sighting to some date in future but it's not being translated to valid_until.

I know I can ignore last_seen but then valid_date is based on the current date and increased every time connector script is executed.

cudeso commented 1 month ago

Hi. What do you mean with arbitrary? A date in the far future so it never expires?

blvrkr commented 1 month ago

Anything in future, preferably last_seen + value similar to days_to_expire. Currently I find this condition never met (as last seen is in the past) :

if date_object > datetime.now():