Limit syncing of tags to those that are part of a specific taxonomy - Githubissues

cudeso / misp2sentinel

MISP to Sentinel integration

MIT License

58 stars 18 forks source link

Limit syncing of tags to those that are part of a specific taxonomy #70

Closed cudeso closed 9 months ago

cudeso commented 9 months ago

Add a constant MISP_ALLOWED_TAXONOMIES
- Such as in https://github.com/cudeso/misp2sentinel/blob/06fbacbcd5e9e9a4c107c6258934a59420480380/constants.py#L133
Change cleanup_labels to check that tag is part of MISP_ALLOWED_TAXONOMIES. If it's not, then skip (ignore=True) https://github.com/cudeso/misp2sentinel/blob/main/RequestObject.py#L154

This takes into account tags set on Events (https://github.com/cudeso/misp2sentinel/blob/main/RequestObject.py#L179) and tags set on Attributes (https://github.com/cudeso/misp2sentinel/blob/main/RequestObject.py#L77).