search

cudeso / misp2sentinel

MISP to Sentinel integration
MIT License
52 stars 17 forks source link

Graph API to Defender ATP error in logs #92

Closed aliman53 closed 2 weeks ago

aliman53 commented 2 months ago

Hi,

I'm using the graph API to try push IOCs to Defender ATP, i've set up the config.py file to only include the Graph API supported sections.

When running the script and checking the logs in /tmp I can see there is a response error but not sure what the exact details of this error are. Is there a way to see further details of this error?

image

cudeso commented 1 month ago

There's one indicator synchronised and one not. This means the sync connection work. The error is most likely an indicator type of MISP not supported by Sentinel (fe. YARA or Sigma rules). Check the folder "log", there should be an output of the JSON error. If not, also set write_post_json and verbose_log to True and run the script again.

cudeso commented 2 weeks ago

Closing pending feedback