Open iglocska opened 5 years ago
@iglocska What would be the best approach from a CSP perspective? Ensuring that the TC are standard MISP sharing groups? To ensure that the organisations are propagated as is?
Creating organisations is fine, generally never remove organisations in MISP.
The recommendation would be: If the melicertes team registry has members removed, simply remove the organisation from the sharing groups, no need to remove the organisation. If they get renamed / updated simply update the existing object referencing that team. If two organisations merge, use the organisation merge tool in MISP. There should never be a need to delete an organisation.
There should also never be a need to confuse users by warning them of orphaned organisations just because they got a new organisation object by pulling a feed.
Hope this makes sense!
Hello @iglocska
Thank you for the insight and explanation. The approach used at creation of this adapter was to create a CRUD interface, and now your response and ensuing discussion cleared this out. We will remove the option to delete orphans.
Thanks again Thanos
https://github.com/melicertes/csp/blob/master/csp-apps/misp/misp-adapter-emitter/src/main/java/com/intrasoft/csp/misp/service/impl/MispTcSyncServiceImpl.java#L164
This is extremely worrying. Organisations that are not in the list of melicertes teams are absolutely normal and should not be flagged in any way. The comment that deletion is not an option for now is concerning - it shows a misunderstanding of what an organisation is in MISP and the purpose of having them.