mispsight should return some column when all sigthings

remg427 / misp42splunk

A Splunk app to use MISP in background

GNU Lesser General Public License v3.0

108 stars 30 forks source link

mispsight should return some column when all sigthings #179

Closed ipfyx closed 3 years ago

ipfyx commented 3 years ago

mispsight should return some column when all sigthings are at 0 (sigthing, false positive and expiration). Otherwise, none appears for attributes with sigthing info. mispsight can then be used to filter out false positive.

|mispsight misp_instance=misp field=misp_ip_dst |search misp_fp="False"

remg427 commented 3 years ago

Hi, thank you for PR. I have integrated it but also took this PR to refactor outpout of mispsight to:

return misp_value and counters when value is found on MISP instance (so if those fields are present, matching values where found)
return information for each sighting type.
use numeric values for counters (easier than string True/False)
return earliest and latest info (timestamp, attribute id, event id, org, source) for each type

number of fields has increased but can be easily filter out, for example | fields - misp_* could you check version 4.0.1 on this repo and provide me feedback thank you again for your interest in misp42

ipfyx commented 3 years ago

Hi, I am new to app development in splunk. Any tips please ? How do you develop misp42splunk ? How do you debug it ? I am currently editing the code of the app installed with the splunk store...

I am kind of use to pdb with breakpoints etc. I would like to run mispgetioc from the cmdline for example, because debuging it using only logs after a websearch is a nightmare... Thanks.

remg427 commented 3 years ago

Hi, I simply develop and test on a Splunk instance using debug messages on key points I haven't tried to emulate cloud from command line What would you like to change to misp42? -- Sent with K-9 Mail.