Use orgc_id instead of org_id for MISP filtering

satta commented 2 years ago

:notebook_with_decorative_cover: Description

From a user's point of view, it is more useful to filter MISP events to forward by orgc_id (creator org) instead of org_id (owner org). This PR reflects this in the filtering engine and also clarifies this in the README.

:memo: Checklist

[x] All user-facing changes have changelog entries.
[x] The changes are reflected on docs.tenzir.com/threatbus, if necessary.
[X] The PR description contains instructions for the reviewer, if necessary.

:dart: Review Instructions

No special instructions. Review tests carefully.

dominiklohmann commented 2 years ago

I've opened up a companion PR internally to update the docs. Do you think this requires a changelog entry?

satta commented 2 years ago

I've opened up a companion PR internally to update the docs. Do you think this requires a changelog entry?

I would assume it does since a user would probably need to adjust their config if they interpreted the config in the previous sense.

tenzir / threatbus