MISP Analyzer Tag and Sightings pull

[syloktools]

Is there any thoughts on adding to the MISP analyzer to pull all tags and number of sightings from the MISP events that match?

[3c7]

Tags should already get displayed on matching events. Last time I checked the MISP api (dev workshop last November) it was not possible to grab the sightings - but I will check again. Sightings would be an enhancement indeed.

…

Am 30.01.2018 um 16:57 schrieb Robert Nixon ***@***.***>: Is there any thoughts on adding to the MISP analyzer to pull all tags and number of sightings from the MISP events that match? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[syloktools]

No tags are coming through on my install. Also when you export to MISP (share), shouldn't the sightings in TheHive be sent with the observables to MISP?

MISP Event:

Cortex Report inside TheHive

{
  "artifacts": [
    {
      "data": "http://xxx.xxx.xxx.xxx",
      "attributes": {
        "dataType": "url"
      }
    }
  ],
  "full": {
    "results": [
      {
        "url": "http://xxx.xxx.xxx.xxx",
        "name": "Unnamed",
        "result": [
          {
            "orgc_id": "2",
            "id": "4",
            "threat_level_id": "3",
            "uuid": "xxx",
            "Object": [],
            "Orgc": {
              "uuid": "xxx",
              "id": "2",
              "name": "PhishMe Intelligence Feed"
            },
            "RelatedEvent": [
              {
                "info": "Inquiry - CVE-2017-11882, Loki Bot",
                "id": "1"
              },
              {
                "info": "firehol_level1 feed",
                "id": "827"
              },
              {
                "info": " - Buying Order Quote - FormGrabber",
                "id": "828"
              },
              {
                "info": " - Inquiry Order - FormGrabber",
                "id": "5"
              },
              {
                "info": " - Payment Credited - FormGrabber",
                "id": "6"
              },
              {
                "info": " - See Attached Purchase Order - FormGrabber",
                "id": "683"
              },
              {
                "info": " - Provisional BC - FormGrabber",
                "id": "205"
              },
              {
                "info": " - Order - FormGrabber",
                "id": "671"
              },
              {
                "info": " - Payment - FormGrabber",
                "id": "131"
              },
              {
                "info": " - FedEx Office Delivery - FormGrabber",
                "id": "782"
              }
            ],
            "timestamp": "1517256532",
            "date": "2018-01-29",
            "info": " - New Inquiry - CVE-2017-11882, FormGrabber",
            "org_id": "1",
            "Galaxy": []
          },
          {
            "orgc_id": "2",
            "id": "1",
            "threat_level_id": "3",
            "uuid": "xxx",
            "Object": [],
            "Orgc": {
              "uuid": "x",
              "id": "2",
              "name": "xxx Feed"
            },
            "RelatedEvent": [
              {
                "info": " - New Inquiry - CVE-2017-11882, FormGrabber",
                "id": "4"
              }
            ],
            "timestamp": "1517326976",
            "date": "2018-01-30",
            "info": " - Inquiry - CVE-2017-11882, Loki Bot",
            "org_id": "1",
            "Galaxy": []
          }
        ]
      }
    ]
  },
  "summary": {
    "taxonomies": [
      {
        "predicate": "Search",
        "namespace": "MISP",
        "value": "\"2 event(s)\"",
        "level": "info"
      }
    ]
  },
  "success": true
}

[3c7]

This is how it should look like:

Are your tags exportable? Seems like they don't show up using the MISP api either.

[syloktools]

You were right. I had to set this to false: MISP.incoming_tags_disabled_by_default
For those events since they came from another org.

What do you think about the sightings? If it is marked as sighted in TheHive should that carry over to MISP?

[saadkadhi]

Hi @robertnixon2003. Re 'What do you think about the sightings? If it is marked as sighted in TheHive should that carry over to MISP?', this has been planned for quite some time. It should be available with TheHive 3.1. We track it under #366 in TheHive's repository.

If you have no other question/suggestion, please close this issue.