#52 Don't export to MISP observables which are not IOC

TheHive-Project · Sep 11, 2017 · 4e795d0 · 4e795d0
1 parent a48e67b
commit 4e795d0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/thehive-misp/app/connectors/misp/MispSrv.scala b/thehive-misp/app/connectors/misp/MispSrv.scala
@@ -80,7 +80,7 @@ class MispSrv @Inject() (
   def getAttributesFromCase(caze: Case): Future[Seq[ExportedMispAttribute]] = {
     import org.elastic4play.services.QueryDSL._
     artifactSrv
-      .find(and(withParent(caze), "status" ~= "Ok"), Some("all"), Nil)
+      .find(and(withParent(caze), "status" ~= "Ok", "ioc" ~= true), Some("all"), Nil)
       ._1
       .map { artifact ⇒
         val (category, tpe) = fromArtifact(artifact.dataType(), artifact.data())