Max Age Filter Not Working?

[urban-moniker]

Request Type

Bug

Work Environment

Training VM

Problem Description

I have deployed the training VM and a test version of MISP to test the integration. To prevent a large number of events being pulled in I have applied a 7 day filter, but this seems to be ignored and all events in MISP are being ingested.

Steps to Reproduce

Deploy new TheHive VM, enable MISP integration with max-age filter. Tailing the logs shows this:-

[saadkadhi]

Hi @urban-moniker. Do you confirm that you have MISP events that have been ingested which last publication date is > 7 days?

[urban-moniker]

I believe so - assuming I understand the import logic. Here is an event in MISP that has not been updated since October 2014, but was pulled in as an alert.

I will say I've had a few other issues (Report Templates not importing, periodic crashes etc) so I may just need to build from scratch but I was trying to do some initial testing from the training VM being lazy!

[urban-moniker]

Confirmed - when building from installers there is no issue so this must be related to the training VM.