MISP - Add an Event Tag instead of/additionnally to Attribute Tag

[Tux-Panik]

Request Type

Feature Request

Work Environment

Question	Answer
OS version (server)	CentOS 7
OS version (client)	Nevermind
TheHive version / git hash	3.1.1
Package Type	Docker

Problem Description

In the MISP section of the application.conf, I found "optional tags to add to each observable imported from an event available on this instance" and using:
tags = ["misp"]

I would like to request a feature to also add an event tag, additionnally to the TLP tag.
It is usefull to identify what events comes from TheHive among the MISP stream.

Again, thanks for your great work.
Kind regards,
Julien

[nadouani]

Hello, you can define a case template to use when importing MISP alerts into cases, and set set the tags you want to that case template.

When you convert a MISP alert to a Case, the tags from the Case Template will be appended to the newly created case, allowing you to filter the case by that tag to find all the cases created from a MISP alert.

[nadouani]

Well, I think that I was too fast reading the feature request. Do you want to set a tag to the MISP event when pushed from TheHive to MISP?

[Tux-Panik]

Hello, Happy New Year guys :-)
In fact, I'd like to set a dedicated tag attached to the MISP events when I share cases from The Hive.
It already exists for each attributes (based on TheHive's TLP) but not as a global for the event.

Does it make sense for you?

Regards,
JMO

[nadouani]

Yes, this makes sense I agree, and it shouldn't be a big deal.

[To-om]

I add a setting exportCaseTags in MISP section, in application.conf. If true, case tags are exported to event.
Example for configuration:

misp {
  "local" {
    url = "http://127.0.0.1"
    key = "_my_key_"
    exportCaseTags = true
  }
}

[Tux-Panik]

Thank you. I'll try it on the next release.

[Tux-Panik]

It sounds good and it works in the 3.3.0 release.
Thanks @To-om