You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On MISP server side all object's attributtes are added to the created event EXCEPT the 'endpoint' with 'ip-dst' type of misp-attribute. I've already tried to change its type to 'text' (which worked) and 'ip-dst|port' (which didn't work).
I also tried to create an object with the default 'domain-ip' template. I added 'ip-dst' attribute to the object. Still, when I added the object to the event and added the event to MISP server there was no 'ip-dst' attribute shown on MISP server.
What could be the problem?
The text was updated successfully, but these errors were encountered:
I created my custom object template and placed it both into MISP server directory and PyMISP directory.
{ "attributes": { "fqdn": { "description": "Fully Qualified Domain Name", "misp-attribute": "domain", "ui-priority": 2 }, "tenant": { "description": "Name of an endpoint's owner", "misp-attribute": "text", "ui-priority": 0 }, "endpoint": { "description": "IP address of an endpoint", "misp-attribute": "ip-dst", "ui-priority": 1 }, "time": { "description": "Exact time of an alert", "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 } }, "description": "Alert metadata", "meta-category": "reputation", "name": "alert", "required": [ "fqdn", "tenant", "endpoint", "time" ], "uuid": "e2fbbb13-0723-4b6d-a4f1-00b13689078c", "version": 1 }
Then locally I created the object, added it to previously already created event and added event to MISP server.
On MISP server side all object's attributtes are added to the created event EXCEPT the 'endpoint' with 'ip-dst' type of misp-attribute. I've already tried to change its type to 'text' (which worked) and 'ip-dst|port' (which didn't work).
I also tried to create an object with the default 'domain-ip' template. I added 'ip-dst' attribute to the object. Still, when I added the object to the event and added the event to MISP server there was no 'ip-dst' attribute shown on MISP server.
What could be the problem?
The text was updated successfully, but these errors were encountered: