<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear all,</p>
<p>Marius is already in contact with Raphaël Vinot, the MISP Feed
Output author and MISP developer. Here is a short summary by
Raphaël, which I can share here on his behalf:</p>
<blockquote>
<p class="moz-quote-pre" wrap="">If you have a
lot of similarities across events, you have the following
options to
avoid crazy amount of correlations:<br>
</p>
<ul>
<li>Create less events (once a week for example)</li>
<li>Disable correlation at event level</li>
<li>Keep the feed in memory only and not create events out of it
in the
database. => in that case, you will still be able to see
hits against
indicators in the events from the feed, but they're in redis
only
instead of in MySQL so it's not a problem.</li>
</ul>
</blockquote>
<p>best regards<br>
Sebastian<br>
</p>
<div class="moz-cite-prefix">On 9/3/20 11:21 AM, Marius Urkis wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4f39d79c-3a27-2df4-384d-cc1f8da17e46@gmail.com">
<pre class="moz-quote-pre" wrap="">Hello IntelMQ users,
Trying to figure out how to use MISP feed output bot, could someone
advise. MISP creates new event once per period (per hour, or per day),
and that makes MISP doing correlation between these events created
previously. And actually that results correlation table grows
exponentially. Am I doing something wrong on IntelMQ side or MISP?
At IntelMQ I configure bot to make one event per day (actually
containing ~1500 events in resulting json file). At the MISP side I have
MISP feed format feed.
Best regards
--
Marius Urkis
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 1 5056416 7201
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="https://www.nic.at/">https://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>