Hi Drupad,
Am Donnerstag 15 April 2021 17:56:18 schrieb Soni, Drupad:
Also I want your help in setting up misp output feed as below.
your image showed that you want all events to go into MISP as well using https://github.com/certtools/intelmq/blob/develop/intelmq/bots/outputs/misp/...
Feed is working fine adding feed in misp doesn't show any feeds there. I am not sure what is the gap here.
Me neither, my experience with MISP is limited, there are many functions and ways to manually use MISP. When following the documentation, I could make the api work, but I've not tested the feed. One possibility you have is to ask the MISP people about how to further analyse the situation (Please give them all the details.)
Best Regards, Bernhard
Our documentation https://intelmq.readthedocs.io/en/latest/user/bots.html#misp-feed
links to https://www.circl.lu/doc/misp/managing-feeds/ for the configuration in MISP. You may want to read it.
Sebastian
On 4/16/21 9:10 AM, Bernhard Reiter wrote:
Hi Drupad,
Am Donnerstag 15 April 2021 17:56:18 schrieb Soni, Drupad:
Also I want your help in setting up misp output feed as below.
your image showed that you want all events to go into MISP as well using https://github.com/certtools/intelmq/blob/develop/intelmq/bots/outputs/misp/...
Feed is working fine adding feed in misp doesn't show any feeds there. I am not sure what is the gap here.
Me neither, my experience with MISP is limited, there are many functions and ways to manually use MISP. When following the documentation, I could make the api work, but I've not tested the feed. One possibility you have is to ask the MISP people about how to further analyse the situation (Please give them all the details.)
Best Regards, Bernhard
IntelMQ-dev mailing list https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev https://intelmq.readthedocs.io/
Hi Sebastian/ Bernhard,
Thank you
Sent from my Windows 10 device
From: Sebastian Wagner Sent: 16 April 2021 12:55 To: intelmq-dev@lists.cert.at; Drupad Soni Subject: Re: [IntelMQ-dev] IntelMQ -> feed MISP
Our documentation https://intelmq.readthedocs.io/en/latest/user/bots.html#misp-feed links to https://www.circl.lu/doc/misp/managing-feeds/ for the configuration in MISP. You may want to read it. Sebastian On 4/16/21 9:10 AM, Bernhard Reiter wrote: Hi Drupad,
Am Donnerstag 15 April 2021 17:56:18 schrieb Soni, Drupad: Also I want your help in setting up misp output feed as below.
your image showed that you want all events to go into MISP as well using https://github.com/certtools/intelmq/blob/develop/intelmq/bots/outputs/misp/...
Feed is working fine adding feed in misp doesn't show any feeds there. I am not sure what is the gap here.
Me neither, my experience with MISP is limited, there are many functions and ways to manually use MISP. When following the documentation, I could make the api work, but I've not tested the feed. One possibility you have is to ask the MISP people about how to further analyse the situation (Please give them all the details.)
Best Regards, Bernhard
_______________________________________________ IntelMQ-dev mailing list https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev https://intelmq.readthedocs.io/