Hello IntelMQ users,
Trying to figure out how to use MISP feed output bot, could someone
advise. MISP creates new event once per period (per hour, or per day),
and that makes MISP doing correlation between these events created
previously. And actually that results correlation table grows
exponentially. Am I doing something wrong on IntelMQ side or MISP?
At IntelMQ I configure bot to make one event per day (actually
containing ~1500 events in resulting json file). At the MISP side I have
MISP feed format feed.
Best regards
--
Marius Urkis