Hello IntelMQ users,
Trying to figure out how to use MISP feed output bot, could someone advise. MISP creates new event once per period (per hour, or per day), and that makes MISP doing correlation between these events created previously. And actually that results correlation table grows exponentially. Am I doing something wrong on IntelMQ side or MISP?
At IntelMQ I configure bot to make one event per day (actually containing ~1500 events in resulting json file). At the MISP side I have MISP feed format feed.
Best regards
--
Marius Urkis