Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MISP synchronization doesn't retrieve all events #236

Closed
To-om opened this issue Jun 12, 2017 · 0 comments
Closed

MISP synchronization doesn't retrieve all events #236

To-om opened this issue Jun 12, 2017 · 0 comments
Assignees
@To-om
Labels
bug
Milestone
2.11.3

Comments

@To-om
Copy link
Contributor

To-om commented Jun 12, 2017

Request Type

Bug

Work Environment

TheHive version 2.11.2

Problem Description

Some MISP events are not retrieved or are not updated by TheHive

Complementary information

TheHive uses timestamp in MISP events to determine if they must be imported in alerts. The field timestamp is the time of the last change on event. Event which are not published are ignored.

This process is not correct because publishing an event doesn't change its timestamp.

Moreover, MISP API used by TheHive (POST events/index with { "searchDatefrom" : lastSyncDate }) filters event based on the field date (creation date) and not timestamp nor publish_timestamp.
@To-om To-om self-assigned this Jun 12, 2017
@To-om To-om added the bug label Jun 12, 2017
@To-om To-om added this to the 2.11.3 milestone Jun 12, 2017
To-om added a commit that referenced this issue Jun 13, 2017
@To-om
#236 Retrieve MISP events according to their publish date
75b17bb
To-om added a commit that referenced this issue Jun 13, 2017
@To-om
#236 Add API to resynchronize all MISP alerts. This API also fix aler…
064b7e0 
…t status name (d451ed0)
To-om added a commit that referenced this issue Jun 14, 2017
@To-om
#236 Wait end of alert status fix before starting full synchronization
689801f
To-om added a commit that referenced this issue Jun 14, 2017
@To-om
#236 Add API to fix alert status
0bd6c54
To-om added a commit that referenced this issue Jun 14, 2017
@To-om
#236 Change route order to make fixStatus available
f591c5c
@To-om To-om closed this as completed Jun 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@To-om To-om

Labels
bug
Projects
None yet
Milestone
2.11.3
Development

No branches or pull requests
1 participant
@To-om