The misp > instance name > tags parameter is not honored when importing MISP events

[saadkadhi]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu
OS version (client)	macOS
TheHive version / git hash	2.13.2

Problem Description

When configuring MISP instances in the misp section in TheHive's application.conf, the administrator can specify one or multiple tags that are added to cases when importing MISP events.

This setting is not honored.

Complementary information

Configuration Excerpt

# MISP
## Enable the MISP connector to import and/or export events.
play.modules.enabled += connectors.misp.MispConnector

misp {
  "REBEL MISP" {
    # URL of the MISP instance.
    url = "http://misp"

    # Authentication key.
    key = "MYKEY"

    # Name of the case template in TheHive that shall be used to import
    # MISP events as cases by
    # default.
    caseTemplate = "MISP-EVENT"

    # Tags to add when importing events.
    tags = ["rebel-misp"]

    # Truststore to use to validate the X.509 certificate of the MISP
    # instance if the default
    # truststore is not sufficient.
    #ws.ssl.trustManager.stores = [
    #{
    #  type: "JKS"
    #  path: "/path/to/truststore.jks"
    #}
    #]
  }

  # Interval between two MISP event synchronization.
  interval = 1h
}

Tags Not Honored

According to the configuration excerpt above, TheHive must add the rebel-misp tag upon import. However, the tag does not appear as expected in the case:

[saadkadhi]

This is a documentation problem.