Outgoing feed - MISP

This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Configure outgoing feeds general options.

Specifications

Transport type

MISP upload

Content type

MISP JSON model

Published data

Events, attributes, and objects.

Description

Publish events, attributes, and objects to MISP platform.

IDS flags

This extension sets the IDS flag (to_ids) to true on packaged event attributes if the corresponding entities on the platform have a tag named “IDS”.

Configure the outgoing feed

  1. Create or edit an outgoing feed.

  2. Under Transport and content, fill out these fields:

    Required fields are marked with an asterisk (*).

    Field

    Description

    Transport type*

    Select MISP upload from the drop-down menu.

    Content type*

    Select MISP JSON model from the drop-down menu.

    Datasets*

    Select an existing dataset from the drop-down menu. The menu only displays datasets that are compatible with the Transport type you’ve selected.

    Update strategy*

    Select an update strategy.

    Supported update strategies:

    • APPEND

    • REPLACE

    MISP server URL*

    Enter the URL you use to reach your MISP instance.

    MISP server API key*

    Enter the API key used to authenticate with your MISP instance.

  3. Store your changes by selecting Save.

View and retrieve outgoing feed content

  1. In the top navigation bar click Data configuration > Outgoing feeds.

  2. In the Outgoing feeds view, click anywhere in the row corresponding to the outgoing feed whose content you want to view or retrieve.

  3. In the selected outgoing feed detail pane, click the Created packages tab.

  4. In the Created packages tab, under the Download column header, click the name of a package to download it, and to save it to a target location.