This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Configure outgoing feeds general options.
MISP JSON model
Events, attributes, and objects.
Publish events, attributes, and objects to MISP platform.
This extension sets the IDS flag (to_ids) to true on packaged event attributes if the corresponding entities on the platform have a tag named “IDS”.
Configure the outgoing feed
Create or edit an outgoing feed.
Under Transport and content, fill out these fields:
Required fields are marked with an asterisk (*).
Select MISP upload from the drop-down menu.
Select MISP JSON model from the drop-down menu.
Select an existing dataset from the drop-down menu. The menu only displays datasets that are compatible with the Transport type you’ve selected.
Select an update strategy.
Supported update strategies:
MISP server URL*
Enter the URL you use to reach your MISP instance.
MISP server API key*
Enter the API key used to authenticate with your MISP instance.
Store your changes by selecting Save.
View and retrieve outgoing feed content
In the top navigation bar click Data configuration > Outgoing feeds.
In the Outgoing feeds view, click anywhere in the row corresponding to the outgoing feed whose content you want to view or retrieve.
In the selected outgoing feed detail pane, click the Created packages tab.
In the Created packages tab, under the Download column header, click the name of a package to download it, and to save it to a target location.