misp-book
misp-book copied to clipboard
Document usage of data filtering strategy
Quote from a mail, this but better explained:
"our mantra is, keep your data for correlation and exclude it from the exports. What I'd suggest:
a. Set an automatic tag for your feed (such as "expireMeInAMonth") - these tags will be automatically applied to all events coming from the feed hereafter b. When exporting data from MISP, for example for your SIEM/NIDS/etc use the following rules:
- 1x full data set, but exclude everything tagged "expireMeInAMonth"
- 1x the data set carrying the "expireMeInAMonth" tag, but with the "last":"30d" parameter set c. Feed both data sets to your tools
This will get you all your regular data + the past 30 day's worth of data from the feed."
I'm guessing this would translate to using the decaying mechanism now?