TheHive icon indicating copy to clipboard operation
TheHive copied to clipboard

[Bug]max-attributes param not working for MISP

Open Shraddha10rathor opened this issue 2 years ago • 0 comments

Request Type

Bug

Work Environment

Question Answer
OS version (server) Ubuntu,
Dedicated RAM 16 GB
vCPU 4
TheHive version / git hash 4.1.9
Package Type Docker
Database Cassandra
Index type Elasticsearch
MISP Version 2.4.150

Problem Description

At least max-attributes config setting is not working as stated here.

Steps to Reproduce

Wait until you receive a MISP alert with more than max-attributes setting. Filter didn't work

able to see the alerts with more than 1000 attribute in the TheHive

Complementary information

play.modules.enabled += org.thp.thehive.connector.misp.MispModule misp { interval: 1 hour servers: [ { name = "CCM" # MISP name url = "https://xxxx/" # URL or MISP auth { type = key key = "xxx" # MISP API key } max-attributes = 1000 wsConfig { ssl { loose { acceptAnyCertificate: true } } } } ] }

Shraddha10rathor avatar Feb 07 '22 15:02 Shraddha10rathor