CSP - MISP exchange issues

[iglocska]

Noticed several issues with the exchange via CSP to MISP:

• Events arrive unpublished, meaning that my partners are not protected using my shared data. This also encourages tampering with shared data to get them published
• Occasionally data doesn't get synchronised / updated. We could not figure out what triggers the behaviour during the training.
• Revocations are not synchronised
• Sharing groups get partially synchronised
• We had cases where sharing groups were synchronised to instances that were not eligible for the contents via CSP

[iglocska]

The last one is really nasty. Imagine the following situation:

Create a trust circle, for example to make something random up, a belgacom incident that involves belgium, luxembourg, cert-eu, nato - and suddenly once we share any data to this trust circle, everyone knows about the sharing group's name and participants.