misp42splunk icon indicating copy to clipboard operation
misp42splunk copied to clipboard

FEATURE REQUESTS - Search IoCs using pagination

Open pietrogu opened this issue 3 years ago • 4 comments

Hi,

when I import from MISP a big number of IoCs, often I receive a Timeout. Could it be possible to give the possibility to make the search using the pagination feature provided by MISP?

Thanks, Pietro

pietrogu avatar Nov 05 '21 14:11 pietrogu

Hi Thank you for using misp42 This is already possible just use limit= and page= to retrieve paginated results Default limit is 1000 and default page is 1 On splunk you may use

|mispgetioc limit=10000 page=1 | append [ |mispgetioc limit=10000 page=2] | append [ |mispgetioc limit=10000 page=3]

Hope it helps Best regards Remi

Sent with K-9 Mail.

remg427 avatar Nov 05 '21 15:11 remg427

Thank you!

pietrogu avatar Nov 08 '21 15:11 pietrogu

Hi,

sorry if I reopen, is there maybe something that let this to without knowing how much page are needed?

pietrogu avatar Feb 22 '23 13:02 pietrogu

Hi, to be tested but I think using | misprest and in json_request returnFormat=count will return the number of results

remg427 avatar Feb 27 '23 21:02 remg427

Loop on pagination was implemented for mispfetch in version 4.3.2

remg427 avatar Sep 10 '24 05:09 remg427