MISP¶
This emitter creates an event on MISP based on an alert. MISP v2 is supported.
emitter: misp
url: ...
api_key: ...
attribute_tags: ...
Components¶
URL¶
url (string) is a MISP URL. Optional. Configurable via MISP_URL environment variable.
API Key¶
api_key (string) is an API key. Optional. Configurable via MISP_API_KEY environment variable.
Attribute Tags¶
attribute_tags (array[:string]) is a list of attribute tags. Optional. Defaults to [].
Note
tags of a rule are set as tags of an event.
id: ...
title: ...
description: ...
tags: # tags for an event
- foo
queries:
- analyzer: ...
query: ...
emitters:
- emitter: database
- emitter: misp
url: ...
api_key: ...
attribute_tags: # tags for attribute(s)
- bar