Miner to pull everything from MISP

[TiagoSantos84]

I'm struggling by getting everything from MISP.

I think that this miner is not pulling from Misp every events. I would like to pull everything by ignoring the TLPs or the share level.

It's possible?

Thank you!

[jtschichold]

Hi @TiagoSantos84,
please check this prototype for an example on how to set the filter to None to pull all the events: https://github.com/PaloAltoNetworks/minemeld-misp/blob/develop/mmmisp/prototypes/misp.yml#L45

[TiagoSantos84]

Hi @jtschichold,

Thank you for your input. I have been testing and analyses the result...

Now, because I need to put all the IOCs on SIEM I need to remove all of those that are in the warning lists to avoid well known IP, Domains, Url and so on..

Thank you!