-
Notifications
You must be signed in to change notification settings - Fork 103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Documentation about "Hover" and "Expansion" #13
Comments
Sorry, missclick, didn't mean to close the issue. |
Indeed the misp-book is not up-to-date with the misp-modules documentation For the definition of hover and expansion: https://github.com/MISP/misp-modules#module-type We will have a look to update misp-book asap. |
Yeah I found that piece of documentation, however, it does not explain HOW its being utilized within MISP itself. Currently I'm struggling with it not doing anything at all. I'd expect MISP to make calls to port 6666 where the misp-modules application is running. It is configured under Administration -> Server Settings -> Plugins -> Enrichment. However no calls. Hence I'm wondering if I'm doing something wrong on the user end ... |
The modules should always show up in the enrichment settings, the hover / enrichment options shouldn't matter. The only difference between the two is what MISP is allowed to use the modules for: Hover: If this is enabled MISP will query the module when a user hovers over an attribute with a matching type with the module's input mispattributes. Enrichment: If this is enabled the small "explosion" icon will show up in the actions field of each attribute when viewing an event that is eligible to be used by the enrichment (again using the input part of the mispattributes). Is there any chance you could share the module that you're working on? I can test it and check what's going wrong. |
I'm using the current modules that come with misp-modules, so based on your description I do expect something to pop up when hovering over an IP address, as the example attribute below, though I don't see anything happening, and don't see a "explosion" icon. I have "Propose Edit", "Propose Delete", "Edit" and "Delete" Payload delivery | ip-src | 142.122.37.211 | E-mail Source IP | Yes |Inherit | 0 (0) |
Hmph. Can you paste the output of misp modules when you start the system? |
sure ...
|
There is no documentation about "hover" and "expansion" that is supposed to come with the misp-modules.
The text was updated successfully, but these errors were encountered: