Add MISP Cluster Publishing page; document module config drift fix
New page: MISP Cluster Publishing — the IrisMISPCluster module. Covers
why the trigger is an explicit button rather than a hook, the mapping of
each content type to the MISP structure that models it (narrative to
Event Report, linked notes to analyst Notes on their indicator,
ioc_description to the attribute comment, tags, campaign galaxy), and
why the full typed pair list is used rather than the 20-value display
cap.
Documents the redaction model in full: terms derived on every push from
every client name in the instance plus the cluster's case names, the
stoplist that preserves incident and sector vocabulary (sector language
is the shareable context the narrative prompt deliberately produces),
IOC values never being redacted because a lookalike domain is the
intelligence, and the honest limit — term matching is not named-entity
recognition, so possible_unredacted_names exists to surface what the
heuristics cannot derive.
Development Guide: two new gotchas.
- Module config schemas are frozen at first registration. Adding a
parameter never reached an existing install, and an incomplete stored
entry raised KeyError in is_mod_configured(), surfacing as a 500 on
/manage/modules/list and an opaque DataTables Ajax error with no clue
to the cause. Documents the boot-time reconciliation that now fixes
it, and the complete-entry rule for anyone hand-editing module_config.
- MISP analyst-data returns a misleading 403 for two undocumented shape
requirements: the body must be wrapped as {"Note": {...}}, and
distribution must be 0-3 because analyst data rejects "inherit event".
Home, MISP Integration, IOC Correlation, API Reference and Changelog
updated with the new page, the Push to MISP button and the misp-push
endpoint.
Add initial wiki (11 pages)