Closed
Description
Request Type
Feature Request
Work Environment
| Question | Answer |
|---|---|
| TheHive version / git hash | 2.13.2 |
Problem Description
Currently integrating The Hive and MISP enable both pulling events from MISP into The Hive alerts, and export The Hive observable into MISP. Sometime one wants to profit from only one side of the integration like being able to export observable into MISP only and leave the generation of alerts in The Hive to third party tool.
Possible Solutions
Add a configuration option in the MISP configuration file to define the grade of integration. For example:
export observable to misp = true|false
create alerts from misp = true|false
A similar result could theoretically be achieved by leveraging on an "impossible tag" as per #370 but a proper switch is a more clean solution.