hi i cant figure out how to do the config in the adapter…
my settings
https://misp/attributes/restSearch/json/${key}
also tested with dollar.response.Attribute.category
and dollar.response[]
Single dollar.Attribute.category
MULTI dollar.Attribute[]
http headers is set
Accept application/json
Authorization TOKENKEY
Content-type application/json
output from curl in cli
curl -d ‘{“returnFormat”:“csv”,“type”:“ip-dst”,“includeContext”:“eventinfo”,“category”:“Network activity”}’ -H “Authorization: KEYTOKEN” -H “Accept: application/json” -H “Content-type: application/json” -X GET --insecure https://misp/attributes/restSearch/json/1.54.137.170 | jq
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 687 100 590 100 97 3124 513 --:–:-- --:–:-- --:–:-- 3138
{
“response”: {
“Attribute”: [
{
“id”: “39634”,
“event_id”: “148”,
“object_id”: “0”,
“object_relation”: null,
“category”: “Network activity”,
“type”: “ip-src”,
“to_ids”: true,
“uuid”: “571f4d47-9940-4638-91d4-4f92950d210f”,
“timestamp”: “1461669191”,
“distribution”: “5”,
“sharing_group_id”: “0”,
“comment”: “spambot (originating SMTP connection)”,
“deleted”: false,
“disable_correlation”: false,
“first_seen”: null,
“last_seen”: null,
“value”: “1.54.137.170”,
“Event”: {
“org_id”: “1”,
“distribution”: “3”,
“id”: “148”,
“info”: “Malspam (2016-04-26) - Dridex botnet 122”,
“orgc_id”: “7”,
“uuid”: “571f489a-26e4-403c-948f-4aff950d210f”
}
}
]
}
}