MISP has a hierarchy of ‘Events’, ‘attributes’ and ‘objects’ and threat intel can be represented in MISP in a number of ways.

Use case 1
An event can be created which contains an attribute or multiple attributes. Filebeat ThreatIntel correctly processes event/attribute relationships for 1 to n attributes and stores the type/values in an index.

Event: 1234

attribute type: MD5
attribute value: e16ddaf4f91df524c28bf4f2e4b1ac09

Use case 2
An event can also be created which contains attributes and objects also containing attributes. Filebeat ThreatIntel correctly processes event/attribute relationships for 1 to n attributes however any event/object/attributes fail to strore in an index. In the example text ‘Malicious executable file” would be included but none of the file:object attributes would be processed.

Event: 4321

attribute type: text
attribute value: Malicious executable file
object: file
attribute type: filename
attribute value: badexe.exe
attribute type: size-in-bytes
attribute value: 46382
attribute type: md5
attribute value: e16ddaf4f91df524b27bf4f2e4b1ac09
attribute type: sha1
attribute value: 988eb4980904d42862f7dc9d4eed52469312ac20
attribute type: sha256
attribute value: 986051385feae5b9850804db2d701c0b029ad24f09bce340c12aee7a5c8a0391

Please see attached sample MISP events:

• 3631,3632 – should behave correctly
• 3634,3635 - fails to import object attribute values but do see records created with ‘error.message’ ‘Illegal list shortcut value [type]
• 3633 only imports the filename ‘thetestfile.txt’
• 3636 only imports the windows-service-name ‘badmojopipe’

misp.sample.events_json.txt