mirror of https://github.com/MISP/MISP
ec93389669
- when running a large MISP community, it is bound to happen that your instance will be used as the back-end for internal tooling
- often these tools are configured to fetch aggressively, often with heavy consequences on the server load
- some filter that serves mostly edge-case lookups can mistakenly lead to heavy server load for no good reason
We have identified attribute level positive filters on the event scope to be such a filter and made them optionally toggle-able
via the MISP.attribute_fitlers_block_only flag. Turning the setting on will remove all event level filters such as "type" from
being viable filter candidates unless used to block the inclusion of attribute types. Some examples:
"type": {"OR": ["ip-dst", "ip-src", "hostname", "domain"]} would normally return ANY event that has at least one of the listed
attribute types. This is the behaviour that can now be disabled.
"type": {"NOT": ["iban", "cc-number"]} would normally remove any attributes with the given types from the list of returned
events. This functionality is NOT affected by the toggle.
|
||
|---|---|---|
| .. | ||
| Config | ||
| Console | ||
| Controller | ||
| Lib | ||
| Locale | ||
| Model | ||
| Plugin | ||
| Test | ||
| View | ||
| files | ||
| tmp | ||
| webroot | ||
| .htaccess | ||
| Makefile | ||
| composer.json | ||
| composer.license | ||
| composer.phar | ||
| index.php | ||
| update_thirdparty.sh | ||