From 9c8da235752c3eeac07b03f5d99ef6b59e2bc423 Mon Sep 17 00:00:00 2001 From: befrankt <32216427+befrankt@users.noreply.github.com> Date: Thu, 6 Jun 2019 15:35:08 +1000 Subject: [PATCH] Update README.md --- faq/README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/faq/README.md b/faq/README.md index 6b06685..886478b 100644 --- a/faq/README.md +++ b/faq/README.md @@ -436,6 +436,22 @@ One potential resolution is to upgrade MISP to 2.4.107. #### Symptoms Users with the site-admin role are able to add objects to events without any error. This error was encountered when a user belonged to every role **except** site-admin. +## WatchList Customization + +### How to create a customized WatchList. + +WatchLists are stored within folder under /var/www/MISP/app/files/warninglists/lists +Every folder contains a list.json file. +Create a new folder and copy and modify an existing list (or create a new one from scratch). +Ensure the "name" value within the file is unique. +Increment the version number when the file is changed. + +Within the MISP GUI, go to WarningLists and "Update WarningLists". + +The new WarningList will now show up. In case of errors, check the permissions on the list.json and it's folder. + +To modify the list or to add entries to it, go back to the file via the CLI, modify the file and reload it via the GUI ("Update WarningLists". +