first commit for the new part
|
@ -12,4 +12,5 @@
|
||||||
* [Taxonomies](taxonomy/README.md)
|
* [Taxonomies](taxonomy/README.md)
|
||||||
* [Galaxies](galaxy/README.md) - in progress
|
* [Galaxies](galaxy/README.md) - in progress
|
||||||
* [Categories and Types](categories-and-types/README.md)
|
* [Categories and Types](categories-and-types/README.md)
|
||||||
|
* [Synchronisation/Sharing](sharing/README.md)
|
||||||
* [Appendices](appendices/README.md)
|
* [Appendices](appendices/README.md)
|
||||||
|
|
|
@ -0,0 +1,145 @@
|
||||||
|
<!-- toc -->
|
||||||
|
|
||||||
|
## Sharing / Syncronisation
|
||||||
|
|
||||||
|
* [Explanation](#users)
|
||||||
|
* [Setup](#setup)
|
||||||
|
* [Roles](#roles)
|
||||||
|
* [Tools](#tools)
|
||||||
|
* [Server Settings](#server-settings)
|
||||||
|
|
||||||
|
* Misp's core functionality is sharing where everyone can be a consumer and/or a contributor/producer.
|
||||||
|
* Quick benefit without the obligation to contribute
|
||||||
|
* Low barrier access to get acquainted to the system
|
||||||
|
|
||||||
|
##Concept
|
||||||
|
|
||||||
|
![Scenario example](figures/MISP_scenario_example.png)
|
||||||
|
|
||||||
|
|
||||||
|
##Setu
|
||||||
|
|
||||||
|
###Adding a server
|
||||||
|
|
||||||
|
Servers can be added by users via
|
||||||
|
|
||||||
|
~~~~
|
||||||
|
https://<misp url>/servers/add
|
||||||
|
~~~~
|
||||||
|
|
||||||
|
![Add Server](figures/add_server_1.png)
|
||||||
|
|
||||||
|
|
||||||
|
The Add Server Form has several input fields:
|
||||||
|
|
||||||
|
![Add Server](figures/add_server_ui.png)
|
||||||
|
|
||||||
|
1. Base URL
|
||||||
|
|
||||||
|
The base-url to the external server you want to sync with. Example: https://foo.sig.mil.be
|
||||||
|
|
||||||
|
2. Instance Name
|
||||||
|
|
||||||
|
A name that will make it clear to your users what this instance is. For example: Organisation A's instance
|
||||||
|
|
||||||
|
3. Remote Sync Organisation Type
|
||||||
|
|
||||||
|
The organization having the external server you want to sync with. Example: BE
|
||||||
|
|
||||||
|
4. Local Organisation
|
||||||
|
|
||||||
|
5. Authkey
|
||||||
|
|
||||||
|
You can find the authentication key on your profile on the external server.
|
||||||
|
|
||||||
|
6. Push
|
||||||
|
|
||||||
|
Allow the upload of events and their attributes.
|
||||||
|
|
||||||
|
7. Pull
|
||||||
|
|
||||||
|
Allow the download of events and their attributes from the server.
|
||||||
|
|
||||||
|
8. Self Signed
|
||||||
|
|
||||||
|
Click this, if you would like to allow a connection despite the other instance using a self-signed certificate (not recommended). (server certificate file still needed)
|
||||||
|
|
||||||
|
9. Server certificate file
|
||||||
|
|
||||||
|
You can also upload a certificate file if the instance you are trying to connect to has its own signing authority. (*.pem)
|
||||||
|
|
||||||
|
10. Client certificate file
|
||||||
|
|
||||||
|
You can also upload a certificate file if the instance you are trying to connect to has its own signing authority. (*.pem)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
###Test connection
|
||||||
|
|
||||||
|
###Rules
|
||||||
|
|
||||||
|
###
|
||||||
|
|
||||||
|
##Collaboration
|
||||||
|
|
||||||
|
### Proposals
|
||||||
|
|
||||||
|
### Forums / Threats
|
||||||
|
|
||||||
|
Forums can be used to discuss non event related topics.
|
||||||
|
|
||||||
|
Discussions can be accessed on the top "Global Actions - List Discussions"
|
||||||
|
|
||||||
|
and via URL:
|
||||||
|
|
||||||
|
~~~~
|
||||||
|
https://<misp url>/threads/index
|
||||||
|
~~~~
|
||||||
|
|
||||||
|
![Discussions](figures/discussions.png)
|
||||||
|
|
||||||
|
####Create a new Topic
|
||||||
|
|
||||||
|
To create a new topic
|
||||||
|
|
||||||
|
~~~~
|
||||||
|
https://<misp url>/posts/add
|
||||||
|
~~~~
|
||||||
|
|
||||||
|
![Start a topic](figures/discussions_start_topic.png)
|
||||||
|
|
||||||
|
####Comment a topic
|
||||||
|
|
||||||
|
A topic can be commented by any user
|
||||||
|
|
||||||
|
~~~~
|
||||||
|
https://<misp url>/threads/view/<topic id>
|
||||||
|
~~~~
|
||||||
|
|
||||||
|
|
||||||
|
### Comments to events
|
||||||
|
|
||||||
|
In MISP ongoing events can be commented by every user.
|
||||||
|
|
||||||
|
![Contact reporter](figures/comment_an_event.png)
|
||||||
|
|
||||||
|
|
||||||
|
### Contact a reporter
|
||||||
|
|
||||||
|
This feature can be used to contact the person or the organisation that the person belongs to that has created the event.
|
||||||
|
|
||||||
|
All E-Mails can be enforced to be encrypted
|
||||||
|
|
||||||
|
![Contact reporter](figures/contact_reporter.png)
|
||||||
|
|
||||||
|
### Receive alerts
|
||||||
|
|
||||||
|
It is possible to get alerts via encrypted mail in the following cases:
|
||||||
|
|
||||||
|
* published events by other user of the MISP instance
|
||||||
|
* events pushed to the MISP instance
|
||||||
|
* events pulled by the MISP instance
|
||||||
|
|
||||||
|
These E-Mail alerts are an opt-in feature
|
||||||
|
|
||||||
|
![Change user settings](figures/profile_receive_alerts.png)
|
After Width: | Height: | Size: 100 KiB |
After Width: | Height: | Size: 28 KiB |
After Width: | Height: | Size: 58 KiB |
After Width: | Height: | Size: 36 KiB |
After Width: | Height: | Size: 89 KiB |
After Width: | Height: | Size: 20 KiB |
After Width: | Height: | Size: 60 KiB |
After Width: | Height: | Size: 30 KiB |
After Width: | Height: | Size: 6.2 KiB |
After Width: | Height: | Size: 42 KiB |