mirror of https://github.com/MISP/misp-book
Merge remote-tracking branch 'upstream/master'
commit
91a6a994f4
|
|
@ -86,9 +86,9 @@ Site admins can use the "Contact users" feature to send all or individual user a
|
|||
* **Action:** This defines the e-mail type, which can be a custom message or a password reset. Password resets automatically include a new temporary password at the bottom of the message and will automatically change the user's password accordingly.
|
||||
* **Subject:** In the case of a custom e-mail, you can enter a subject line here.
|
||||
* **Recipient:** The recipient toggle lets you contact all your users, a single user (which creates a second drop-down list with all the e-mail addresses of the users) and potential future users (which opens up a text field for the e-mail address and a text area field for a GnuPG public key).
|
||||
* **Custom message checkbox:** This is available for password resets or for welcome message, you can either write your own message (which will be appended with a temporary key and the signature), or let the system generate one automatically.
|
||||
* **Custom message checkbox:** This is available for password resets and for welcome messages. You can either write your own message (which will be appended with a temporary key and the signature), or let the system generate one automatically.
|
||||
|
||||
Keep in mind that all e-mails sent through this system, in addition to your own message, will be signed in the name of the instance's host organisation's support team, the e-ail will also include the e-mail address of the instance's support (if the contact field is set in the bootstrap file), and will include the instance's GnuPG signature for users that have a GnuPG key set (and thus are eligible for an encrypted e-mail).
|
||||
Keep in mind that all e-mails sent through this system, in addition to your own message, will be signed in the name of the instance's host organisation's support team, the e-mail will also include the e-mail address of the instance's support (if the contact field is set in the bootstrap file), and will include the instance's GnuPG signature for users that have a GnuPG key set (and thus are eligible for an encrypted e-mail).
|
||||
|
||||
:warning: GnuPG instance key is the GnuPG key used by the MISP instance and which is only used to sign notification. The GnuPG key used in the MISP instance must not be used anywhere else and should not be valuable.
|
||||
|
||||
|
|
@ -113,9 +113,9 @@ To add a new organisation, click on the "Add Organisation" button in the adminis
|
|||
* **Type of organisation:** Define the type of the organisation.
|
||||
* **Contacts:** You can add some contact details for the organisation.
|
||||
|
||||
#### Listing all organisation
|
||||
#### Listing all organisations
|
||||
|
||||
To list all current organisation of the system, just click on List Organisations under the administration menu to the left. There are 3 tabs in this view to filter local organisations, remote organisations or both. The default view displays local organisations. For all views the following columns of information are available:
|
||||
To list all current organisations of the system, just click on List Organisations under the administration menu to the left. There are 3 tabs in this view to filter local organisations, remote organisations or both. The default view displays local organisations. For all views the following columns of information are available:
|
||||
|
||||
|
||||
|
||||
|
|
@ -130,6 +130,7 @@ To list all current organisation of the system, just click on List Organisations
|
|||
* **Contacts:** Contacts of organisation.
|
||||
* **Added by:** Login of the user who added the organisation
|
||||
* **Local:** Flag defined if the organisation is local or remote.
|
||||
* **Users:** The amount of users on this instance belonging to the organisation.
|
||||
* **Actions:** There are 3 options available: edit, delete or display an organisation's information. These options are also available on the left menu when you are on the display view.
|
||||
* **Edit Organisation:** Same options of create organisation's view.
|
||||
|
||||
|
|
@ -139,7 +140,7 @@ To list all current organisation of the system, just click on List Organisations
|
|||
|
||||
|
||||
#### Merge organisations
|
||||
Merge Organisation menu is available only in the organisation view, under the left menu. Merge one organisation to another will transfer all users and data from one to another. On the left the organisation to merge, on the right the target one.
|
||||
Merge Organisation menu is available only in the organisation view, under the left menu. Merging one organisation into another will transfer all users and data from one organisation to a different one. The organisation of which the users and data will be transferred is displayed on the left, the target organisation is displayed on the right.
|
||||
|
||||
|
||||
|
||||
|
|
@ -149,10 +150,10 @@ Merge Organisation menu is available only in the organisation view, under the le
|
|||
|
||||
Privileges are assigned to users by assigning them to rule groups. Rule groups use one of four options determining what they can do with events as well as four additional privilege elevation settings. These are the four options to edit the full options available in the Roles section: Read Only, Manage My Own Events, Manage Organisation Events, Manage & Publish Organisation Events. A short description is provided below:
|
||||
|
||||
* **Read Only:** This allows a user to browse events that his organisation has access to, but doesn't allow any changes to be made to the database.
|
||||
* **Manage My Own Events:** The second option, gives its users the rights to create, modify or delete their own events, but they cannot publish them.
|
||||
* **Read Only:** Allows a user to browse events that his organisation has access to, but doesn't allow any changes to be made to the database.
|
||||
* **Manage My Own Events:** Allows users to create, modify or delete their own events, but they cannot publish them.
|
||||
* **Manage Organization Events:** Allows users to create events or modify and delete events created by a member of their organisation.
|
||||
* **Manage & Publish Organisation Events:** This last setting, gives users the right to do all of the above and also to publish the events of their organisation.
|
||||
* **Manage & Publish Organisation Events:** Gives users the right to do all of the above and to publish the events of their organisation.
|
||||
|
||||
The extra permissions are defined below:
|
||||
|
||||
|
|
@ -176,7 +177,7 @@ When creating a new role, you will have to enter a name for the role to be creat
|
|||
|
||||
#### Listing roles
|
||||
|
||||
By clicking on the List Roles button, you can view a list of all currently registered roles and a list of the permission flags enabled for each. In addition, you can find buttons that allow you to edit and delete said roles. Keep in mind that you will need to first remove every member from a role before you can delete it.
|
||||
By clicking on the List Roles button, you can view a list of all currently registered roles and their enabled permissions. In addition, you can find buttons that allow you to edit and delete said roles. Keep in mind that you will need to first remove every member from a role before you can delete it.
|
||||
|
||||
|
||||
|
||||
|
|
@ -219,7 +220,7 @@ The settings and diagnostics tool is split up into several aspects, all accessib
|
|||
* **Misc settings**: Settings controlling debug options, please ensure that debug is always disabled on a production system.
|
||||
* **Diagnostics**: The diagnostics tool checks if all directories that MISP uses to store data are writeable by the apache user. Also, the tool checks whether the STIX libraries and GnuPG are working as intended.
|
||||
* **Workers**: Shows the background workers (if enabled) and shows a warning if they are not running. Admins can also restart the workers here.
|
||||
* **Download report**: Download a report in JSON format, compiled of all of the settings visible in the tool.
|
||||
* **Download report**: Download a report of all the settings visible in the tool, in JSON format.
|
||||
|
||||
|
||||
|
||||
|
|
@ -228,13 +229,13 @@ Each of the setting pages is a table with each row representing a setting. Colou
|
|||
* **Setting**: The setting name.
|
||||
* **Value**: The current value of the setting.
|
||||
* **Description**: A description of what the setting does.
|
||||
* **Error Message**: If the setting is incorrect / not set, then this field will let the user know what is wrong.
|
||||
* **Error Message**: If the setting is incorrect / not set, this field will let the user know what is wrong.
|
||||
|
||||
|
||||
|
||||
The workers tab shows a list of the workers that MISP can use. You can restart workers using the "restart all workers" button. If the button doesn't work, make sure that the workers were started using the apache user. This can however only be done using the command line, refer to the INSTALL.txt documentation on how to let the workers automatically start on each boot.
|
||||
|
||||
* **Worker Type**: The worker type is determined by the queue it monitors. MISP currently has 5 queues (cache, default, prio, email and a special _schdlr_ queue).
|
||||
* **Worker Type**: The worker type is determined by the queue it monitors. MISP currently has 6 queues (cache, default, prio, email, update and a special _schdlr_ queue).
|
||||
* **Worker Id**: The ID is made up of the machine name, the PID of the worker and the queue it monitors.
|
||||
* **Status**: Displays OK if the worker is running. If the _schdlr_ worker is the only one not running, make sure that you copy the config file into the cakeresque directory as described in the INSTALL.txt documentation.
|
||||
|
||||
|
|
@ -258,6 +259,12 @@ The workers tab shows a list of the workers that MISP can use. You can restart w
|
|||
Interdependence:
|
||||
|
||||
|
||||
**update**
|
||||
|
||||
Role:
|
||||
Interdependence:
|
||||
|
||||
|
||||
**prio**
|
||||
|
||||
Role:
|
||||
|
|
@ -265,9 +272,11 @@ The workers tab shows a list of the workers that MISP can use. You can restart w
|
|||
|
||||
|
||||
**scheduler**
|
||||
|
||||
Role:
|
||||
Interdependence:
|
||||
|
||||
|
||||
#### Workers dead
|
||||
|
||||
Even if the workers are dead, any actions related to them are on-hold. Nothing is lost.
|
||||
|
|
|
|||
|
|
@ -82,6 +82,77 @@ curl --header "Authorization: YOUR API KEY " --header "Accept: application/json"
|
|||
{"name":"Not Found","message":"Not Found","url":"\/servers\/gaaa"}
|
||||
~~~~
|
||||
|
||||
## Search
|
||||
|
||||
It is possible to search in the database for a list of attributes or events based on a list of criterias.
|
||||
|
||||
To return attributes or events in a desired format, use the following URL and header settings:
|
||||
|
||||
URL:
|
||||
~~~~
|
||||
YOUR_MISP_URL/attributes/restSearch
|
||||
YOUR_MISP_URL/events/restSearch
|
||||
~~~~
|
||||
|
||||
Headers:
|
||||
~~~~
|
||||
Accept: application/json
|
||||
Content-type: application/json
|
||||
Authorization: YOUR_API_KEY
|
||||
~~~~
|
||||
|
||||
The next feature to take care of then is the body of the query. This is where you are going to put your filters.
|
||||
As an example, if we want to export all the IP addresses that have a TLP marking and not marked as TLP:red, you can find below the corresponding filters to use:
|
||||
~~~~json
|
||||
{
|
||||
"returnFormat": "json",
|
||||
"type": {
|
||||
"OR": [
|
||||
"ip-src",
|
||||
"ip-dst"
|
||||
]
|
||||
},
|
||||
"tags": {
|
||||
"NOT": [
|
||||
"tlp:red"
|
||||
],
|
||||
"OR": [
|
||||
"tlp:%"
|
||||
]
|
||||
}
|
||||
}
|
||||
~~~~
|
||||
|
||||
Find below a non exhaustive list of parameters that can be used to filter data in your search (some parameters specific to given export formats are not mentioned):
|
||||
- **returnFormat**: Set the return format of the search (Currently supported: json, xml, openioc, suricata, snort - more formats are being moved to restSearch with the goal being that all searches happen through this API). Can be passed as the first parameter after restSearch or via the JSON payload.
|
||||
- **limit**: Limit the number of results returned, depending on the scope (for example 10 attributes or 10 full events).
|
||||
- **page**: If a limit is set, sets the page to be returned. page 3, limit 100 will return records 201->300).
|
||||
- **value**: Search for the given value in the attributes' value field.
|
||||
- **type**: The attribute type, any valid MISP attribute type is accepted.
|
||||
- **category**: The attribute category, any valid MISP attribute category is accepted.
|
||||
- **org**: Search by the creator organisation by supplying the organisation identifier.
|
||||
- **tags**: To include a tag in the results just write its names into this parameter. To exclude a tag prepend it with a '!'.
|
||||
- **quickfilter**: Enabling this (by passing "1" as the argument) will make the search ignore all of the other arguments, except for the auth key and value. MISP will return an xml / json (depending on the header sent) of all events that have a sub-string match on value in the event info, event orgc, or any of the attribute value1 / value2 fields, or in the attribute comment.
|
||||
- **from**: Events with the date set to a date after the one specified in the from field (format: 2015-02-15). This filter will use the date of the event.
|
||||
- **to**: Events with the date set to a date before the one specified in the to field (format: 2015-02-15). This filter will use the date of the event.
|
||||
- **eventid**: The events that should be included / excluded from the search
|
||||
- **withAttachments**: If set, encodes the attachments / zipped malware samples as base64 in the data field within each attribute
|
||||
- **metadata**: Only the metadata (event, tags, relations) is returned, attributes and proposals are omitted.
|
||||
- **uuid**: Restrict the results by uuid.
|
||||
- **publish_timestamp**: Restrict the results by the timestamp of the last publishing of the event. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]).
|
||||
- **last**: (Deprecated synonym for publish_timestamp) Restrict the results by the timestamp of the last publishing of the event. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]).
|
||||
- **timestamp**: Restrict the results by the timestamp (last edit). Any event with a timestamp newer than the given timestamp will be returned. In case you are dealing with /attributes as scope, the attribute's timestamp will be used for the lookup. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]).
|
||||
- **published**: Set whether published or unpublished events should be returned. Do not set the parameter if you want both.
|
||||
- **enforceWarninglist**: Remove any attributes from the result that would cause a hit on a warninglist entry.
|
||||
- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, irregardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled.
|
||||
- **deleted**: If this parameter is set to 1, it will return soft-deleted attributes along with active ones. By using "only" as a parameter it will limit the returned data set to soft-deleted data only.
|
||||
- **includeEventUuid**: Instead of just including the event ID, also include the event UUID in each of the attributes.
|
||||
- **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]).
|
||||
- **sgReferenceOnly**: If this flag is set, sharing group objects will not be included, instead only the sharing group ID is set.
|
||||
- **eventinfo**: Filter on the event's info field.
|
||||
- **searchall**: Search for a full or a substring (delimited by % for substrings) in the event info, event tags, attribute tags, attribute values or attribute comment fields.
|
||||
- **attackGalaxy**: Select the ATT&CK matrix like galaxy to use when using returnFormat = attack. Defaults to the Mitre ATT&CK library via mitre-attack-pattern.
|
||||
|
||||
## Events management
|
||||
|
||||
### /events
|
||||
|
|
|
|||
114
faq/README.md
114
faq/README.md
|
|
@ -902,6 +902,120 @@ Created symlink from /etc/systemd/system/multi-user.target.wants/php73-php-fpm.s
|
|||
|
||||
A galaxy can be assigned like a tag. You can use the add tag function and copy the full conntector-tag. Example `misp-galaxy:ransomware=“Locky”`, which can be found in `/galaxy_clusters/view/`
|
||||
|
||||
## Updating PHP from 7.2 to 7.4.5 on Ubuntu 18.04
|
||||
|
||||
### Installation
|
||||
|
||||
1. Disable and Uninstall Currently Installed SSDEEP
|
||||
```bash
|
||||
sudo phpdismod ssdeep
|
||||
sudo pecl uninstall ssdeep
|
||||
sudo apt purge ssdeep
|
||||
sudo rm -rf /etc/php/7.2/mods-available/ssdeep.ini
|
||||
```
|
||||
|
||||
2. Install PHP 7.4.5
|
||||
```bash
|
||||
sudo apt install software-properties-common -qy
|
||||
sudo add-apt-repository ppa:ondrej/php -y
|
||||
sudo apt update
|
||||
sudo apt install -qy \
|
||||
libapache2-mod-php7.4 \
|
||||
php7.4 \
|
||||
php7.4-cli \
|
||||
php7.4-dev \
|
||||
php7.4-json \
|
||||
php7.4-xml \
|
||||
php7.4-mysql \
|
||||
php7.4-opcache \
|
||||
php7.4-readline \
|
||||
php7.4-mbstring \
|
||||
php-redis \
|
||||
php-gnupg \
|
||||
php-gd
|
||||
sudo apt update
|
||||
sudo apt upgrade -y
|
||||
```
|
||||
|
||||
3. Install SSDEEP
|
||||
```bash
|
||||
cd /usr/local/src
|
||||
sudo rm -rf ssdeep-2.14.1.tar.gz ssdeep-2.14.1
|
||||
sudo wget https://github.com/ssdeep-project/ssdeep/releases/download/release-2.14.1/ssdeep-2.14.1.tar.gz
|
||||
sudo tar zxvf ssdeep-2.14.1.tar.gz
|
||||
cd ssdeep-2.14.1
|
||||
sudo ./configure --datadir=/usr --prefix=/usr --localstatedir=/var --sysconfdir=/etc
|
||||
sudo make
|
||||
sudo make install
|
||||
```
|
||||
|
||||
4. Test SSDEEP
|
||||
```bash
|
||||
ssdeep -h
|
||||
```
|
||||
|
||||
5. Install ssdeep_php
|
||||
```bash
|
||||
sudo pecl channel-update pecl.php.net
|
||||
sudo pecl install ssdeep
|
||||
```
|
||||
|
||||
6. Enable SSDEEP in both 7.2 and 7.4 (** as root** `sudo su`)
|
||||
```bash
|
||||
echo 'extension=ssdeep.so' > /etc/php/7.2/mods-available/ssdeep.ini
|
||||
echo 'extension=ssdeep.so' > /etc/php/7.4/mods-available/ssdeep.ini
|
||||
```
|
||||
|
||||
7. Enable SSDEEP PHP Mod
|
||||
```bash
|
||||
sudo phpenmod ssdeep
|
||||
```
|
||||
|
||||
8. Set PHP 7.4.5 to default PHP
|
||||
```bash
|
||||
sudo a2dismod php7.2
|
||||
sudo a2enmod php7.4
|
||||
sudo update-alternatives --set php /usr/bin/php7.4
|
||||
```
|
||||
|
||||
9. [Optional] Set better values for defaults
|
||||
```bash
|
||||
sudo sed -i "s/max_execution_time = 30/max_execution_time = 300/" /etc/php/7.4/apache2/php.ini ; \
|
||||
sudo sed -i "s/memory_limit = 128M/memory_limit = 2048M/" /etc/php/7.4/apache2/php.ini ; \
|
||||
sudo sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 500M/" /etc/php/7.4/apache2/php.ini ; \
|
||||
sudo sed -i "s/post_max_size = 8M/post_max_size = 500M/" /etc/php/7.4/apache2/php.ini ; \
|
||||
sudo sed -i "s/max_execution_time = 30/max_execution_time = 300/" /etc/php/7.4/cli/php.ini ; \
|
||||
sudo sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 500M/" /etc/php/7.4/cli/php.ini ; \
|
||||
sudo sed -i "s/post_max_size = 8M/post_max_size = 5000M/" /etc/php/7.4/cli/php.ini ;
|
||||
```
|
||||
|
||||
10. Restart Apache to implement changes
|
||||
```bash
|
||||
sudo sudo systemctl restart apache2
|
||||
```
|
||||
|
||||
### Verification of php 7.2 to 7.4
|
||||
|
||||
1. **Administration** > **Server Settings & Maintenance**
|
||||
|
||||
2. **Diagnostics**
|
||||
|
||||
3. Scroll down to the **PHP Settings** section and verify
|
||||
|
||||
|
||||
### What are the required steps after a MISP installation to have a properly running instance?
|
||||
|
||||
- First login with the installation credentials and change the password immediatly (especially if your instance is publicly accessible)
|
||||
- Set the base_url to the hostname of your machine (apache virtualhost name)
|
||||
- Create a new organisation which will be the host organisation running the MISP instance
|
||||
- Set the new organisation in `MISP.host_org_id` to replace the default one
|
||||
- Set messages like `MISP.footermidleft` and alike to a proper message to help your users
|
||||
- Create a new user as `admin` role with the new organisation
|
||||
- Log with the new user, if successful, remove the default user used during the installation such as `admin@admin.test`
|
||||
- Select and enable required taxonomies for your sharing community
|
||||
- Select and enable the external feeds (as caching only if you don't want full events but you can get the full feeds too)
|
||||
- Select and enable the warning-list (if you don't know what to enable, select all)
|
||||
- Add the remote MISP instances where you have access to (either caching only or full pull if you want the complete events)
|
||||
|
||||
<!--
|
||||
Comment Place Holder
|
||||
|
|
|
|||
699
galaxy/README.md
699
galaxy/README.md
|
|
@ -53,7 +53,704 @@ Once this is done double check if you can still see the Galaxies in the Web UI.
|
|||
|
||||
> [warning] This will impact the UI "Update MISP" functionality in administration. Your git head might get [detached](https://git-scm.com/docs/gitglossary#gitglossary-aiddefdetachedHEADadetachedHEAD) in your misp-galaxy repo.
|
||||
|
||||
### Adding a new Galaxy (WiP - notFuctional)
|
||||
### Adding a new Galaxy
|
||||
|
||||
#### Context
|
||||
|
||||
A galaxy is designed to provide more info than a tag. It comes in two formats: regular or matrix-shape. In a tag, you can only display one label and one color. In a galaxy, you can display:
|
||||
- name
|
||||
- synonymous
|
||||
- description
|
||||
- categories (for matrix-galaxies)
|
||||
|
||||
#### Directory structure
|
||||
|
||||
Galaxies are represented by two json files stored in:
|
||||
```bash
|
||||
/var/www/MISP/app/files/misp-galaxy/galaxies/mygalaxy.json
|
||||
/var/www/MISP/app/files/misp-galaxy/clusters/mygalaxy.json
|
||||
```
|
||||
The __/galaxies__ file contains metatdatas and galaxy structure.
|
||||
The __/clusters__ file contains actual data.
|
||||
|
||||
|
||||
#### The galaxy managment GUI
|
||||
|
||||
|
||||
|
||||
In this windows, you will be able to check all your galaxies and if your newly created ones are OK.
|
||||
|
||||
#### The galaxy file
|
||||
The galaxy file provides the framework for the data stored in the cluster file.
|
||||
For example:
|
||||
```bash
|
||||
{
|
||||
"description": "attck4fraud - Principles of MITRE ATT&CK in the fraud domain",
|
||||
"icon": "map",
|
||||
"kill_chain_order": {
|
||||
"fraud-tactics": [
|
||||
"Initiation",
|
||||
"Target Compromise",
|
||||
"Perform Fraud",
|
||||
"Obtain Fraudulent Assets",
|
||||
"Assets Transfer",
|
||||
"Monetisation"
|
||||
]
|
||||
},
|
||||
"name": "attck4fraud",
|
||||
"namespace": "misp",
|
||||
"type": "financial-fraud",
|
||||
"uuid": "cc0c8ae9-aec2-42c6-9939-f4f82b051836",
|
||||
"version": 1
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
* __description__: generalities about the galaxy (1)
|
||||
* __icon__: the icon used in the MISP interface (2)
|
||||
* __name__: the name of the galaxy (3)
|
||||
* __namespace__: the namespace where is stored the galaxy. Namespace are used to regroup similar galaxies (4)
|
||||
* __type__: __IMPORTANT field__, it MUST match the galaxy and cluster files name to actually chain both files together (5)
|
||||
* __uuid__: as any MISP object, it has a uuid. __IMPORTANT__, it MUST be repeated in the uuid property of the cluster file (6)
|
||||
* __version__: as usual in MISP, versioning, especially to force update (7)
|
||||
* __kill_chain_order__: a special and optionnal field: it will be used if you want to create a matrix-galaxy. In this field, you insert a named table (_fraud-tactics_ in the example above) containing the categories labels of you data. They will be used then in the cluster file (8)
|
||||
|
||||
More detail on galaxy fields here: https://tools.ietf.org/html/draft-dulaunoy-misp-galaxy-format-06#page-9
|
||||
|
||||
#### The cluster file
|
||||
|
||||
The cluster file provides the actual data of the galaxy.
|
||||
For example (Attck4fraud):
|
||||
```bash
|
||||
{
|
||||
"authors": [
|
||||
"Francesco Bigarella"
|
||||
],
|
||||
"category": "guidelines",
|
||||
"description": "attck4fraud - Principles of MITRE ATT&CK in the fraud domain",
|
||||
"name": "attck4fraud",
|
||||
"source": "Open Sources",
|
||||
__"type": "financial-fraud",__
|
||||
__"uuid": "cc0c8ae9-aec2-42c6-9939-f4f82b051836"__,
|
||||
"values": [
|
||||
{
|
||||
"description": "In the context of ATT&CK for Fraud, phishing is described as the sending of fraudulent emails to a large audience in order to obtain sensitive information (PII, credentials, payment information). Phishing is never targeted to a specific individual or organisation. Phishing tries to create a sense of urgency or curiosity in order to capture the victim.",
|
||||
"meta": {
|
||||
"detection": "Email sender is spoofed; Email sender belongs to a domain recently created; Presence of typos or poor grammar in the email text; The request in the mail is unsolicited and creates urgency; No recollection of the subject or the sender of the phishing email; Request for credentials; Presence of a suspicious URL or attachment.",
|
||||
"examples": [
|
||||
"Phishing messages were sent to Amazon users posing as the Amazon customer support",
|
||||
"Fake Apple invoices were sent to Apple App Store customers in order to obtain their Apple ID credentials"
|
||||
],
|
||||
"external_id": "FT1001",
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Initiation"
|
||||
],
|
||||
"mitigation": "Implementation of DKIM and SPF authentication to detected spoofed email senders; anti-phishing solutions.",
|
||||
"refs": [
|
||||
"https://blog.malwarebytes.com/cybercrime/2015/02/amazon-notice-ticket-number-phish-seeks-card-details/",
|
||||
"https://www.bleepingcomputer.com/news/security/widespread-apple-id-phishing-attack-pretends-to-be-app-store-receipts/"
|
||||
],
|
||||
...
|
||||
],
|
||||
"version": 3
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
* __authors__: descriptive field (1)
|
||||
* __category__: descriptive field (2)
|
||||
* __description__: descriptive field (3)
|
||||
* __name__: same as in /galaxy file, used in the Matrix display (4)
|
||||
* __source__: descriptive field (5)
|
||||
* __type__: IMPORTANT, this field MUST match the /galaxy and /cluster files names AND the type field in the /galaxy file name -5 in above paragraph- (6)
|
||||
* __uuid__: IMPORTANT, this field MUST match the /galaxy uuid field -6 in above paragraph- (7)
|
||||
* __values__: a table containing the actual values (8)
|
||||
* __data fileds__: fields used to describe single data are detailed here: https://tools.ietf.org/html/draft-dulaunoy-misp-galaxy-format-06#page-9 (9)
|
||||
* __kill_chain__: IMPORTANT, provide the column of the Matrix where the data will be displayed: (10)
|
||||
* __arg1__: MUST match /galaxy file's kill_chain arg (_fraud-tactics_ in the example)
|
||||
* __arg2__: name of the column of the data (_Initiation_ in the example)
|
||||
* __version__: same as for galaxies
|
||||
|
||||
More details on /cluster fields can be found here: https://tools.ietf.org/html/draft-dulaunoy-misp-galaxy-format-06#page-9
|
||||
|
||||
#### Implementation
|
||||
* Once your files are ready, ALWAYS submit them in a json validator such as:
|
||||
https://jsonformatter.curiousconcept.com/ . Do it before putting them into your instance, your sanity is at stake.
|
||||
|
||||
* Copy/paste your files in both folders (/galaxies and /clusters)
|
||||
|
||||
* Go to Galaxies/List galaxies and clic on Update galaxies
|
||||
|
||||
* Your new galaxy should be displayed on the screen with the others
|
||||
|
||||
|
||||
|
||||
* Your galaxy is available in the events for selecting in the right namespace
|
||||
|
||||
|
||||
|
||||
#### Troubleshooting
|
||||
|
||||
* __The galaxy does not update, galaxy is empty__
|
||||
* Check json validation
|
||||
* Remove commas on last items of any {} or []
|
||||
* Update version of files
|
||||
* Check files names
|
||||
* Delete the galaxy in the GUI and update
|
||||
|
||||
* __Matrix is not displayed__
|
||||
* Check the kill_chain_order array in the /galaxies json
|
||||
* Check the chaining
|
||||
|
||||
#### Example
|
||||
We will create a galaxy from scratch. To demonstrate MISP can handle any type of use-case, we will not work on malware but on Shadowrun pen and paper RPG.
|
||||
In this RPG, 2060's large megacorporations launch paramilitary actions against each other. They can belong to 3 main categories (ranked by international standards):
|
||||
- AAA: extraterritorial corporation and seating at the top-10 council;
|
||||
- AA: only extraterritorial compagnies;
|
||||
- A: nation-scale corporation.
|
||||
|
||||
A corporation can act in several fields:
|
||||
- energy
|
||||
- IT
|
||||
- biotechnology
|
||||
- cybertechnology (body enhancement)
|
||||
|
||||
It can work on several continent:
|
||||
- Europe;
|
||||
- Asia;
|
||||
- Africa;
|
||||
- Oceania;
|
||||
- America.
|
||||
|
||||
All these context elements are enough to build a galaxy.
|
||||
|
||||
##### Simple galaxy
|
||||
|
||||
* the galaxy file: galaxies/shadowrun.json
|
||||
|
||||
```
|
||||
{
|
||||
"description": "My Shadowrun test galaxy",
|
||||
"icon": "user-secret",
|
||||
"name": "shadowrun",
|
||||
"namespace": "RPG",
|
||||
"type": "shadowrun",
|
||||
"uuid": "7a956b4d-613c-4c08-b5d6-19974682aea8",
|
||||
"version": 1
|
||||
}
|
||||
```
|
||||
Keep the uuid and type, it will be necessary later.
|
||||
|
||||
* Check your json
|
||||
* Click on update and see your work:
|
||||
|
||||
|
||||
* the cluster file: clusters/shadowrun.json
|
||||
|
||||
```
|
||||
{
|
||||
"authors": [
|
||||
"myself"
|
||||
],
|
||||
"category": "RPG",
|
||||
"description": "Shadowrun galaxy",
|
||||
"name": "shadowrun corporations",
|
||||
"source": "Internal",
|
||||
"type": "shadowrun",
|
||||
"uuid": "7a956b4d-613c-4c08-b5d6-19974682aea8",
|
||||
"values": [
|
||||
{
|
||||
"description": "extraterritorial corporation and seating at the top-10 council.",
|
||||
"meta": {
|
||||
"Corporate council seat": "Yes",
|
||||
"examples": [
|
||||
"Renraku",
|
||||
"Shiawase",
|
||||
"Aztechnology",
|
||||
"Ares Macrotechnologies",
|
||||
"Saeder Krupps"
|
||||
]
|
||||
},
|
||||
"uuid": "43e1b900-5a03-11ea-9ad1-080027cbfd66",
|
||||
"value": "AAA"
|
||||
},
|
||||
{
|
||||
"description": "only extraterritorial compagnies.",
|
||||
"meta": {
|
||||
"Corporate council seat": "No",
|
||||
"examples": [
|
||||
"Shibata",
|
||||
"Monobe",
|
||||
"Zeta Impchem",
|
||||
"ESUS"
|
||||
]
|
||||
},
|
||||
"uuid": "7aad2dd4-5a03-11ea-ad69-080027cbfd66",
|
||||
"value": "AA"
|
||||
},
|
||||
{
|
||||
"description": "nation-scale corporation.",
|
||||
"meta": {
|
||||
"Corporate council seat": "No",
|
||||
"examples": [
|
||||
"Genom",
|
||||
"KSAF",
|
||||
"Seretech",
|
||||
"Infocore",
|
||||
"MicroDek (ex-Microsoft)",
|
||||
"Tan Tien"
|
||||
]
|
||||
},
|
||||
"uuid": "50c0d622-5c67-11ea-bd4b-0800275bbff6",
|
||||
"value": "A"
|
||||
},
|
||||
{
|
||||
"description": "energy sector: exploitation, , refining, selling",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"Saeder Krupps"
|
||||
],
|
||||
"subsectors": [
|
||||
"petroleum",
|
||||
"electricity",
|
||||
"gas",
|
||||
"bio"
|
||||
]
|
||||
},
|
||||
"uuid": "293e7e5c-51a8-411f-9b47-d52ed62d4b78",
|
||||
"value": "energy"
|
||||
},
|
||||
{
|
||||
"description": "cybertechnology sector: manufacturing, selling and implanting modifications.",
|
||||
"meta": {
|
||||
"Delta clinic (for implanting)": [
|
||||
"Yes",
|
||||
"No"
|
||||
],
|
||||
"examples": [
|
||||
"headware",
|
||||
"bodyware",
|
||||
"eyeware",
|
||||
"earware",
|
||||
"cyberlimbs"
|
||||
]
|
||||
},
|
||||
"uuid": "7e962290-cba7-49ad-95c2-115575c8a9d2",
|
||||
"value": "cybertechnology"
|
||||
},
|
||||
{
|
||||
"description": "Biotechnology: bioware, genetics, etc",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"bioware",
|
||||
"genetics",
|
||||
"biodrones",
|
||||
"biocosmetics"
|
||||
]
|
||||
},
|
||||
"uuid": "c899564c-bfe4-460f-a2ed-aae98e1355a3",
|
||||
"value": "biotechnology"
|
||||
},
|
||||
{
|
||||
"description": "IT: softwares, hardware, cybersec",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"software dev",
|
||||
"hardware manufacturing",
|
||||
"intrusion countermeasrures"
|
||||
]
|
||||
},
|
||||
"uuid": "16c49ba4-8a79-4f67-a98a-07cdc08f8a2d",
|
||||
"value": "IT"
|
||||
},
|
||||
{
|
||||
"description": "Europe",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"France",
|
||||
"Belgium",
|
||||
"Luxembourg",
|
||||
"Germany",
|
||||
"Italy"
|
||||
]
|
||||
},
|
||||
"uuid": "8e745c22-9b14-4334-887a-0000eda58f75",
|
||||
"value": "Europe"
|
||||
},
|
||||
{
|
||||
"description": "Asia",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"China",
|
||||
"Japan",
|
||||
"Thailand"
|
||||
]
|
||||
},
|
||||
"uuid": "95d4ff78-42f8-4fe8-bb63-af2c7e500ec8",
|
||||
"value": "Asia"
|
||||
},
|
||||
{
|
||||
"description": "Russia and former USSR",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"Russia",
|
||||
"kazakhstan"
|
||||
]
|
||||
},
|
||||
"uuid": "87a3ac08-6ffc-45eb-826e-e8e0af392563",
|
||||
"value": "Russia"
|
||||
},
|
||||
{
|
||||
"description": "Africa",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"Nigeria",
|
||||
"Malia",
|
||||
"Algeria"
|
||||
]
|
||||
},
|
||||
"uuid": "aba705b7-fcb4-4bf4-81d4-b896314f53ed",
|
||||
"value": "Africa"
|
||||
},
|
||||
{
|
||||
"description": "Oceania",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"Asutralia",
|
||||
"Polynesia"
|
||||
]
|
||||
},
|
||||
"uuid": "ae28830b-b90f-48d9-8b89-acda0864ff4e",
|
||||
"value": "Oceania"
|
||||
},
|
||||
{
|
||||
"description": "America",
|
||||
"meta": {
|
||||
"examples": [
|
||||
"UCAS",
|
||||
"CAS",
|
||||
"Pueblo Corporate COuncil",
|
||||
"AZtlan"
|
||||
]
|
||||
},
|
||||
"uuid": "d41c6222-4d10-43e9-9a8e-47d586eaf0e7",
|
||||
"value": "America"
|
||||
}
|
||||
],
|
||||
"version": 3
|
||||
}
|
||||
```
|
||||
|
||||
__IMPORTANT: __
|
||||
* the ""uuid": "7a956b4d-613c-4c08-b5d6-19974682aea8"," is the same in both files
|
||||
* the cluster filename is the same as the "type" field in the galaxy file
|
||||
* CHECK YOUR JSON (https://jsonformatter.curiousconcept.com/) AND SAVE YOUR SANITY!
|
||||
|
||||
We check the thing by clicking on the update button in the galaxy GUI:
|
||||
|
||||
|
||||
|
||||
We can test our work on the MISP GUI:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Remark: we created a simple galaxy. We will later see how to create a Matrix-shaped one.
|
||||
|
||||
##### Matrix-shaped galaxy
|
||||
|
||||
To create a matrix-shaped galaxy, a new field is added:
|
||||
* __kill_chain__ for the /galaxy json
|
||||
* __kill_chain_order__ for the /cluster json
|
||||
|
||||
In the galaxy json, categories are listed:
|
||||
```
|
||||
"kill_chain":[
|
||||
"killchain_name":[
|
||||
"category_1",
|
||||
"category_2",
|
||||
"category_3"
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
The final galaxy file:
|
||||
|
||||
```
|
||||
{
|
||||
"description": "My Shadowrun test matrix galaxy",
|
||||
"icon": "user-secret",
|
||||
"kill_chain_order": {
|
||||
"shadowrun": [
|
||||
"ranking",
|
||||
"sector",
|
||||
"area"
|
||||
]
|
||||
},
|
||||
"name": "shadowrun_matrix",
|
||||
"namespace": "RPG",
|
||||
"type": "shadowrun",
|
||||
"uuid": "1b013b10-5c6e-11ea-8881-0800275bbff6",
|
||||
"version": 1
|
||||
}
|
||||
```
|
||||
|
||||
In the cluster json, reference to the categories are done:
|
||||
```
|
||||
"values": [
|
||||
{
|
||||
"description": "",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"killchain_name:category_1"
|
||||
],
|
||||
```
|
||||
|
||||
The final cluster file:
|
||||
|
||||
```
|
||||
{
|
||||
"authors": [
|
||||
"myself"
|
||||
],
|
||||
"category": "RPG",
|
||||
"description": "Shadowrun matrix galaxy",
|
||||
"name": "shadowrun corporations",
|
||||
"source": "Internal",
|
||||
"type": "shadowrun",
|
||||
"uuid": "1b013b10-5c6e-11ea-8881-0800275bbff6",
|
||||
"values": [
|
||||
{
|
||||
"description": "extraterritorial corporation and seating at the top-10 council.",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:ranking"
|
||||
],
|
||||
"Corporate council seat": "Yes",
|
||||
"examples": [
|
||||
"Renraku",
|
||||
"Shiawase",
|
||||
"Aztechnology",
|
||||
"Ares Macrotechnologies",
|
||||
"Saeder Krupps"
|
||||
]
|
||||
},
|
||||
"uuid": "43e1b900-5a03-11ea-9ad1-080027cbfd66",
|
||||
"value": "AAA"
|
||||
},
|
||||
{
|
||||
"description": "only extraterritorial compagnies.",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:ranking"
|
||||
],
|
||||
"Corporate council seat": "No",
|
||||
"examples": [
|
||||
"Shibata",
|
||||
"Monobe",
|
||||
"Zeta Impchem",
|
||||
"ESUS"
|
||||
]
|
||||
},
|
||||
"uuid": "7aad2dd4-5a03-11ea-ad69-080027cbfd66",
|
||||
"value": "AA"
|
||||
},
|
||||
{
|
||||
"description": "nation-scale corporation.",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:ranking"
|
||||
],
|
||||
"Corporate council seat": "No",
|
||||
"examples": [
|
||||
"Genom",
|
||||
"KSAF",
|
||||
"Seretech",
|
||||
"Infocore",
|
||||
"MicroDek (ex-Microsoft)",
|
||||
"Tan Tien"
|
||||
]
|
||||
},
|
||||
"uuid": "50c0d622-5c67-11ea-bd4b-0800275bbff6",
|
||||
"value": "A"
|
||||
},
|
||||
{
|
||||
"description": "energy sector: exploitation, , refining, selling",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:sector"
|
||||
],
|
||||
"examples": [
|
||||
"Saeder Krupps"
|
||||
],
|
||||
"subsectors": [
|
||||
"petroleum",
|
||||
"electricity",
|
||||
"gas",
|
||||
"bio"
|
||||
]
|
||||
},
|
||||
"uuid": "293e7e5c-51a8-411f-9b47-d52ed62d4b78",
|
||||
"value": "energy"
|
||||
},
|
||||
{
|
||||
"description": "cybertechnology sector: manufacturing, selling and implanting modifications.",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:sector"
|
||||
],
|
||||
"Delta clinic (for implanting)": [
|
||||
"Yes",
|
||||
"No"
|
||||
],
|
||||
"examples": [
|
||||
"headware",
|
||||
"bodyware",
|
||||
"eyeware",
|
||||
"earware",
|
||||
"cyberlimbs"
|
||||
]
|
||||
},
|
||||
"uuid": "7e962290-cba7-49ad-95c2-115575c8a9d2",
|
||||
"value": "cybertechnology"
|
||||
},
|
||||
{
|
||||
"description": "Biotechnology: bioware, genetics, etc",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:sector"
|
||||
],
|
||||
"examples": [
|
||||
"bioware",
|
||||
"genetics",
|
||||
"biodrones",
|
||||
"biocosmetics"
|
||||
]
|
||||
},
|
||||
"uuid": "c899564c-bfe4-460f-a2ed-aae98e1355a3",
|
||||
"value": "biotechnology"
|
||||
},
|
||||
{
|
||||
"description": "IT: softwares, hardware, cybersec",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:sector"
|
||||
],
|
||||
"examples": [
|
||||
"software dev",
|
||||
"hardware manufacturing",
|
||||
"intrusion countermeasrures"
|
||||
]
|
||||
},
|
||||
"uuid": "16c49ba4-8a79-4f67-a98a-07cdc08f8a2d",
|
||||
"value": "IT"
|
||||
},
|
||||
{
|
||||
"description": "Europe",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"France",
|
||||
"Belgium",
|
||||
"Luxembourg",
|
||||
"Germany",
|
||||
"Italy"
|
||||
]
|
||||
},
|
||||
"uuid": "8e745c22-9b14-4334-887a-0000eda58f75",
|
||||
"value": "Europe"
|
||||
},
|
||||
{
|
||||
"description": "Asia",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"China",
|
||||
"Japan",
|
||||
"Thailand"
|
||||
]
|
||||
},
|
||||
"uuid": "95d4ff78-42f8-4fe8-bb63-af2c7e500ec8",
|
||||
"value": "Asia"
|
||||
},
|
||||
{
|
||||
"description": "Russia and former USSR",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"Russia",
|
||||
"kazakhstan"
|
||||
]
|
||||
},
|
||||
"uuid": "87a3ac08-6ffc-45eb-826e-e8e0af392563",
|
||||
"value": "Russia"
|
||||
},
|
||||
{
|
||||
"description": "Africa",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"Nigeria",
|
||||
"Malia",
|
||||
"Algeria"
|
||||
]
|
||||
},
|
||||
"uuid": "aba705b7-fcb4-4bf4-81d4-b896314f53ed",
|
||||
"value": "Africa"
|
||||
},
|
||||
{
|
||||
"description": "Oceania",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"Asutralia",
|
||||
"Polynesia"
|
||||
]
|
||||
},
|
||||
"uuid": "ae28830b-b90f-48d9-8b89-acda0864ff4e",
|
||||
"value": "Oceania"
|
||||
},
|
||||
{
|
||||
"description": "America",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"shadowrun:area"
|
||||
],
|
||||
"examples": [
|
||||
"UCAS",
|
||||
"CAS",
|
||||
"Pueblo Corporate COuncil",
|
||||
"AZtlan"
|
||||
]
|
||||
},
|
||||
"uuid": "d41c6222-4d10-43e9-9a8e-47d586eaf0e7",
|
||||
"value": "America"
|
||||
}
|
||||
],
|
||||
"version": 4
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
|
||||
The final result:
|
||||
|
||||
|
||||
Done! Eventually!
|
||||
|
||||
#### Dependencies
|
||||
|
||||
|
|
|
|||
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 455 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 82 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 166 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 385 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 492 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 397 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"description": "My Shadowrun test galaxy",
|
||||
"icon": "user-secret",
|
||||
"name": "shadowrun",
|
||||
"namespace": "RPG",
|
||||
"type": "shadowrun",
|
||||
"uuid": "7a956b4d-613c-4c08-b5d6-19974682aea8",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -30,7 +30,6 @@ A user of a role that grants sync permissions, these users (and their authentica
|
|||
### Synchronisation
|
||||
What we call synchronisation is an exchange of data between two (or more) MISP instances through our pull and push mechanisms.
|
||||
### Tagging
|
||||
Users with tagging rights can assigned various dynamically created tags to events, allowing an arbitrary link between events to be created. It is possible to filter events based on these tags and they can also be used to filter events for the automation.
|
||||
Users with tagging rights can assign various dynamically created tags to events, allowing an arbitrary link between events to be created. It is possible to filter events based on these tags and they can also be used to filter events for the automation.
|
||||
### Templating
|
||||
Users with templating rights can create easy to fill forms that help with the event creation process.
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
The process of entering an event can be split into 3 phases, the creation of the event itself, populating it with attributes
|
||||
and attachments and finally publishing it.
|
||||
|
||||
During this first step, you will be create a basic event without any actual attributes, but storing general information such as a description, time and risk level of the incident. To start creating the event, click on the New Event button on the left and fill out the form you are presented with. The following fields need to be filled out:
|
||||
During this first step, you will create a basic event without any actual attributes, but storing general information such as a description, time and risk level of the incident. To start creating the event, click on the New Event button on the left and fill out the form you are presented with. The following fields need to be filled out:
|
||||
|
||||
|
||||
|
||||
|
|
@ -328,7 +328,7 @@ The last option is a checkbox that restricts all of the results to attributes th
|
|||
## Updating and modifying events and attributes
|
||||
|
||||
Every event and attribute can easily be edited. First of all it is important to find the event or attribute that is to be edited, using any of the methods mentioned in the section on [browsing past events](#browsing_events).
|
||||
Once it is found, the edit button (whether it be under actions when events/attributes get listed or simply on the event view) will bring up the same screen as what is used to create the entry of the same type (for an event it would be the event screen as [seen here](#Creating an event), for an attribute the attribute screen as [described here](#add-attributes-to-the-event)). You can also simply double-click on the event you wish to edit and enter the edit mode.
|
||||
Once it is found, the edit button (whether it be under actions when events/attributes get listed or simply on the event view) will bring up the same screen as what is used to create the entry of the same type (for an event it would be the event screen as [seen here](#Creating an event), for an attribute the attribute screen as [described here](#add-attributes-to-the-event)). You can also simply double-click on the event you wish to edit and enter the edit mode.
|
||||
Keep in mind that editing any event (either directly or indirectly through an attribute) will unpublish it, meaning that you'll have to publish it (through the event view) again once you are done.
|
||||
|
||||
## Tagging
|
||||
|
|
|
|||
Loading…
Reference in New Issue