MISP
/
misp-book
mirror of https://github.com/MISP/misp-book
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #242 from Wachizungu/add-visibility-of-data-section 

chg: [sharing/sync] Add visibility of data section. Fix #226
pull/255/head
Alexandre Dulaunoy 2021-03-12 07:19:25 +01:00 committed by GitHub
parent 7e2381bce5 883675fdb9
commit 95e16d287a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sharing/README.md
View File

@ -167,6 +167,17 @@ Events that are not published are only distributed/shared to the local organisat
Only events that are **published** will be shared with remote organisations on other MISP servers via push/pull mechanisms. Only events that are **published** will be shared with remote organisations on other MISP servers via push/pull mechanisms.
More details on publishing events [here](../using-the-system/#publish-an-event). More details on publishing events [here](../using-the-system/#publish-an-event).
#### Visibility of data - events objects and attributes
Assuming that none of the ancestors of the object of attribute are too restrictive, you can view an event/object/attribute on an instance if:
- You are a site admin
- You have any of the other roles and one of the below statements are true:
- You belong to the owner organisation of the event and the distribution is 'Your organisation only'
- The distribution of the event/object/attribute is 'This community only', 'Connected communities' or 'All communities'
- Your organisation belongs to the sharing group of the event/object/attribute or the sharing group has the 'all orgs' flag set for the instance
*Note*:
- As of MISP version 2.4.140: When pulling in data you can only see due to the 'all orgs' flag being set in the sharing group, your organisation will be added to the sharing group when creating the data locally.
### Community ### Community
A community is composed of the local organisations on a MISP server and the remote organisations connected by the sync users. For more information on the concept of community, refer to an [article on MISP information sharing following ISO/IEC 27010](https://github.com/MISP/misp-compliance/blob/master/ISO_IEC_27010/misp-sharing-information-following-ISO-IEC-27010.md#suitable-data-model), explaining the concept of community. A community is composed of the local organisations on a MISP server and the remote organisations connected by the sync users. For more information on the concept of community, refer to an [article on MISP information sharing following ISO/IEC 27010](https://github.com/MISP/misp-compliance/blob/master/ISO_IEC_27010/misp-sharing-information-following-ISO-IEC-27010.md#suitable-data-model), explaining the concept of community.