MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

some more stuff

pull/21/head
Andras Iklody 2018-10-07 11:33:48 +02:00 committed by GitHub
parent bc35cf0030
commit 100ba755cb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
misp-query-format/raw.md
View File

@ -82,17 +82,28 @@ returnFormat **MUST** be present. returnFormat sets the type of output format. M
| suricata | Suricata NIDS format | | suricata | Suricata NIDS format |
| snort | Snort NIDS format | | snort | Snort NIDS format |
| csv | CSV format | | csv | CSV format |
| rpz | Response policy zone format |
| text | Raw value list format |
### limit ### limit
limit **MAY** be present. If present, the page parameter **MUST** also be supplied. limit sets the number of returned elements when paginating, depending on the scope of the request (x number of attributes or x number of events) as converted into the output format.
### page ### page
page **MAY** be present. If present, the page parameter **MUST** also be supplied. page generates the offset for the pagination and will return a result set consisting of a slice of the query results starting with offset (limit * page) + 1 and ending with (limit * (page+1)).
### value ### value
value **MAY** be present. If set, the returned data set will be filtered on the attribute value field. value **MAY** be a string or a sub-string, the latter of which start with, ends with or is encapsulated in wildcard (\%) characters.
### type ### type
type **MAY** be present. If set, the returned data set will be filtered on the attribute type field. type **MAY** be a string or a sub-string, the latter of which start with, ends with or is encapsulated in wildcard (\%) characters.
### category ### category
category **MAY** be present. If set, the returned data set will be filtered on the attribute category field. category **MAY** be a string or a sub-string, the latter of which start with, ends with or is encapsulated in wildcard (\%) characters.
# Security Considerations # Security Considerations