From 190388e886473d79b772ef965966e507122dee08 Mon Sep 17 00:00:00 2001
From: Andras Iklody <andras.iklody@circl.lu>
Date: Fri, 10 Nov 2017 11:13:26 +0100
Subject: [PATCH] Update 2017-11-10-MISP.2.4.82.released.md

---
 _posts/2017-11-10-MISP.2.4.82.released.md | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/_posts/2017-11-10-MISP.2.4.82.released.md b/_posts/2017-11-10-MISP.2.4.82.released.md
index 21ed9ad..a2ada0a 100755
--- a/_posts/2017-11-10-MISP.2.4.82.released.md
+++ b/_posts/2017-11-10-MISP.2.4.82.released.md
@@ -4,10 +4,10 @@ layout: post
 featured: /assets/images/misp-small.png
 ---
 
-A new version of MISP [2.4.82](https://github.com/MISP/MISP/tree/v2.4.82) has been released including an improved publish-subscribe ZMQ format, improvement in the feeds system, sighting is now ingested and synchronised among MISP instances, many bug fixes and export improvement.
+A new version of MISP [2.4.82](https://github.com/MISP/MISP/tree/v2.4.82) has been released including an improved publish-subscribe ZMQ format, improvements in the feeds system, sightings are now ingested and synchronised among MISP instances, many bug fixes and export improvements.
 
 MISP includes a nifty real-time publish-subscribe system to notify subscribers on any updates on a MISP instance. 2.4.82 introduced new channels and expanded format
-to deliver additional information to the subscribers. The system can be used to feed stream processing automation systems (e.g. IntelMQ), real-time SIEM interaction , monitoring or custom application. As an example, we developed a complete dashboard application called [misp-dashboard](https://www.github.com/MISP/misp-dashboard) which solely relies on the publish-subscribe ZMQ feature to allow a geolocalised view, historical search of geographical information and contributor dashboard which is the first version of the gamification model in MISP to promote information sharing (a separate post will come soon).
+to deliver additional information to the subscribers. The system can be used to feed stream processing automation systems (e.g. IntelMQ), real-time SIEM interaction , monitoring or custom applications. As an example, we developed a complete dashboard application called [misp-dashboard](https://www.github.com/MISP/misp-dashboard) which solely relies on the publish-subscribe ZMQ feature to allow for a geolocalised view, historical searches of geographical information and a contributor dashboard which is the first version of the gamification project in MISP to promote information sharing (a separate post will come soon).
 
 <div class="myvideo">
    <video  style="display:block; width:100%; height:auto;" autoplay controls loop="loop">
@@ -17,8 +17,9 @@ to deliver additional information to the subscribers. The system can be used to
 
 MISP ZMQ has new channels especially related to MISP objects in addition to events and attributes.
 
-CSV export has been improved to allow the selection of attributes to be exported. CSV is still the most commonly exported format used
-and we had feedback from various organisations relying on CSV to enhance the export.
+CSV export has been improved to allow the selection of columns to be included in the export. 
+CSV is still the most commonly exported format used and we had feedback from various organisations 
+relying on CSV requesting enhancements to the export format.
 
 The old legacy CSV export will work as before like exporting all attributes:
 
@@ -26,18 +27,18 @@ The old legacy CSV export will work as before like exporting all attributes:
 GET https://<misp-instance>/events/csv/download/<event-id>
 ~~~~
 
-The new export format allows to select some attributes using the following query format:
+The new export format allows to select more columns using the following query format:
 
 ~~~~
 GET https://<misp-instance>/events/csv/download/<event-id>?attributes=timestamp,type,uuid,value
 ~~~~
 
-The order of the attribute will be honoured including attributes of objects.
+The order of columns will be honoured including those related to object level information.
 
-The new export format allows to select some attributes including some attributes from the objects too:
+To select object level columns, simply pre-pend the given object column's name by object_, such as:
 
 ~~~~
-GET https://<misp-instance>/events/csv/download/<event-id>?attributes=timestamp,type,uuid,value&obj_attributes=uuid,name
+GET https://<misp-instance>/events/csv/download/<event-id>?attributes=timestamp,type,uuid,value&object_attributes=uuid,name
 ~~~~
 
 The following columns will be returned (all columns related to objects
@@ -51,10 +52,10 @@ The STIX 2.0 export has been improved to include custom objects, Person object i
 
 The STIX 1.x export now includes reporter in STIX incident and producer in STIX indicator and MISP TLP Marking as STIX tlpMarking. File objects are now included in STIX 1.x export.
 
-The MISP feed format has been improved to include objects, attribute tags and objet references. The format has been also significantly improved with a quick-hash-list to perform fast lookups and improve the MISP caching mechanisms for large feeds. If you rely on the feed generator in PyMISP, [feed-generator has been updated](https://github.com/MISP/PyMISP/commit/195cd6d7fc305ac6628ed8f2ff762b3f69a9b6ca).
+The MISP feed format has been improved to include objects, attribute tags and object references. The format has been also significantly improved with a quick-hash-list to perform fast lookups and improve the MISP caching mechanisms for large feeds. If you rely on the feed generator in PyMISP, [feed-generator has been updated](https://github.com/MISP/PyMISP/commit/195cd6d7fc305ac6628ed8f2ff762b3f69a9b6ca).
 
 The feed preview in MISP has been improved to include the objects and support the new feed format.
 
-MISP [galaxy](/galaxy.pdf), [objects](/objects.pdf] and [taxonomies](/taxonomies.pdf) were notably extended by many contributors. These are also included by default in MISP. Don't forget to do a `git submodule update` and update in the UI the respective galaxy, objects and taxonomies.
+MISP [galaxy](/galaxy.pdf), [objects](/objects.pdf] and [taxonomies](/taxonomies.pdf) were notably extended by many contributors. These are also included by default in MISP. Don't forget to do a `git submodule update` and update galaxies, objects and taxonomies via the UI.
 
 For the MISP users joining the [Borderless Cyber Conference and Technical Symposium / 6-8 Dec 2017 / Prague](https://eu17.first-oasis-conference.org/en/), we will do a MISP training on the 8th December.