mirror of https://github.com/MISP/misp-website
chg: [blog:v2.5.2] Added more content
Sami Mokaddem
parent
5b2d24d3ae
commit
25464d54ca
|
|
@ -1,3 +1,14 @@
|
|||
---
|
||||
title: MISP 2.5.2 released - Post Hack.lu/CTI-Summit release with many new features
|
||||
banner: /img/blog/SkillAegis/skillaegis-banner.png
|
||||
author:
|
||||
- MISP Project team
|
||||
date: 2024-11-19
|
||||
tags: ["MISP", "Threat Intelligence", "release" ]
|
||||
layout: post
|
||||
---
|
||||
|
||||
|
||||
# Post Hack.lu/CTI-Summit release
|
||||
|
||||
The Hack.lu/CTI-Summit once again allowed us to get in touch with the community and sit down to talk about new features and issues to be implemented. As usual, it was a real pleasure to get that much concentrated feedback. In this release, we put a lot of effort trying to fix and create new content as much as possible based on the collected needs of the community.
|
||||
|
|
@ -10,55 +21,74 @@ In MISP, we’ve always had the ability to create workflows based on application
|
|||
|
||||
Ad-Hoc Workflows can be executed manually or scheduled, offering flexible options for routine or custom tasks. Additionally, the new `run_workflow` module enables workflows to launch other workflows, opening new chains of automation.
|
||||
|
||||
|
||||
|
||||
|
||||
With these standalone worklows at hand, the first things that came right into our mind was to allow users to apply a workflow directly to an event, similar to how you’d run an enrichment.
|
||||
|
||||
|
||||
|
||||
|
||||
These new capabilities unlock more automation possibilities, but with great power comes great danger to mess your data up! The increased flexibility means there’s potential to unintentionally alter data, so use this feature thoughtfully.
|
||||
|
||||
## Galaxies
|
||||
## Any Galaxy on the Event view
|
||||
### Any Galaxy Matrix on the Event view
|
||||
In the event view, you can now access all available galaxy matrices and select the specific one you'd like to view - a long-overdue feature that will finally give users a way to use their own matrices.
|
||||
|
||||
|
||||
|
||||
|
||||
## MITRE ATT&CK
|
||||
### MITRE ATT&CK
|
||||
Finally, the matrix for MITRE ATT&CK also includes an unfiltered tab `attack-enterprise` that shows all techniques on the same tab. This tab is the one that's opened by default whevener the matrix is diplayed.
|
||||
|
||||
|
||||
### Private Custom Galaxies
|
||||
Now in MISP, you can create and edit Custom Galaxies. Galaxies can have ownership and distribution levels, allowing galaxies and their clusters to be hidden as needed. Note that, similar to default Clusters, default Galaxies aren't editable.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
it’s now possible to encounter tags from unknown clusters through synchronization.
|
||||
|
||||
With this added flexibility there is a greater chance to encounter tags from unknown Galaxies or Clusters. This small UI issue can be addressed with a new setting `MISP.hide_unknown_cluster`. It will be enabled by default and hides unknown clusters from your tags list.
|
||||
|
||||
With the ability to hide clusters (and galaxies), a misconfiguration could unintentionally lead to large amounts of data being hidden. To address this, we've introduced a diagnostic widget on the Galaxy index page. This widget serves as a warning system, briefly highlighting unknown default and custom clusters.
|
||||
|
||||
|
||||
|
||||
|
||||
## Event Reports
|
||||
There has been many changes for Event Reports. Let's have a quick look at what's new!
|
||||
|
||||
### Tags on Event Reports
|
||||
To improve classification and sorting, users can now attach (global and local) tags on Event Reports.
|
||||
|
||||
|
||||
|
||||
### User Variables in Event Reports
|
||||
- User can define template variable in their user-settings
|
||||
- These variables can then be replaced in the event-report
|
||||
- The syntax to use the variable is the handlebars-style notation `{{var_name}}`
|
||||
- Also added support of hints when editing and UI to specify the template vars
|
||||
- Enabled more than 1 matrix in event report
|
||||
|
||||
|
||||
### Template Variables in Event Reports
|
||||
|
||||
|
||||
Template variables can now be defined in the user-settings for content that get reused in all event reports. These variables can be with the handlebars-style notation, `{{ var_name }}`. The replacement is done automatically when the report is visualized or exported. The UI has also been updated to support hints to specify these template variables.
|
||||
|
||||
|
||||
|
||||
### Export as PDF using Pandoc (through misp-module)
|
||||
We added a new "Download as PDF" option is in event reports, offering an alternative to the traditional "Save as PDF" print method. This functionality uses the `convert_markdown_to_pdf.py` module from the misp-module project. It converts markdown content (GFM format supporting HTML) to PDF using Pandoc and wkhtmltopdf. Note that these 2 dependencies have to be installed in order for the module to work as intended.
|
||||
|
||||
We added a new "Download as PDF" option is in event reports, offering an alternative to the traditional "Save as PDF" print method. This functionality uses the `convert_markdown_to_pdf.py` module from the misp-module project. It converts markdown content (GFM format supporting HTML) to PDF using Pandoc, wkhtmltopdf and mermaid-cli. Note that these 3 dependencies have to be installed in order for the module to work as intended.
|
||||
|
||||
|
||||
Once again, thanks to Hack.lu/CTI-Summit attendees for all the feedback
|
||||
### Picture Pasting in Event Reports
|
||||
You can now paste pictures directly into the Event Report editor. This long-awaited feature allows you to save images either on the disk or as an attachment to the event, making the reporting process faster and smoother.
|
||||
|
||||
{{<video src="/img/blog/2.5.2/event-report-img-pasting.mp4" title="Event report image pasting demo" >}}
|
||||
|
||||
### Manage Imported pictures
|
||||
|
||||
Site admins have the ability to manage images pasted but not saved as attributes. They can assign aliases to these images, allowing for quick and easy inclusion in reports using the following syntax:
|
||||
```md
|
||||
|
||||
```
|
||||
|
||||
## Extending Event
|
||||
We've enhanced the extended event functionality to make it more intuitive and slightly more versatile. Previously, you could switch to "extended view" to see the combined content of the parent event and all its child events. Now, we've added the reverse option: a merged view where the parent's data is merged into the child event.
|
||||
|
||||
Additionally, we've improved the UI to better indicate whether you're viewing an extended event (parent) or an extending event (child).
|
||||
|
||||
|
||||
|
||||
|
||||
Once again, thanks to Hack.lu/CTI-Summit attendees for all the feedback but also all the other contributors that helps us make the tool better. Thank you!
|
||||
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 123 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 101 KiB |
Loading…
Reference in New Issue