MISP
/
misp-website
mirror of https://github.com/MISP/misp-website
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: duration for recorrelation was based on initial execution with other (flawed) version, fixed

pull/47/head
iglocska 2021-04-28 09:09:24 +02:00
parent a7aab0466c
commit 777c6c37a3
No known key found for this signature in database
GPG Key ID: BEA224F1FEF113AC
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
_posts/2021-04-27-MISP.2.4.142.released.md
View File

@ -18,7 +18,7 @@ With the current release we've included two main tools to combat this:
We can now remove individual values from ever correlating again, so if you come across some typical noisy values (such as empty file hashes, registry values of 000000, internal IPs recurringly encoded by your sandbox), you can add those to the exclusion list. We can now remove individual values from ever correlating again, so if you come across some typical noisy values (such as empty file hashes, registry values of 000000, internal IPs recurringly encoded by your sandbox), you can add those to the exclusion list.
Once added, you can execute the cleaning of the existing correlations, to retroactively execute your exclusion rules. This is a background processed task and depending on the amount of correlations you have may take quite some time (it took us around 10 minutes on 25M correlations), so just fire it off and check back later whether the job has completed. Once added, you can execute the cleaning of the existing correlations, to retroactively execute your exclusion rules. This is a background processed task and depending on the amount of correlations you have may take quite some time (it took us around 30 minutes on 25M correlations), so just fire it off and check back later whether the job has completed.
You can also comment your reason for removing an entry. In the future we plan on publishing community maintained default exclusion lists. You can also comment your reason for removing an entry. In the future we plan on publishing community maintained default exclusion lists.