chg: [misp] new features added

features.html

@@ -25,7 +25,7 @@ Discover how MISP is used today in multiple organisations. Not only to store, sh
         <li> Automatic <strong>correlation</strong> finding relationships between attributes and indicators from malware, attacks campaigns or analysis. Correlation engine includes correlation between attributes and more advanced correlations like Fuzzy hashing correlation (e.g. ssdeep) or CIDR block matching. Correlation can be also enabled or event disabled per attribute.</li>
         <li> A flexible data model where complex <a href="/objects.html">objects</a> can be expressed and <a href="/objects.html#_relationships">linked together</a> to express threat intelligence, incidents or connected elements.</li>
         <li> Built-in <strong>sharing functionality</strong> to ease data sharing using different model of distributions. MISP can synchronize automatically events and attributes among different MISP. Advanced filtering functionalities can be used to meet each organization sharing policy including a <strong>flexible sharing group</strong> capacity and an attribute level distribution mechanisms.</li>
-        <li> An <strong>intuitive user-interface</strong> for end-users to create, update and collaborate on events and attributes/indicators. A <strong>graphical interface</strong> to navigate seamlessly between events and their correlations. Advanced filtering functionalities and <a href="https://github.com/MISP/misp-warninglists">warning list</a> to help the analysts to contribute events and attributes.</li>
+        <li> An <strong>intuitive user-interface</strong> for end-users to create, update and collaborate on events and attributes/indicators. A <strong>graphical interface</strong> to navigate seamlessly between events and their correlations.  An <strong>event graph</strong> functionality to create and view relationships between objects and attributes. Advanced filtering functionalities and <a href="https://github.com/MISP/misp-warninglists">warning list</a> to help the analysts to contribute events and attributes.</li>
         <li> <strong>storing data</strong> in a structured format (allowing automated use of the database for various purposes) with an extensive support of cyber security indicators along fraud indicators as in the financial sector.</li>
         <li> <strong>export</strong>: generating IDS (Suricata, Snort and Bro are supported by default), OpenIOC, plain text, CSV, MISP XML or JSON output to integrate with other systems (network IDS, host IDS, custom tools)</li>
         <li> <strong>import</strong>: bulk-import, batch-import, free-text import, import from OpenIOC, GFI sandbox, ThreatConnect CSV or MISP format.</li>
@@ -41,6 +41,7 @@ Discover how MISP is used today in multiple organisations. Not only to store, sh
                 <li> <strong>sighting support</strong> to get observations from organizations concerning shared indicators and attributes. Sighting <a href="https://www.circl.lu/doc/misp/automation/index.html#sightings-api">can be contributed</a> via MISP user-interface, API as MISP document or STIX sighting documents. Starting with MISP 2.4.66, <a href="https://www.misp.software/2017/02/16/Sighting-The-Next-Level.html">Sighting has been extended</a> to support false-negative sighting or expiration sighting.</li>
                 <li> <strong>STIX support</strong>: export data in the STIX format (XML and JSON) including export/import in STIX 2.0 format.</li>
                 <li> <strong>integrated encryption and signing of the notifications</strong> via PGP and/or S/MIME depending of the user preferences.</li>
+                <li> <strong>Real-time publish-subscribe channel</strong> within MISP to automatically get all changes (e.g. new events, indicators, sightings or tagging) in ZMQ (e.g. <a href="https://github.com/MISP/misp-dashboard">misp-dashboard</a>) or Kafka.</li>
         </ul>
 
                 <h3>Sharing with humans</h3>