hey ,

I tried to install the module on the same MISP server ubuntu 16.04 . Not sure it matters but instead of "git submodule update" I used "git clone https://github.com/yinqiwen/ardb.git" because of the SSH I can't open. When I finish installing, I try Starting the ReST API server and encounter the "configparser.NoSectionError: No section: 'server'" error.
I changed the file name from server.cfg.sample to server.cfg and did not change the settings inside (need to change them?). Now I'm having the error "redis.exceptions.ConnectionError: Error 2 connecting to unix socket: /tmp/ardb.sock. No such file or directory."
The file really does not exist, should it be created manually? So what settings should I put in it?

Thank you !
Shimi

Hello,

I'm using 2.4.177 version of MISP, and still receive same error message 403.
Does anyone knows if this connection between MISP and misp-sighting-server is available already for this version?

Thanks in advance.

Was looking into using this as a plug-in replacement in the future for the sighting system, it indeed looks very good and the performance is insanely fast.

However, in order to fully replicate what we have currently we need to be able to replicate the following:

• value based sighting
• id/uuid sighting
• source
• types:
  • sighting
  • FP (added just now)
  • expiration (to be added, but tricky due to 1/org limitation - maybe this shouldn't go in here?)
• timestamp
• org_id/org_uuid

Once we have all of them covered we can start thinking about phasing out the current implementation (though sharing across instances will still be tricky).

Hi, I would like to ask if I understood this "misp-sighting-server" correctly. I thought that it serves as a database to store "sightings" for individual attributes for multiple MISP instances. But I have a problem with the connection from MISP. The instance is communicating correctly, I tried listening via netcat and MISP is communicating. I get the error message Error 403:, but my "misp-sighting-server" via "curl" responds correctly. ( curl --header 'X-API-Key: afdef83f9cc7c87b801c36e4af632ef06af2f2ef' -X PUT http://127.0.0.1:5000/add -d "value=127.0.0.1&type=0&org_uuid=0acdaad8-b305-482f-a904-78330640636b" -d "source=honeypot")