MImisp
Feeds

Edit a feed

Changed on
put/feeds/edit/{feedId}

Request

  • Base URL
    https://misp.local
  • URL
    https://misp.local/feeds/edit/{feedId}
  • Auth
    API key in header Authorization

Path parameters

string required
OR
string uuid required
Example:3

UUID or numeric ID of the feed

Request body

idstring
namestring
providerstring
urlstring
rulesstring nullable

Stringified JSON filter rules.

enabledboolean
distribution'0' | '1' | '2' | '3' | '4' | '5'

Who will be able to see this event once it becomes published and eventually when it becomes pulled:

  • 0 - Your organization only
  • 1 - This community only
  • 2 - Connected communities
  • 3 - All communities
  • 4 - Sharing group
  • 5 - Inherit Event
tag_idstring
source_format'1' | 'csv' | 'freetext' | 'misp'
fixed_eventboolean

target_event option might be considered

delta_mergeboolean

Merge attributes (only add new attribute, remove revoked attributes)

event_idstring
publishboolean
override_idsboolean

The IDS flags will be set to Off for this feed

input_source'local' | 'network'

Specify whether the source (url field) is a directory (local) or a genuine url (network).

delete_local_fileboolean

The IDS flags will be set to Off for this feed

lookup_visibleboolean

The lookup will not be visible in the feed correlation

headersstring nullable

Headers to be passed with the requests. All separated by

caching_enabledboolean

The feed is cached

force_to_idsboolean

The IDS flags will be set to On for this feed

orgc_idstring

Example request

{
  "id": "3",
  "name": "CIRCL OSINT Feed",
  "provider": "CIRCL",
  "url": "https://www.circl.lu/doc/misp/feed-osint",
  "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
  "distribution": "4",
  "sharing_group_id": "1",
  "tag_id": "12345",
  "event_id": "12345",
  "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
  "orgc_id": "12345"
}

Response

Get feed response

Example response

{
  "Feed": {
    "id": "3",
    "name": "CIRCL OSINT Feed",
    "provider": "CIRCL",
    "url": "https://www.circl.lu/doc/misp/feed-osint",
    "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "distribution": "4",
    "sharing_group_id": "1",
    "tag_id": "12345",
    "event_id": "12345",
    "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
    "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
    "orgc_id": "12345",
    "cache_timestamp": "1617875568"
  }
}

Changes

  • 0a9c9382121aRevision changes
    • breaking

      the request property became not nullable

    • breaking

      the request property type changed from string to no type

    • breaking

      the ///// response property's maxLength was unset from 10 for the response status

    • breaking

      added to the ///// response property oneOf list for the response status

    • breaking

      the ///// response's property type changed from string to no type for status

    • info

      added to the request property oneOf list

    • info

      removed the pattern ^\d+$|^$ from the request property

    • info

      the ///// response's property pattern ^\d+$|^$ was removed for the status