Unpublish or Change Distribution of all events
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 491
- Forks
- 290
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 3
Description
Hi,
We are syncing events (pull) from multiple external MISP instances to ours. Now we want to create a new org for one of the internal department and give them access to only that org events that they will create. However the events that we are pulling are also getting shared with that org because of the distribution. We want to restrict sharing of those events to the new local org.
I tested manually and if i unpublish all synced events or change the Distribution to "Own Organization only" then those events do not reflect in the new org. But i am not sure if there's a way to automate this as we have too many events to do this manually. Also the unpublish checkbox in the sync setting only works for push ops and not for pull.
Is there a way to achieve this via some sort of automation ?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by reviewing PyMISP's sync-related API support and the MISP distribution and unpublish controls, focusing on pull behavior rather than push operations. Done means there is a documented or implemented way to restrict pulled events to the intended local organization without manual updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100