Skip to content

Commit

Permalink
chg: [faq] Update README.md to include blocking attachment
Browse files Browse the repository at this point in the history
  • Loading branch information
mokaddem authored Sep 25, 2024
1 parent f9c7644 commit 36f870a
Showing 1 changed file with 12 additions and 0 deletions.
12 changes: 12 additions & 0 deletions faq/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -922,6 +922,18 @@ Created symlink from /etc/systemd/system/multi-user.target.wants/php73-php-fpm.s
A galaxy can be assigned like a tag. You can use the add tag function and copy the full conntector-tag. Example `misp-galaxy:ransomware=“Locky”`, which can be found in `/galaxy_clusters/view/`
## How to block attachment (and malware-sample) to be ingested
For that, we'll use the Import Regex feature in MISP.
1. Got to `/regexp/admin_index` (In the UI under Input Fulters -> Import Regexp)
2. Create a new import Regex `/admin/regexp/add`
- Regexp: `/^.$/i`
- Note: If you want to only allow specific file extensions, you can use a regex a similar regex (in this case, we only allow .png attachment): `/^.*\.(?!png)[^.]+$/i`
- Replacement: `[Leave the field empty]` (Leaving the field empty will prevent that value to be saved)
- Select the checkboxes `attachment` and `malware-sample`
3. From that point onward, users will still be able to add attachement but they won't be accepted by the system anymore.
- Note: If you allowed specific file extensions, only file ending with the provided extension will be accepted. Please, bear in mind that it only looks at the filename and skip MIME checks alltogether.
## Updating PHP from 7.2 to 7.4.5 on Ubuntu 18.04
### Installation
Expand Down

0 comments on commit 36f870a

Please sign in to comment.