MISP feed - Update Query documentation (#27713)

demisto · Jul 2, 2023 · 3308b1e · 3308b1e
1 parent e20ae79
commit 3308b1e
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 1 deletion.
diff --git a/Packs/FeedMISP/Integrations/FeedMISP/FeedMISP.py b/Packs/FeedMISP/Integrations/FeedMISP/FeedMISP.py
@@ -350,6 +350,9 @@ def fetch_indicators(client: Client,
                      is_fetch: bool = True) -> List[Dict]:
     params_dict = clean_user_query(query) if query else build_params_dict(tags, attribute_type)
 
+    if limit and limit not in params_dict:
+        params_dict['limit'] = limit
+
     response = client.search_query(params_dict)
     indicators_iterator = build_indicators_iterator(response, url)
     added_indicators_iterator = update_indicators_iterator(indicators_iterator, params_dict, is_fetch)

diff --git a/Packs/FeedMISP/Integrations/FeedMISP/README.md b/Packs/FeedMISP/Integrations/FeedMISP/README.md
@@ -117,3 +117,22 @@ Gets indicators from the feed.
 
 #### Human Readable Output
 Retrieved 7 indicators.
+
+## Additional Information
+If you experience a timeout error while fetching indicators, the following query configuration may be helpful for you.
+
+You can configure the feed to return results from the last 24 hours as shown below:
+```json
+{
+    "returnFormat": "json",
+    "type": {
+        "OR": []
+    },
+    "tags": {
+        "OR": []
+    },
+    "last":"24h"
+}
+```
+
+Both of the above queries can be modified however you would like depending on your specific use case. Additional information can be found here https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes
diff --git a/Packs/FeedMISP/ReleaseNotes/1_0_24.md b/Packs/FeedMISP/ReleaseNotes/1_0_24.md
@@ -0,0 +1,5 @@
+
+#### Integrations
+
+##### MISP Feed
+- Documentation and metadata improvements.
diff --git a/Packs/FeedMISP/pack_metadata.json b/Packs/FeedMISP/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "MISP Feed",
     "description": "Indicators feed from MISP",
     "support": "xsoar",
-    "currentVersion": "1.0.23",
+    "currentVersion": "1.0.24",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",