MISP/misp-rfc

Several of the attribute attributes refer to their context as "event", maybe C&P error?

acruise opened this issue · 3 comments

e.g.

the event. The uuid MUST be preserved for any updates or transfer of

If the uuid/id really do refer to the presumed parent event, they should be described that way... If they are actually attributes of the attribute (meta-attribute?) the noun should be updated. :)

It would be good to clarify the relationship between id and uuid ... is the id locally unique within a given installation, but likely to change if an object is sent to a different org? Is the uuid expected to stay the same under such a situation?
Edit: I read a bit more, the answer is yes. :)

Yup, clarification would be welcome. I get a lot of "Duplicate UUID found in attribute" in my logs. I think because I try to use the same UUID (for the same attribute) in a different event (from the same manifest.json). I would expect that if the attribute is the same (an IP address in this case) the UUID could stay the same.
Maybe a hint could be added on how to best create an attribute UUID.
Is it org UUID, event UUID and attribute value?