Last parameter not working

Question

Last parameter not working

Closed this issue 2 years ago · 2 comments

While using last=1h the filter doesn't works. It also gives misp IoCs from a very long time in past. It seems it got depreciated in MISP.

Answer 1 · 2022-12-10T16:03:22.000Z

Hi. Thank you for reporting. I'll check and improve Remi Le 10 décembre 2022 00:41:11 GMT+01:00, Gh1Dra0 ***@***.***> a écrit :

While using last=1h the filter doesn't works. It also gives misp IoCs from a very long time in past. It seems it got depreciated in MISP. -- Reply to this email directly or view it on GitHub: #222 You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

-- Sent with K-9 Mail.

Answer 2 · 2022-12-10T16:05:54.000Z

Hi Be aware that last applies on last publish timestamp of eventvand not at attributes timestamp level I.e. it returns all attributes of an event published in last hour Cheers Le 10 décembre 2022 00:41:11 GMT+01:00, Gh1Dra0 ***@***.***> a écrit :

While using last=1h the filter doesn't works. It also gives misp IoCs from a very long time in past. It seems it got depreciated in MISP. -- Reply to this email directly or view it on GitHub: #222 You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

-- Sent with K-9 Mail.