Quarto migration - #301
Draft
iglocska wants to merge 34 commits into
Draft
Conversation
Full toolchain migration per the MISP Book Rework PRD (Phase 2).
Build:
- Add _quarto.yml (book project) covering all 35 chapters in SUMMARY.md
reading order, plus the glossary as an appendix. Outputs HTML + PDF (Typst,
no LaTeX) + EPUB. Reuse the spike's branding (assets/misp.scss, logos) and
the frozen executable-cell pattern.
- Rename every <chapter>/README.md -> <chapter>/index.qmd (history preserved);
add front-matter titles; strip <!-- toc --> and duplicated title headings.
- Convert GitBook constructs: {% codesnippet %} (keys.py / start_workers.sh
inlined, last.py replaced by a live frozen PyMISP search() cell); pagebreak
divs -> {{< pagebreak >}}; raw <img> -> figure; "> [warning]" alerts ->
Quarto callouts. Rewrite ../foo/README.md links to ../foo/index.qmd.
- GLOSSARY.md -> glossary.qmd; README.md becomes a repo-facing readme.
Content-integrity fixes surfaced by Pandoc's stricter parsing (Honkit's
marked.js hid these; they were broken in every format):
- Fix unclosed / inline-on-their-own-line code fences that swallowed real
headings (faq, administration).
- Insert a blank line before 101 headings that followed a non-blank line and
were being folded into the preceding paragraph (general-concepts rendered
only 1 of ~14 headings before this).
- Repair 6 dead/wrong internal anchors so all cross-references resolve; fix a
broken image path (using-the-system TOTP screenshot).
CI & tooling:
- Replace honkit.yml with quarto.yml (quarto-actions): build all three formats
on push, an offline lychee link+anchor check, and an rsync-to-CIRCL deploy on
main gated on the CIRCL_DEPLOY_KEY/CIRCL_KNOWN_HOSTS secrets.
- Update publish.sh (quarto render + rsync, drop MOBI) and serve.sh (quarto
preview); refresh README/USAGE/CONTRIBUTING for the new toolchain.
- Remove book.json and styles/*.css; commit _freeze/ so CI renders hermetically.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Systemic, text-only content fixes from the B1 content audit (prds/misp-book-content-audit.md), verified against /var/www/MISP7 source and rendered green (HTML) + offline link-check clean. - workers: CakeResque -> SimpleBackgroundJobs/Supervisor across administration, faq, requirements, general-concepts, appendices G (6 queues; Worker showQueues|flushQueue|showJobStatus; old *Worker commands documented as no-ops) - CLI: Admin updateDatabase -> runUpdates; UserIP/IPUser -> User user_ips/ip_user - version/OS currency: PHP 5/7.2 -> 8.3, Ubuntu 18.04 -> 24.04 / Debian 12-13, branch 2.4 -> 2.5; removed the two obsolete PHP-upgrade FAQ walkthroughs and pre-2.5 hotfix Q&As - faq: MISP.live command -> `cake Admin live`; TAXII 2.x answer - categories-and-types: add edge-extension-id, suricata, uuid (verified vs describeTypes.json) + a regeneration note - taxonomy: static 32-list -> dynamic pointer (live 166); 2.4.X reframe - updating-python: STIX1 -> misp-stix; pydeep->pydeep2; zmq->pyzmq; requirements.txt as the canonical update path - requirements: add software-requirements section (PHP/MariaDB/Redis/ Supervisor/OS matrix); drop defunct COVID example - user-stories/personas: AM!TT/AMITT -> DISARM; prune dead tooling - cross-links: sharing/glossary -> Quarto-validated .qmd links - appendices: Appendix F LDAP warning callout (full rewrite deferred) 13 files, +159/-480. Wave B/C/D (P1 chapter rewrites, net-new chapters, Phase 3 screenshots, B6 restructure) remain -- see the audit report. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Full rewrite of the flagship chapter against MISP 2.5.42 source (/var/www/MISP7) + live instance. Restructures around the real event lifecycle: create -> populate -> contextualise -> collaborate -> publish. - Add Event: drop removed GFI Sandbox field; document current fields (Distribution incl. Sharing group, Threat Level default Undefined, Analysis, Event Info, Extends Event) + "Create event via template" callout. - Add Attribute: add first_seen/last_seen, disable_correlation, batch-import checkbox, and the "Inherit event" distribution default. - Add Attachment: multi-file upload, malware-checked-by-default, object templates + advanced extraction. - Consolidate legacy OpenIOC/ThreatConnect/template/freetext imports under the single "Populate from..." chooser; drop dead ioc_parser/report_to_misp. - New context sections: tagging (taxonomies/galaxies/tag collections, local vs global), analyst data (notes/opinions/relationships), enrichment (Enrich Event/Cortex/hover), decaying scores. - Rewrite the event view: 9 content toggles (Pivots, Galaxy, Event graph, Event timeline, Correlation graph, Galaxy matrix, Event reports, Attributes, Discussion), updated general-info block (Creator/Owner org, Protected Event, Extends/Extended by, Sightings, Correlation toggle), and the modern attribute table with inline tools. - Add collaboration (proposals, sightings, contact reporter, delegation), publish variants (unpublish, publish sightings, delegate, ZMQ/Kafka), and an Extending events section. - Sharing Groups: keep the 4-tab wizard, relabel "Servers" -> "MISP Instances". - Exporting: modern restSearch / "Download as..." path; note legacy cached-export page disabled by default. - Collapse duplicated "Connecting to other instances" + "REST API" sections to pointers (sharing / automation own that content); preserve inbound anchors (#creating-an-event, #publish-an-event, #create-and-manage-sharing-groups, #rest-api). - Keep the accurate TOTP/HOTP MFA section. Rendered green (HTML); linkcheck clean (all cross-links + inbound anchors resolve). Screenshots left for Wave D per the audit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deep pass beyond the Wave A worker sweep, verified against /var/www/MISP7 source + live instance. - Roles: replace the stale ~11-item extra-permission list with the corrected 4-level model (Read Only / Manage Own / Manage Org / Manage & Publish) and a full 24-permission table (site/org admin, sync variants, sighting, galaxy/ object-template/decaying/analyst-data/warninglist editors, zmq/kafka, feed correlations, skip-otp, server signing); note the 6 default roles. - Blocklists: add the three missing types (Sighting, Galaxy cluster, Analyst data) with their enable settings, and note Event Block Rules management. - Correlation: expand "correlation exclusions" into a full correlation section (exclusions, event-relationship rules, over-correlating values + correlation_limit, Top Correlations, engine selector). - Logs: rewrite the pre-2.5 single-Log-UI section around the 2.5 "Logs" menu — Application/Audit/Access/Search; document AuditLog (log_new_audit, field-level diffs, ACL scoping) and AccessLog (log_paranoid* verbosity). Fix "top API users" to query access_logs; replace the dead resque-* on-disk log paths with misp-workers.log/-errors.log; fix failed-auth menu paths. - CLI: add 2.5 maintenance commands (live, redisReady, configLint, schemaDiagnostics, optimiseTables, securityAudit, cleanCaches, reencrypt, updateToAdvancedAuthKeys). - Add an "Other 2.5 administration features" section: advanced AuthKeys, decaying models, Workflows, Cerebrate, TAXII servers, Dashboards, Benchmarking (with menu locations + enabling settings). - Rewrite the recurring-task scheduling around the reworked Supervisor-scheduler cron-style Scheduled Tasks; drop the malformed triple-quote block; align the Jobs queue-filter list. - Remove the "under modification" scaffold + redundant manual TOC; drop the GFI Sandbox reference in Import Regexp. Rendered green (HTML); linkcheck clean (inbound #automating-certain-console-tasks and new internal anchors resolve). Screenshots deferred to Wave D. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the pre-2.5 "edit JSON files on disk / fork the repo" framing with a UI-first (Galaxy 2.0) chapter, verified against /var/www/MISP7 source. - Galaxies/clusters concept + the misp-galaxy:type="uuid" tag model; galaxy vs taxonomy distinction. - Managing galaxies in the UI: index (tabs, columns, enabled/local-only), galaxy view + cluster list context tabs, enable/disable, Update / Force Update / Wipe Default (still ingests the on-disk misp-galaxy submodule; cake Admin updateGalaxies), matrix (ATT&CK) galaxies. - Using galaxies in events/attributes: Add new cluster vs Add new local cluster, the select-galaxy→select-cluster picker, synonyms/search, per-cluster inline actions (view/list/relationship/detach), global vs local. - NEW: creating custom clusters in the UI (form fields: Name/Distribution/Sharing Group/Description/Authors/Source/Elements, Toggle UI), custom galaxies, default-read-only vs custom, publishing (must publish to use/sync; edits auto-unpublish). - NEW: forking a cluster (editable copy, extends_uuid/version, "new version available" update). - NEW: cluster relationships (source→target, free-form type, tags, distribution; tree/tabular view; unpublishes source). - NEW: galaxy-cluster blocklist (cross-link administration). - Repoint JSON authoring to the MISP Galaxy Editor (misp-engineering-bay) instead of hand-editing files; drop the ~500-line Shadowrun example. - Replace the static ~35-cluster "Available Galaxies" dump with a dynamic pointer (live instance has 128 galaxies; see the misp-galaxy repo). Rendered green (HTML); linkcheck clean. Screenshots deferred to Wave D. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Targeted rework of the API chapter (verified vs /var/www/MISP7 + live 2.5.42),
focused on the systemic breaks rather than a full rewrite of the 2.6k-line
recipe list.
- Reframe the intro away from "generate IDS signatures / Signature field=Yes"
to the general-purpose REST API.
- Add a "The MISP REST API" headline section making /api/openapi (Redoc OpenAPI
3.0 spec) and the built-in REST client (/api/rest) the canonical, versioned
reference; cross-link PyMISP.
- Fix the auth section: drop the stale "API key in the event-actions/automation
menu" and the ancient "2.2 URL auth deprecated/temporarily supported" note
(URL auth is gone); point to My Profile > Auth Keys. Fix the mislabeled
authkey-created screenshot caption.
- Fill the "Status Codes" placeholder with real 200/403/404/405/500 semantics.
- Correct the returnFormat list for /events/restSearch (was json,xml,openioc,
suricata,snort → the full 24 formats from Event::validFormats), with a pointer
to /api/openapi.
- Replace the stale getVersion example (2.4.85) with the live 2.5.42 response
(incl. pymisp_recommended_version, perm_*, request_encoding, collection_sync)
and note getPyMISPVersion is deprecated.
- Fix two broken curl examples (unescaped inner quotes → single-quoted JSON
bodies) so they actually run.
- Scrub the insecure admin/users output example (plaintext password + authkey
→ redacted).
- Flag the legacy positional-URL export block ("Special Cases") as deprecated in
favour of POST restSearch + returnFormat.
Rendered green (HTML); linkcheck clean; inbound #sightings-api preserved.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Verified against the installed pymisp 2.5.34.1 API surface.
- Fix the constructor everywhere: PyMISP(url, key, ssl=..., debug=...) — drop the
removed positional out_type='json' argument.
- Replace the add_named_attribute() walkthrough (method removed from the library)
with add_attribute(event, {...}, pythonify=True) and a MISPEvent object-model
example; explain pythonify.
- Installation: pip install . (pyproject.toml) instead of python setup.py install;
note ExpandedPyMISP is a deprecated alias and getVersion.pymisp_recommended_version.
- Getting started: get the key from My Profile > Auth Keys (drop the removed
/events/automation URL); keys.py with misp_verifycert.
- Fix the consuming-feed snippet constructor (ssl kwarg).
- Replace the ~2017 static examples catalogue with a pointer to the repo's
examples/ directory (the set evolves).
- Repoint all links from github.com/CIRCL/PyMISP (master) to github.com/MISP/PyMISP
(main) and the PyMISP docs.
- Keep the frozen live search()/pythonify example verbatim.
Rendered green (HTML, frozen cell); linkcheck clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…tubs (Wave B) Turn three stubs into real chapters, verified against /var/www/MISP7. - extended-events (was a 43-word blog link): concept (extend vs edit vs proposal, when to use), the two creation paths (Extend this event / Extends Event field), the Extended/Extending view, the Extends / Extended by metadata, and the extended / is_extended / is_extension search filters. Blog kept as further reading. - user-management (was first-login only): trim the first-run section (drop the IE9/IE10 note, fix the dead gitbooks password-policy link), add My Profile, notification preferences, API keys (advanced auth keys), MFA, My Settings (theme / publish alert filter), and a pointer to Administration for user admin + roles. - noticelists (was a 54-word stub): how notices are triggered inline on the attribute form, and managing them (List / enable-disable / Update Noticelists + cake Admin updateNoticeLists), with the misp-noticelist repo. Rendered green (HTML); linkcheck clean (all cross-chapter anchors resolve). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Verified against /var/www/MISP7. - sightings: keep the GUI walkthrough, add the 2.5 privacy/policy controls (Sightings_policy, Sightings_anonymise, Sightings_anonymise_as, Sightings_range), SightingDB offloading (Sightings_sighting_db_enable), and real-time sharing (Sightings_enable_realtime_publish / Publish Sightings) + a pointer to the sighting blocklist. Preserves inbound #sightings-api target. - modules (was an 85-word stub): full chapter — what misp-modules is, the five families (Enrichment expansion/hover, Import, Export, Action, Cortex) and where each surfaces, running the module service, enabling/configuring per family (*_services_enable / _url / _port, hover settings, per-module Plugin.*_enabled), using them (Enrich Event / hover / Populate from… / Download as…), and the /modules/index + /modules/queryEnrichment endpoints. Drop the dead 2016 SWITCH PDF link. Rendered green (HTML); linkcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… dev-faq (Wave B) Verified against /var/www/MISP7. - misp-objects: reframe the intro (drop "2.4.80"); add Object references and relationships (relationship types, event graph), Editing objects, and Object templates (update via Update Objects / cake Admin updateObjectTemplates); repoint template authoring to the Object Template Creator (misp-engineering-bay) and cross-link Populate from… - glossary: replace the stale/incorrect Roles permission list (had "Memory Limit" / "Max Execution Time", missing most 2.5 perms) with the corrected set aligned to the administration Roles table + a cross-link; drop the dead 2016 SWITCH PDF from the modules entry; add missing 2.5 terms (Analyst Data, Event Report, Decaying Model, Workflow, Cerebrate, Collection). - dev-faq: fix the 2.4-branch Code of Conduct link (→2.5); add a short "About the codebase" orientation (CakePHP 2 / PHP 8, SimpleBackgroundJobs, submodules, /api/openapi). Rendered green (HTML); linkcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… (Wave B) Verified against /var/www/MISP7 (global_menu.ctp). - quick-start: fill the two empty stub sections (Enable a Taxonomy; Enable and fetch a feed); modernise the export section (drop the "Signature field=Yes" framing → the to_ids/IDS flag and the real export formats); drop the dead LastPass password-generator link. - general-layout: bring the top-menu documentation up to the current 2.5 bar — add the API menu (OpenAPI + REST client), rename the Audit menu to Logs with its four views (Application/Audit/Access/Search), add new Event Actions items (Collections, Event Reports, Analyst Data) and move the REST client to the API menu, rename Templates → Event Templates, add TAXII Servers to Sync Actions, and add the new Administration tools (Workflows, correlation tools, Benchmarking) with a pointer to the Global Actions blueprints/decaying tools. Rendered green (HTML); linkcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the VM-only chapter with the current deployment options. - Add a "Choosing a deployment method" overview: official installer (production), Docker (misp-docker), cloud images, and the evaluation VM — pointing to the canonical, maintained instructions on misp-project.org/download and the MISP repo rather than reproducing drift-prone install steps. - Keep the CIRCL evaluation VM walkthrough but clean it up: drop the Viper Web UI port from the forwarded-ports table (Viper is dead tooling), tidy the credentials/networking/base-URL sections, and fix external_baseurl → the MISP.external_baseurl setting. - Cross-link requirements / faq / updating-python. Rendered green (HTML); linkcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add six chapters documenting MISP 2.5 features that had no coverage, each grounded in the 2.5.42 source at /var/www/MISP7: - workflows: event-driven automation graphs (triggers/logic/actions), blocking vs non-blocking, editor, blueprints, debugging (site-admin, experimental). - analyst-data: Notes/Opinions/Relationships collaborative annotation, distribution, federation/sync, blocklist, API. - event-reports: rich-text markdown reports, MISP element syntax, IoC extraction, import-from-URL, templates, PDF export, LLM assist. - decaying-models: indicator scoring/decay, formulas, type mapping, simulation, restSearch integration, ownership. - collections: distributable bundles of events/galaxy clusters, sync. - cryptographic-keys: PGP event signing and Protected Events, sync verification. Wire all six into _quarto.yml (build) and SUMMARY.md (reading order). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- sharing: document the 2.5 analyst-data/collection sync toggles on the server form; add Cerebrate, Sharing Group Blueprints and TAXII 2.x server sections (grounded in ServersController/Cerebrate/TaxiiServer/ SharingGroupBlueprint source). - connectors: reframe the single MS-Graph sample as a connector index (REST/PyMISP/STIX-TAXII/modules/ZMQ/feeds) with the Graph script kept as a worked example and pointers to the upstream catalogue. - misp-zmq: topic list 6->14 with the matching Plugin.ZeroMQ_* toggles; venv-based install; corrected sub.py --help defaults. - best-practices: fix Origin taxonomy link to information-origin, point Confidence to estimative-language/admiralty-scale; add a 2.5-era practices section (sightings, decaying, analyst data, first/last_seen, correlation hygiene). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- translation: rewrite around the Crowdin workflow (crowdin.com/project/ misp) that replaced the manual .po/Transifex process; keep the developer translatable-string guidance and MISP.language enabling step. - delegation: add the unpublishedprivate caveat, one-pending-request rule, and the View delegation requests menu path. - general-concepts: drop the duplicate admin entry; add Correlation and Distribution levels concepts. - keyboard-shortcuts: replace the obsolete per-page JSON mechanism with the JS definition file, add the current defaults table. - index (intro): note 2.5.x targeting; refresh ongoing copyright years. - create-event-report: drop the removed GFI sandbox field; point at the current add-event form (Extends event, sharing-group distribution). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- taxonomy: document exclusive taxonomies/predicates, index bulk actions (mass enable/disable/require/highlight) and normalise-custom-tags; drop the dead Viper reference. - warninglists: document the 5 matching types (string/substring/hostname/ cidr/regex) and 2 categories (false_positive/known); add GUI create/ edit/delete + bulk enable/disable; fix a mislabelled cross-reference. - managing-feeds: add custom Headers (authenticated feeds), the unpublish- event setting, tag-collection as default tag, and the index scope tabs (All/Default/Custom) + bulk actions. - appendices (Appendix F): rewrite LDAP against the shipped LdapAuth plugin README — correct key names/defaults and, critically, the Security.auth => ['LdapAuth.Ldap'] enabling step the old config omitted; add group->role mapping, AD memberOf, TLS options, the test script; add an overview of the other auth plugins (OidcAuth/AadAuth/ShibbAuth/ CertAuth/LinOTPAuth). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…Wave D/B6) Group the ~41 flat chapters into 7 thematic parts (Getting Started / Using MISP / Data Model & Context / Sharing & Synchronisation / Automation & Integration / Administration / Reference & FAQ), fixing reading order to flow newcomer -> advanced. No chapter dropped or duplicated. Fix two migration leftovers surfaced while restructuring: - appendices/index.qmd was never wired into _quarto.yml (orphaned since the Honkit->Quarto migration), so the whole Appendices unit — including the Wave C LDAP rewrite — was not rendered. Add it to the appendices section. - Delete the dead SUMMARY.md (legacy Honkit nav pointing at removed README.md paths; Quarto uses _quarto.yml as the single nav source). Full-book HTML render green (43/43 units); linkcheck clean bar the PDF/EPUB download-button false-positives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace 16 pre-2.5 screenshots with current MISP 2.5.42 captures, matching the existing filenames so chapters pick them up with no text change: - general-layout: MenuBarAdmin + the Event Actions / Galaxies / Input Filters / Global Actions / Sync Actions / Administration dropdowns (now showing the 2.5 menus: Collections, Event Reports, Analyst Data, Workflows, Benchmarking, Cerebrates, TAXII Servers, SightingDB, the new Logs + API top-level menus). - using-the-system: event_detail (2.5 metadata incl. Protected Event mode + modification map), add_event (Extends-Event field, GFI gone), add_attribute (first_seen/last_seen/disable_correlation), add_attachment, list_events2. - quick-start: ListEvents. - administration: list_roles (full 2.5 permission matrix), jobs (SimpleBackgroundJobs), correlationExclusions. Captured via the new reusable Playwright catalog (misp-book-tooling/ capture-catalog.js, PRD C1/C5): deterministic named element/dropdown/table flows, 2x light-mode, writing straight into each chapter's figures/. Per-shot provenance (MISP version, url/selector, viewport, timestamp) recorded in assets/screenshots-provenance.json. Data policy (D10): list/index views are trimmed and filtered to tlp:white|clear rows only (the instance holds mixed-TLP data); the single-event shot uses CIRCL tlp:white event 33; forms are empty. list_users/list_org were intentionally NOT recaptured — the dev instance's user/org tables carry XSS pentest payloads and junk, so they need curated demo data first (tracked for a follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…/menus/toggles (Wave D/Phase 3) Captures the remaining Wave-1 shots against MISP 2.5.42, all curated to the screenshot data policy (light mode, 1440x900 @2x, only tlp:clear/local-admin data). Provenance merged into assets/screenshots-provenance.json (28 shots). New/recaptured figures: - administration: settings_1/2/3 (Overview+tabs, MISP settings table, Workers tab), list_logs + search_log, schedule (seeded Admin+Feed tasks), list_users + list_org. - general-layout: MenuBarUser + LeftMenuBar (non-admin session). - using-the-system: event_toggles (content-toggle button bar) + attack_matrix (ATT&CK Galaxy matrix panel), both wired into the Content toggles section. Data curation: created a local-admin "Sample Organisation" + 5 demo users (one per role) for list_users; allow-listed clean community orgs for list_org; seeded a clean tlp:white ATT&CK demo event (7183) for the toggle panels; restricted the audit-log shot to the site admin provisioning the demo data. No XSS-polluted user/org rows, profane emails, or non-white event titles ship. Prose fixes found while capturing (screenshots now match the live UI): - Workers tab columns corrected to Worker PID/User/Worker process/Information/ Actions (grouped per queue), replacing the outdated Worker Type/Id/Status. - Scheduled Tasks: the schedulable types are Server/Feed/Workflow/Periodic Summary/TAXII/Admin (the definition-updates are the Admin actions), replacing the incomplete "definition updates only" description. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…axonomy/galaxy/objects/sharing/zmq (Wave D/Phase 3) Recapture 10 Wave-2 figures against 2.5.42 via the capture-catalog pipeline (new groups: feeds wlists taxo galaxyidx objforms serveradd zmq): - managing-feeds: addfeedform (#FeedAddForm), feedspage (feeds index — filtered to clean default OSINT feeds; the instance's Org column carries XSS org names and junk tags on some feeds, so keep only empty-Org rows + drop alert()/junk markers), listfeeds (Sync Actions dropdown). - warninglists: MISPwarninglist (index, id-ascending → canonical built-ins), warninglist-checkValue (192.168.0.1 → the two documented RFC 1918/5735 hits; those two lists were enabled on the instance). - taxonomy: taxonomies-index (index, id-ascending). - galaxy: GalaxyView (galaxy index, id-ascending → Threat Actor/Intrusion Set/…). - misp-objects: object_ipport (ip-port object add form, template v10). - sharing: add_server_ui (add-server form; Local Organisation select scrubbed of the seeded XSS-payload org and pinned to the clean demo org). - misp-zmq: zmq-config (ZeroMQ plugin settings block; passwords redacted). Data policy (D10): every list/table filtered for the seeded XSS/junk pollution; `alert(` is the surgical malicious-marker (benign per-row <script>/<img> markup is not flagged). Provenance now 38 shots. Prose fixes to match live UI: feeds top-menu item is "Feeds" under "Sync Actions" (not "List Feeds"); drop the stale "old version of the template" note on the ip-port object (now current v10); consolidate the two duplicate "Add Server" figures into one and fix a stray indented line (delete orphan add_server_1.png). Full-book HTML render green (43/43); linkcheck clean bar the PDF/EPUB button false-positives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e 3) Four more Wave-2 recaptures against 2.5.42 (capture-catalog groups diag + galaxyidx/GalaxyMenu): - misp-zmq: zmq-diagnostics (the ZeroMQ status block on the diagnostics page — "ZeroMQ settings…OK" + Start/Stop/Status). - faq: misp-module-system-diag (the Module System status block — Enrichment/ Import/Export "Connection refused", matching the "MISP modules Connection refused" FAQ entry it illustrates). - galaxy: GalaxyMenu (the Galaxies top-bar dropdown → List Galaxies / List Relationships); GalaxyView re-shot (galaxy index, unchanged). Both diagnostics panels captured by wrapping their <h3> section (heading + content up to the next <h3>) — no secrets exposed. Provenance now 41 shots. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…t (Wave D/Phase 3) Five more galaxy figures recaptured against 2.5.42 (capture-catalog groups galaxydetail + galaxyevent), all injection-verified clean: - GalaxyList: Threat Actor galaxy view (metadata + cluster list). Uses the DEFAULT-clusters tab so the instance's custom junk clusters (foobar / "test") are excluded; shows clean official actors (Stealth Mango, 1937CN, 313 Team, …). - Matrix: the ATT&CK Attack Pattern heat-map (no standalone galaxy-matrix route in 2.5, so captured on the tlp:white demo event — exactly what the "Matrix galaxies" section describes), with the demo event's techniques highlighted. - EventWithoutCluster: the empty Galaxies panel + globe/person add buttons, on a new no-cluster demo event. - GalaxyPopup: the "Add new cluster" picker popover (galaxy selector). - NewThreatActor: the Galaxies panel with the clean official Sofacy (APT28) threat-actor cluster attached + its inline view/list/relate/detach actions. Data policy: cluster JSON on this instance carries injection payloads, so each captured view was checked for alert()/<img onerror> markers and the polluted custom clusters were filtered out (default-tab + XSS drop). Provenance now 46. New demo events seeded (local-admin, tlp:white, kept for recaptures): 7184 "Galaxy picker demo (no clusters)" + 7185 "Galaxy demo (with cluster)" (Sofacy). Deferred (noted in handoff): Search/Alias (the synonym-search states use the same fragile chosen-combobox as the object picker) and GalaxyUpdate (a native browser confirm() that cannot be screenshotted). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…s/sharing-rules/SG-wizard/noticelists (Wave D/Phase 3)
Recaptured 13 stale pre-2.5 figures + 2 net-new noticelist figures against live
2.5.42, all in-policy (tlp:white / local-admin / fictional data), each verified
on-screen and injection-checked.
taxonomy (7): enableTaxonomy (admiralty-scale detail w/ Enable action + tags),
taxonomy-list (index w/ Enabled/Required/Highlighted columns), highlight-event
(highlighted TLP box on an event), highlight-list-event (highlighted TLP tag in
the events list — only our 4 clean demo events kept), tag-box (add-tag picker
surfacing highlighted TLP tags), missing-taxo ("Missing taxonomies:
estimative-language" notice), publishing-without-required (publish blocked flash).
warninglists: warninglist-warnings (event 7188, ip 192.168.0.1/.53 → RFC 1918
false_positive warning triangles, IDS on).
sharing: rules (the modern 2.5 "Set PUSH rules" modal — replaces the stale
dual-listbox figure — configured to block tlp:red + Setec Astronomy; the select2
tag/org pickers' 8k+ polluted source options scrubbed so nothing malicious draws).
using-the-system: sgpage1-4 (the 4-tab Sharing Group wizard — General /
Organisations / MISP Instances / Summary — filled with clean demo data).
noticelists: NEW noticelist-index (gdpr index row) + noticelist-attribute (the
GDPR personal-data notice inline on the attribute add form); both wired into
noticelists/index.qmd (chapter previously had no figures).
Seed (idempotent, kept for recapture): seed-smallodds.py creates the fictional
"Setec Astronomy" org (874) + tlp:white warninglist-hit event (7188), enables the
gdpr noticelist + estimative-language taxonomy; tlp set highlighted. The
estimative-language "required" flag (set to shoot missing-taxo/publishing) was
reverted after capture so publishing is not blocked instance-wide.
Full-book HTML render green (43/43); linkcheck clean bar the PDF/EPUB button
false-positives. Provenance now 61 shots.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- _quarto.yml: execute.freeze auto -> true so CI reuses the committed _freeze/ cells. With auto, Quarto 1.9.38 re-executes the pymisp Jupyter cell on a full project render (despite a matching content hash); CI has no MISP instance or Jupyter kernel, so quarto render crashed with ModuleNotFoundError: nbformat. true force-reuses the frozen output, matching the stated design intent. - appendices: fix malformed [SimpleBackgroundJobs]((url)) link whose doubled parens baked (...) into the href, which would fail the offline lychee link-check once build passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ropdown (Wave D/Phase 3) The 2.5 "Add Object" flow changed: the side-menu entry now opens a single searchable Chosen dropdown of all active object templates (each labelled with its meta-category + description) — the old meta-category pill row (All Objects/file/financial/…) and the "few templates shown as buttons" variant are gone. Reworked the misp-objects "Using objects" prose to match and replaced the three stale picker figures (select_obj_cat/select_object1/ select_object2) with one capture of the live picker (object_picker.png, event 7183 → objectChoice popover). Also corrected an inaccuracy carried over from the old prose: the ip-port template does not have a strictly-required "Ip" attribute — it requires *one of* dst-port, src-port, domain, hostname, ip, ip-src or ip-dst (per the v10 template shown in object_ipport.png). Provenance: +object_picker.png (62 shots). Capture tooling: misp-book-tooling/capture-objpicker.js. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…se (Wave D/Phase 3) Captured the exclusivity conflict notice (Taxonomy.checkIfTagInconsistencies -> .tag-conflict-notice) into taxonomy/figures/exclusive-conflict.png, driven on a seeded demo event (7189) tagged with both tlp:white and tlp:red. Also corrected the prose: MISP does NOT block a conflicting exclusive tag — neither attachTagToObject nor the tag UI enforces exclusivity — it applies the tag and then flags the conflict with a warning in the event's tag area (the inconsistency is detected on display, and typically arises from synced/ API-tagged events). The old "warns you rather than applying it" was inaccurate. Tooling: seed-taxo-conflict.py + capture-taxo-conflict.js. Provenance: 63 shots. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e (Wave D/Phase 3) Recaptured all 7 sightings figures against a seeded demo event (7190, ip-dst 198.51.100.7 with 14 backdated sightings: 9 sightings / 4 false-positives / 1 expiration over ~5 days): the attribute Sightings column (9/4/1 + sparkline), the "Sighting details" popup Graph/All/My org/Add-sighting tabs, and the event-level count + popup. Prose fix (At Event level): the 2.5 event metadata shows total count + own-org count (green) + a sightings-policy note + a wrench — NOT a sparkline (that is per-attribute only; verified in eventSightingValue.ctp). Also noted the event-level popup has no "Add sighting" tab (sightings attach to an attribute). Tooling: seed-sightings.py (idempotent, backdated via /sightings/add timestamp) + capture-sightings.js. Provenance: 70 shots. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rose (Wave D/Phase 3)
Recaptured all 13 delegation figures against a seeded pending delegation
(Acme Factory -> Setec Astronomy, event 7191; plus a ready dist-0 event 7192
and a too-open dist-1 event 7193). Driven as the two org Publisher users on
the classic theme:
send side (Acme): delegationpossible/impossible menus, the Delegate
Publishing popup (org/distribution/message), the pending
reminder, and the requester's request-details popup.
answer side (Setec): the red envelope notification, the delegation-requests
list, the delegated event metadata, the recipient's
request-details popup, and the discard/accept confirms.
Prose fix (Answer a delegation request): dropped the outdated "dashboard, where
the delegation request appears in the left pane" step + dashboard.png — the 2.5
default dashboard has no delegation widget. Recipients reach requests via
Global Actions -> View delegation requests (already referenced above). Also
"red circle around the envelope" -> "red envelope".
Tooling: seed-delegation.py (orgs/users+authkeys, classic theme, org-only event,
pending delegation) + capture-delegation.js. Provenance: 83 shots.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…s; fix stories table rendering (Wave C deferred) Deferred Wave-C polish (audit §4 user-stories / user-personas): user-stories: - Add 5 net-new stories covering 2.5 feature families that had no representation: site-admin automation (Workflows/Blueprints, blocking vs non-blocking, Decaying Models), site-admin trust/connectivity (cryptographic event signing / Protected Events, sync + TAXII 2.x, Cerebrate), org-admin day-to-day operations (Sharing Group Blueprints, distribution, delegation), Analyst Data (Notes/Opinions/Relationships), and Collections. The table had zero site-admin/operator stories before. - Fix: the "Example workflow" column rendered ENTIRELY BLANK since the Honkit->Quarto migration -- Pandoc drops block-level <ul><li> raw HTML inside pipe-table cells (verified: empty <td> for every row). Converted all 54 rows to inline "<br>* " bullets, which render correctly, and normalized the malformed <ll>/unclosed-</ul> typos in the original source. Not yet shipped (deploy still gated), so this is caught before first deploy. user-personas: - Add two missing personas: Priya (The Platform Administrator / site admin) and Marco (The Operator / organisation admin), grounded in real 2.5 admin/ops capabilities. - Sprinkle 2.5 capabilities into existing personas: Workflows/Blueprints (Farrah), Analyst Data + Collections (Adam), Cerebrate + SG Blueprints + Protected Events (Jacob). - Fix the secondary-personas roster sentence (also omitted Jay before). Full-book HTML render green (43/43); linkcheck clean bar the PDF/EPUB button false-positives; blankscan 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… (D7 follow-up) The Quarto book deploys into the same www.circl.lu/doc/misp/ path the Honkit book occupies. Page-level URLs already matched (every old <chapter>/ dir renders identically); this commit closes the remaining gaps found by diffing the live old site against the new build. 1. PDF/EPUB filenames (_quarto.yml + index.qmd): Set `book: output-file: book` so downloads emit book.pdf / book.epub instead of the title-slug default MISP-User-Guide.*, keeping the long-standing external links .../doc/misp/book.pdf and .../book.epub alive. Verified: EPUB build emits _book/book.epub and the sidebar download buttons repoint accordingly. Also fixed the hardcoded download links in the root index.qmd. (MOBI stays dropped.) 2. Deploy mirror (.github/workflows/quarto.yml): Add --delete to both rsync commands so the target becomes an exact mirror of _book/, pruning stale Honkit artefacts (gitbook/ assets, search_index.json, translation/ja_JP.html, old book.mobi) instead of serving outdated files. The target dir is book-dedicated, so nothing else is pruned. 3. Anchor crosswalk (77 aliases across 27 chapters): Old GitBook heading slugs and Quarto/Pandoc slugs mostly coincide, but differ on punctuation (& / . :) and the content refresh renamed/removed many sections. Diffed 194 gone anchors old-vs-new and injected []{#old-slug} alias spans for the 63 whose section survives (incl. slug-quirk cases like config.php is not writeable, Update 2.4.82, the mispjson* ZMQ topics, Populate from consolidation, VM eval subsections) plus 14 page-title self-anchors. The remaining ~117 point at content that was intentionally removed (CakeResque worker UI, PHP-upgrade FAQ walkthroughs, per-script PyMISP examples, the old galaxy JSON-file walkthrough, Crowdin-replaced translation sections) and are left to 404, per the "drop rewritten/removed" rule. Full-book HTML + EPUB render green; sampled old anchors all resolve in the new build; blankscan 0; linkcheck clean bar the PDF/EPUB button false-positives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The intro page still showed the old "MISP Threat Sharing" speech-bubble logo (assets/misp-logo.png) while the sidebar/menu and favicon already used the current "MISP Intelligence Sharing" mark (assets/misp-2-verti.png). Point the front-page image at the same current logo so branding is consistent, and nudge the width 280->220 to keep the same on-page footprint (the new mark is nearly square vs the old horizontal one). The old logo file is now unreferenced. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cover.jpg still carried the old "MISP Threat Sharing" speech-bubble logo. Rebuilt
it around the official new-brand logo (MISP7 misp-logo-main-cmyk-hori-, the
hexagon + "MISP Intelligence Sharing" mark), keeping the original cover's layout,
Comfortaa font, #3465A5 title blue and wording ("MISP – User Guide / A Threat
Sharing Platform", "A collaborative effort from the MISP community"). Same
1984x2806 A4-portrait dimensions and filename, so no _quarto.yml change needed.
Verified the new image is embedded in the EPUB cover. Reproducible generator:
misp-book-tooling/build-cover.sh (ImageMagick + Comfortaa + Playwright).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ng Platform) MISP was rebranded from "Malware Information Sharing Platform" to the recursive acronym MISP = MISP Intelligence Sharing Platform (in the GNU tradition). Update the book's naming convention to match: - glossary: replace the "Malware Information Sharing Platform and Threat Sharing" entry with a "MISP" entry defining the recursive name (with a brief historical note); kept the old heading's anchor via an alias span for inbound links. - book-convention: new "The MISP name" section stating the convention. - index (intro) + quick-start: expand MISP as the MISP Intelligence Sharing Platform instead of the old/ad-hoc expansions. - _quarto.yml subtitle: "Open Source Threat Intelligence Sharing Platform" -> "MISP Intelligence Sharing Platform". - cover.jpg: subtitle line now reads "MISP Intelligence Sharing Platform" (regenerated via build-cover.sh; the stale "A Threat Sharing Platform" tagline is gone). Third-party tool blurbs in the appendices that quote the old name are left as-is (they describe external projects). Full HTML render green; blankscan 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ld works The anchor crosswalk in 0de9463 added web-compat aliases as Pandoc span anchors (`[]{#old-slug}`). When such a span precedes a chapter's first heading it hijacks that chapter/section's Typst label, so every fragment-less cross-chapter link (`[..](../automation/index.qmd)` -> `#link(<automation-and-misp-api>)`) fails to resolve and `quarto render --to typst` aborts. That silently broke the PDF build (and the CI `build` job, which runs a full `quarto render`) from 0de9463 onward. These aliases only exist to keep old **HTML** URLs working after the Honkit->Quarto move; a PDF has no such URLs. So convert all 78 of them from Pandoc spans to raw HTML anchors `<a id="old-slug"></a>`: Pandoc emits these only for HTML and drops them for Typst, so they can't hijack a label. Verified: bare-env (CI-equivalent) `quarto render --to typst` now builds _book/book.pdf clean (uses the committed typ.json freeze), the sampled old anchors still resolve in the HTML build, full HTML render green, blankscan 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration and rework