Can't tell that MISP messages are making it to backbone about threatbus HOT 3 CLOSED

Hi @mdavis332

thanks for reaching out! I tested your configuration and was able to see successful debug logs of the backbone when attributes were published in MISP. Since you did not get any error logs, your MISP instance seems to be reachable by Threat Bus. So the problem might hide in the setup. Can you please check the following settings on the MISP instance?

• Go to Administration -> Server Settings & Maintenance -> Diagnostics Tab
• Find the ZeroMQ plugin section and enable it, if not already.
• Go to Administration -> Server Settings & Maintenance -> Plugin settings Tab -> ZeroMQ
• Set the entry Plugin.ZeroMQ_enable to true
• Set the entry Plugin.ZeroMQ_attribute_notifications_enable to true

The last setting is the most important. When you add / delete attributes via the MISP event web view they will be auto published via ZeroMQ.

from threatbus.

Woohoo, sure enough it was the

Plugin.ZeroMQ_attribute_notifications_enable=true that I was missing. (I swear I had used the python zmq lib to sub directly to my MISP instance as a generic test and was getting notified on adds of attributes or new events). Seems like I'm going crazy, but after enabling that value threatbus backbone now gets the intel messages on attribute adds. Now time to test my actual plugin.

I do apologize it wound up being a local troubleshooting error, but thank you again @0ortmann

from threatbus.

You're very welcome, glad to hear it's working now!

from threatbus.