This is sort of a follow on to this blog post https://community.rsa.com/t5/netwitness-blog/threat-intel-integration-with-misp-and-minemeld/ba-p/518870 by @EricPartington
I'm pulling data from MISP and intergrating it into NetWitness as a threat feed.
What I'd like to do now is if there is any meta generated that indicates a 'hit' on data from MISP, I'd like to send that back to MISP in the form of a 'Sighting' - https://www.circl.lu/doc/misp/sightings/
Has anyone got any ideas on how to acheive this? Could ESA be utilised to make REST calls to MISP to update IOCs with Sighting information?
Thanks.
