Hello,
I noticed an issue with the module when processing composite/combined IOCs that use the | separator (such as ip-dst|port or filename|sha1).
The module successfully queries the configured MISP instance. However, when it updates the IOC to embed the "MISP Report" tab inside the custom attributes, it overwrites the original value. As a result, the IOC type remains correctly set to ip-dst|port, but the actual value is truncated, leaving only the first part (e.g., ip-dst).
Hello,
I noticed an issue with the module when processing composite/combined IOCs that use the | separator (such as ip-dst|port or filename|sha1).
The module successfully queries the configured MISP instance. However, when it updates the IOC to embed the "MISP Report" tab inside the custom attributes, it overwrites the original value. As a result, the IOC type remains correctly set to ip-dst|port, but the actual value is truncated, leaving only the first part (e.g., ip-dst).