{"action":"created","issue":{"url":"https://api.github.com/repos/MISP/misp-modules/issues/138","repository_url":"https://api.github.com/repos/MISP/misp-modules","labels_url":"https://api.github.com/repos/MISP/misp-modules/issues/138/labels{/name}","comments_url":"https://api.github.com/repos/MISP/misp-modules/issues/138/comments","events_url":"https://api.github.com/repos/MISP/misp-modules/issues/138/events","html_url":"https://github.com/MISP/misp-modules/issues/138","id":267799020,"number":138,"title":"CEF Export Example","user":{"login":"Amorik","id":23191740,"avatar_url":"https://avatars1.githubusercontent.com/u/23191740?v=4","gravatar_id":"","url":"https://api.github.com/users/Amorik","html_url":"https://github.com/Amorik","followers_url":"https://api.github.com/users/Amorik/followers","following_url":"https://api.github.com/users/Amorik/following{/other_user}","gists_url":"https://api.github.com/users/Amorik/gists{/gist_id}","starred_url":"https://api.github.com/users/Amorik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amorik/subscriptions","organizations_url":"https://api.github.com/users/Amorik/orgs","repos_url":"https://api.github.com/users/Amorik/repos","events_url":"https://api.github.com/users/Amorik/events{/privacy}","received_events_url":"https://api.github.com/users/Amorik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-10-23T20:03:58Z","updated_at":"2017-10-23T21:14:30Z","closed_at":null,"author_association":"NONE","body":"Can Some please provide an example of how to use the CEF Export module, or any export module for that fact. The documentation is poor in this regard and it is not clear on how to actually use most of the modules.\r\n\r\nThank you\r\n\r\n~Regards"},"comment":{"url":"https://api.github.com/repos/MISP/misp-modules/issues/comments/338798761","html_url":"https://github.com/MISP/misp-modules/issues/138#issuecomment-338798761","issue_url":"https://api.github.com/repos/MISP/misp-modules/issues/138","id":338798761,"user":{"login":"Amorik","id":23191740,"avatar_url":"https://avatars1.githubusercontent.com/u/23191740?v=4","gravatar_id":"","url":"https://api.github.com/users/Amorik","html_url":"https://github.com/Amorik","followers_url":"https://api.github.com/users/Amorik/followers","following_url":"https://api.github.com/users/Amorik/following{/other_user}","gists_url":"https://api.github.com/users/Amorik/gists{/gist_id}","starred_url":"https://api.github.com/users/Amorik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amorik/subscriptions","organizations_url":"https://api.github.com/users/Amorik/orgs","repos_url":"https://api.github.com/users/Amorik/repos","events_url":"https://api.github.com/users/Amorik/events{/privacy}","received_events_url":"https://api.github.com/users/Amorik/received_events","type":"User","site_admin":false},"created_at":"2017-10-23T21:14:30Z","updated_at":"2017-10-23T21:14:30Z","author_association":"NONE","body":"Didn't know the option was there. Looking at the download url seems like the missing link was the sub url of events. Using \"http:<yourmispserver>/events/exportModule/cef_export\" does the trick for all events (though only those that have attributes per the coded mapping - an option to be able to alter this would be nice)\r\n\r\nStill working out the  CLI but it seems you pass the event results from the json format as the \"data\" attribute. Short Example:\r\n`curl -s http://<yourmispmoduleserver>:<yourmispmoduleserverport>/query -H \"Content-Type: application/json\" -d '{\r\n   \"module\": \"cef_export\",\r\n   \"data\": [ <json formatted list of events> ]\r\n}'`\r\n\r\nThe module loops through the events and loops through the \"Attributes\" within each event to get the output. It might be possible to edit the mapping in the request, haven't tried yet."}}
{"actor":{"display_login":"Amorik"}}