STIX Sightings Import

Work environment

Questions	Answers
Type of issue	Support
OS version (server)	Ubuntu 18.04
OS version (client)	Ubuntu 18.04
PHP version	7.2
MISP version / git hash	2.4.133
Browser	Firefox

Support Questions

I'm trying to test out the STIX import of sightings via the /sightings/add/stix endpoint outlined in the API guide: https://www.circl.lu/doc/misp/automation/#sightings-api.

The guide has an example STIX XML object that I am using with a test domain indicator malicious2.example.com. I have created an event with an attribute malicious2.example.com.

Then, I used the REST client to attempt to add a sighting using the example STIX XML.

Logs, screenshots, configuration dump, ...

REST Client, the HTTP Body is the sample STIX XML.

And here is the response:

I noticed in the cURL tab, there does not seem to be any data passed in despite content present under HTTP body.

The sightings count of the attribute remains unchanged:

Any pointers are appreciated.