Skip to content

Commit

Permalink
Fix typos
Browse files Browse the repository at this point in the history
  • Loading branch information
kamil-certat committed Jul 9, 2024
1 parent af2b8ce commit 77e3a15
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/user/bots.md
Original file line number Diff line number Diff line change
Expand Up @@ -4630,7 +4630,7 @@ as not usable for IDS.
**`event_separator`

(optional, string): If set to a field name from IntelMQ event, the bot will work in parallel on a few
events instead of saving all incomming messages to a one. Each unique value from the field will
events instead of saving all incoming messages to a one. Each unique value from the field will
use its own MISP Event. This is useful if your feed provides data about multiple entities you would
like to group, for example IPs of C2 servers from different botnets. For a given value, the bot will
use the same MISP Event as long as it's allowed by the `interval_event`.
Expand All @@ -4643,7 +4643,7 @@ depends of datetimes saved there). If you use `event_separator`, you may want to
placeholder which will be then replaced with the value of the separator.

For example, the following configuration can be used to create MISP Feed with IPs of C2 servers
of different botnets, having each botnet in a separated MISP Events with an appropiate description.
of different botnets, having each botnet in a separated MISP Events with an appropriate description.
Each MISP Event will contain objects with the `source.ip` field only, and the events' info will look
like *C2 Servers for botnet-1. IntelMQ event 2024-07-09T14:51:10.825123 - 2024-07-10T14:51:10.825123*

Expand Down

0 comments on commit 77e3a15

Please sign in to comment.