Select the MISP instance from the dropdown

The title of this alert.

The description to send with the alert.

A field name that contains timestamps ( _time, strptime() etc.). if not defined or not present, default to now()

Source for sighting. You may provide a field name.

Sighting for matching values Sighting for matching attributes UUID misp_attribute_uuid Set mode for sighting. Default to "matching attribute UUID"

Sighting type 0: (default STIX interpretation of a sighting). Sighting type 1: this sighting has been interpreted as a false-positive by the organisation. Sighting type 2: expiration sighting which defines when the sighted attribute is to be expired. Set type of sighting.