{"action":"created","issue":{"url":"https://api.github.com/repos/MISP/MISP/issues/665","labels_url":"https://api.github.com/repos/MISP/MISP/issues/665/labels{/name}","comments_url":"https://api.github.com/repos/MISP/MISP/issues/665/comments","events_url":"https://api.github.com/repos/MISP/MISP/issues/665/events","html_url":"https://github.com/MISP/MISP/issues/665","id":106980277,"number":665,"title":"MD5 - SHA1 - SHA256 + VT links","user":{"login":"advancedeng","id":8973767,"avatar_url":"https://avatars.githubusercontent.com/u/8973767?v=3","gravatar_id":"","url":"https://api.github.com/users/advancedeng","html_url":"https://github.com/advancedeng","followers_url":"https://api.github.com/users/advancedeng/followers","following_url":"https://api.github.com/users/advancedeng/following{/other_user}","gists_url":"https://api.github.com/users/advancedeng/gists{/gist_id}","starred_url":"https://api.github.com/users/advancedeng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/advancedeng/subscriptions","organizations_url":"https://api.github.com/users/advancedeng/orgs","repos_url":"https://api.github.com/users/advancedeng/repos","events_url":"https://api.github.com/users/advancedeng/events{/privacy}","received_events_url":"https://api.github.com/users/advancedeng/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-17T13:08:39Z","updated_at":"2015-09-17T13:15:44Z","closed_at":null,"body":"Hi all,\r\n\r\nI have observed in some MISP instances that when you provide a simple MD5, MISP queries VT, adds the link as external analysis and finally adds the respective SHA1 and SHA256 values. \r\nIs this feature available for our MISP instances? \r\n\r\nCheers,\r\nAndreas"},"comment":{"url":"https://api.github.com/repos/MISP/MISP/issues/comments/141080064","html_url":"https://github.com/MISP/MISP/issues/665#issuecomment-141080064","issue_url":"https://api.github.com/repos/MISP/MISP/issues/665","id":141080064,"user":{"login":"adulau","id":3309,"avatar_url":"https://avatars.githubusercontent.com/u/3309?v=3","gravatar_id":"","url":"https://api.github.com/users/adulau","html_url":"https://github.com/adulau","followers_url":"https://api.github.com/users/adulau/followers","following_url":"https://api.github.com/users/adulau/following{/other_user}","gists_url":"https://api.github.com/users/adulau/gists{/gist_id}","starred_url":"https://api.github.com/users/adulau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adulau/subscriptions","organizations_url":"https://api.github.com/users/adulau/orgs","repos_url":"https://api.github.com/users/adulau/repos","events_url":"https://api.github.com/users/adulau/events{/privacy}","received_events_url":"https://api.github.com/users/adulau/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T13:15:44Z","updated_at":"2015-09-17T13:15:44Z","body":"Sure, It's part of the viper.li MISP module ( https://github.com/viper-framework/viper/blob/master/modules/misp.py ).\r\n\r\nWe do it automatically using viper for some of our MISP instances. If you have a viper.li session running with a MISP module, you can simply do for auto expansion of hashes:\r\n\r\n~~~\r\n misp check_hashes -e <EVENT ID> -p\r\n~~~\r\n\r\nLet us know if you need additional information.\r\n\r\nCheers"}}