Make The Hive MISP integration sharing vs pull configurable

[vacmf]

Request Type

Feature Request

Work Environment

Question	Answer
TheHive version / git hash	2.13.2

Problem Description

Currently integrating The Hive and MISP enable both pulling events from MISP into The Hive alerts, and export The Hive observable into MISP. Sometime one wants to profit from only one side of the integration like being able to export observable into MISP only and leave the generation of alerts in The Hive to third party tool.

Possible Solutions

Add a configuration option in the MISP configuration file to define the grade of integration. For example:
export observable to misp = true|false
create alerts from misp = true|false

A similar result could theoretically be achieved by leveraging on an "impossible tag" as per #370 but a proper switch is a more clean solution.