Limiting transforms depending of PAP or TLP classification of a MISP event about misp-maltego HOT 3 CLOSED

While I'm still looking for something similar blocking as Cortex does, here are some ideas:

• Bookmarks: add a colored star on top of the entity.

  • good: maps easily to TLP or PAP separately
  • bad: has no white color, does not support to separately TLP/PAP
    

• Notes: A string containing additional notes that can be attached to a Maltego entity.
  

As notes:

• inherit tags from the event
• an attribute should have the lowest level of TLP/PAP: for example, if something is TLP:White or Green the chose needs to be White.

from misp-maltego.

A first implementation is found in commit 0790c53.
Tags from a specific type will be added as note to an Entity, the currently implemented ones are : ['tlp:', 'PAP:', 'de-vs:', 'euci:', 'fr-classif:', 'nato:']

from misp-maltego.

I will close this issue, as limiting other (non-MISP-maltego) transforms is not technically possible with Maltego. The current implementation is the best we can do and give the analyst an idea of what can be done or not.

from misp-maltego.