Refactor and enhance the MISP connector about connectors

[Fred-certeu]

One important use case for us:

• be able to import all MISP events (from a given MISP instance), independently of whether they have a tag or not
• from a certain date (typically the date of activation of the connector - but it could be an earlier date)
• specify a report type to transform MISP event into reports (e.g. report type = ''event'')
• associate automatically threat actors / intrusion sets, malware families, attack patterns (especially ATT&CK techniques), based on MISP tags

[SamuelHassine]

@Fred-certeu: all your points will be took into account.

[Fred-certeu]

Hello @SamuelHassine ,
another topic to address with the MISP connector : the question of UUIDs.
I'm not sure if openCTI uses UUID, but MISP does, and it's very useful :

• when observables (attributes) transit in different platforms (MISP or non MISP).
• to query observables from platforms

On the other hand, I understand that openCTI will not duplicate observables with the same value (which is a major progress and which should be maintained).

Then the question is:

• do you have a use case with UUID in openCTI ?
• how should it be handled (for example, two MISP attributes with the same value and distinct UUIDs will be handled in openCTI as one observables. So should there be two UUID for the same observables ???)