Misp: Local tags should be synced when same org

[eCrimeLabs]

I would be really nice to be able to sync local set tags between MISP instances that belongs to same Organisation.

Worst case In the situation where a MISP instance gets migrated by Syncing data the local tages will disappear.

[RichieB2B]

Absolutely. When a local tag is marked exportable it should be synced to remote servers with the same MISP.host_org_id

In essence there are 4 types of tags:

1. global and exportable: always synced
2. global and not exportable: never synced (enforced in tag definition)
3. local and exportable: synced to local servers
4. local and not exportable: never synced (enforced per tag use)

The difference between exportable and local is that exportable is a property of the tag definition while local is a property of the specific tag on an event or attribute. Also, local tags do not modify the timestamp and event publish status.

Currently type 3 does not work which I consider a bug in the local tag implementation.

[iglocska]

correct, that sounds like a bug (omission in the design).

[eCrimeLabs]

I don't know if this is covered in the @RichieB2B comment, however from the usage I've seen the local tags be seen as both an local instance tag and a local organisations tag, as mentioned it does not modify existing events but help the organisation to add context and work flow on events or attributes from data delivered by other organisations.

I should be possible to add local tags that are synced between MISP instances where the organisation is the same, meaning on the Sync side -> "Internal instance" = checked, "Organisation type" = "Local organisation" AND "local Organisation" = the same.

In the cases of using the data for internal data flow control, I would not want a tag to be exportable, it should be as "private" as possible to avoid it by mistake to be exported to external instances.

[RichieB2B]

You are describing tag type 3 and 4 from my previous comment.