misp-osint-collection/version-5/misp_osint_create_event_f.md

# MISP for OSINT: create new event

## cross checking

### Is the OSINT already known?

- Is known from public sources (search in public indexer, blog posts, reports)

	- yes

	- no

- Is known accross communities

	- yes : make a proposal for update if the event requires update

	- no: create a new event

## create event

## set-up basic informations

### step 1: event info

- summary, concise

- can add "OSINT" in the text field

### step 2: event distribution

- who will see your event

	- your organisation only

	- this community only

	- connected communities

	- All communities

	- A sharing group

### step 3: timeline

- activity detected, when it happened

- is there a date of publication, some mentions?

### step 4: add tags

- this step is important for correlation and classification

- use existing tag: source type, requests, certainty, etc...

	- TLP: white

	- requests

		- collaborative intelligence

	- confidence level

		- osint certainty

		- information credibility

- some tags are missing

	- you can create your own

	- or post an issue on Github

## event content

### step 5: create attributes

- object: is there an object template?

	- yes

		- review and complete the attributes

	- no

		- create an issue or proposal on Github

### step 6: create relationships

- set references between the entities

	- via the correlation graph (visual)

	- via the object reference

### step 7: galaxies

- explore galaxies for additional contextual informations

## review and publish

### review the event details, tags, TLP/PAP tags and distribution

### publish or download your event

## MISP community

### Ask for help

- Issues on Github

	- https://github.com/MISP

### Contribute

- MISP Project

	- https://www.misp-project.org