[adulau]

Add a dedicated Value Intelligence chapter under Using MISP, based on the current 3.0_wip branch (99ebee729). The worked investigation follows a fictional sign-in URL through three event contexts, with 14 genuine screenshots from the MISP 3.0 interface.

The guide covers lookup and worklists, occurrence filtering, correlations versus co-occurrence, deliberate enrichment with the local URL parser, organization-local answer reuse, review before event creation, timelines and incomplete audit history, profile-based assessment, and value-level collaboration. Expanded correlation rows show why the quoted control event can be related through its domain without its comment becoming a URL correlation. The exercise also distinguishes observation time, sightings and ingestion time.

Add navigation and crosslinks from the layout guide, Using MISP, best practices, correlation and modules chapters. Include source hashes, screenshot provenance and fixture checks in assets/value-intelligence-screenshots.json.

Validation:

• Complete HTML, PDF and ePub render, plus the repository's PDF cross-reference smoke build.
• Offline internal links and heading anchors; generated data-model reference; whitespace checks.
• Desktop/mobile and light/dark browser checks, all 14 screenshot lightboxes and chapter navigation order.
• All screenshot hashes/dimensions verified; original images present in HTML/ePub and embedded in the PDF; PDF chapter text within page bounds; existing diagram hashes unchanged.
• Live checks of occurrence filtering, expanded correlation evidence, timeline drag/reset and one manual local parser run. Reopening the retained answer does not ask the module again. No external intelligence provider was queried, no enrichment result was imported, and the New event dialog was not submitted.

All exercise events remain organization-only, unpublished and IDS-off. Original personal settings, including recent values and their timestamp, were restored exactly. Application source, instance configuration and analyst profiles were not modified, and only the four temporary services started for capture were stopped.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T06:13:33.709846Z	1f9b8d8	PR opened
🔒 Security Review	✅ Completed 2026-11-08T06:15:16.334074Z	1f9b8d8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.