[adulau]

Add Searching and Filtering Intelligence to Using MISP, immediately after Using the System. The chapter walks through a reproducible three-event exercise on the current MISP 3.0_wip branch (99ebee729), with 14 genuine UI screenshots.

• Compare event, attribute, object, distinct-value and report search scopes; explain word-start, inside-word, complete-value and CIDR matching.
• Demonstrate tag inclusion/exclusion and Any/All, attribute types, object relations, modification versus observation/publication clocks, event-local filters, empty results, resets and preserving queries.
• Include tested event/attribute REST searches and an explicit observation-time range, linked to the existing API reference. The API requests use the same reader account as the screenshots.
• Cross-link the new chapter from the layout, usage, reports, Value Intelligence and automation chapters. Include source pins, screenshot hashes, fixture details and verification provenance.

The chapter explicitly records a limitation in the checked development branch: the Objects custom two-ended date picker does not interpret its serialized bounds as the intended range. It documents a working relative modification preset and a verified API range instead of presenting an unverified UI result.

Local validation: full HTML/PDF/ePub render; PDF smoke profile; offline links and fragments; generated data-model reference; desktop/mobile layouts in light/dark mode; all 14 images and lightboxes; original screenshot assets in all exports; PDF text bounds; existing diagram hashes; git diff --check. Fixture records remain organization-only, unpublished and IDS-off. Reader preferences and application source were unchanged, and the three task-started services were stopped.

GitHub CI is currently blocked before rendering: both push and PR runs failed in Set up Quarto while downloading the pinned Quarto 1.9.38 .deb from GitHub Releases, with repeated HTTP 504 Gateway Time-out responses. Retrying both failed runs once produced the same download failure. The local checks above passed with Quarto 1.9.38; CI did not reach the book render or link-check steps. Failed retry log.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T09:07:29.040863Z	f2d7b25	PR opened
🔒 Security Review	✅ Completed 2026-11-08T09:08:33.815654Z	f2d7b25	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.