Yeah, to address this issue, now MISP has an additional field "threat actor classification" under which the "operation" value can be added.