try to auto-guess MISP tlp level from distribution option