FeedMISPThreatActors

Fetches the MISP threat actor galaxy and builds it into Threat Actor indicators in Cortex Threat Intel Management (TIM).

Data Enrichment & Threat Intelligence · MISP Threat Actors · Feed

Details

IDFeedMISPThreatActors
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

MISP Threat Actors Feed Integration

Overview

This integration fetches threat actor information from the MISP Threat Actors Galaxy and creates indicators in Cortex TIM. It provides valuable threat intelligence about various threat actors, including their aliases, targets, origin countries, and related information.

Use Cases

  • Fetch and update threat actor information regularly.
  • Enrich your threat intelligence with detailed information about known threat actors.
  • Create relationships between threat actors and their targets or aliases.

Configuration

  1. Navigate to Settings > Integrations > Instances.
  2. Search for MISP Threat Actors Feed.
  3. Click Add instance to create and configure a new integration instance.
    • Name: A meaningful name for the integration instance.
    • URL: The URL to fetch the MISP Threat Actors Galaxy file (default: https://raw.githubusercontent.com/MISP/misp-galaxy/main/galaxies/threat-actor.json)
    • Feed Fetch Interval: How often the feed should be fetched and indicators created or updated.
    • Reliability: Reliability of the feed source.
    • TLP Color: Traffic Light Protocol color for the indicators.
    • Feed Tags: Tags to be added to each indicator fetched from the feed.
    • Bypass exclusion list: Whether to bypass the exclusion list when creating indicators.
  4. Click Test to validate the URLs and connection.
  5. Save and exit the integration instance.

Commands

This integration works in the background to fetch indicators and does not have any specific commands to execute manually.

fetch-indicators

This command runs in the background at the specified feed fetch interval to create and update threat actor indicators.

Additional Information

  • The integration fetches the latest version of the MISP Threat Actors Galaxy file and only processes new updates.
  • Indicators are created with rich metadata, including descriptions, aliases, targeted sectors and countries, and origin information when available.
  • The integration creates relationships between threat actors and their aliases, targets, and attributed countries.

Troubleshooting

  • If the integration fails to fetch data, ensure the provided URL is accessible and the network settings (including proxy if used) are correctly configured.
  • Check the integration logs for any error messages or debugging information.

Configuration parameters

  • feed — Fetch indicators
  • url — MISP Threat actor galaxy raw address (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • tlp_color — Traffic Light Protocol Color
  • feedTags — Tags

Commands (1)

  • mispthreatactors-get-indicators

    Retrieves indicators from Threat Vault.

Source

FeedMISPThreatActors.py FeedMISPThreatActors_test.py FeedMISPThreatActors.yml FeedMISPThreatActors_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: FeedMISPThreatActors
  version: -1
configuration:
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- defaultvalue: https://raw.githubusercontent.com/MISP/misp-galaxy/refs/heads/main/clusters/threat-actor.json
  display: MISP Threat actor galaxy raw address
  name: url
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Indicator Reputation
  name: feedReputation
  type: 18
  required: false
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: B - Usually reliable
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- name: feedExpirationPolicy
  display: ''
  defaultvalue: indicatorType
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
- name: feedExpirationInterval
  display: ''
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '240'
  type: 19
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- display: Traffic Light Protocol Color
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: WHITE
  section: Collect
- name: feedTags
  display: Tags
  type: 0
  additionalinfo: Supports CSV values.
  section: Collect
description: Fetches the MISP threat actor galaxy and builds it into Threat Actor indicators in Cortex Threat Intel Management (TIM).
display: Feed MISP Threat Actors
name: FeedMISPThreatActors
script:
  feed: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: mispthreatactors-get-indicators
    arguments:
    - name: limit
      description: Limit the amount of indicators to fetch (default is 10).
      required: false
    outputs:
    - contextPath: FeedMISPThreatActors.ThreatActor.name
      description: The name of the threat actor.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.description
      description: The threat actor description.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.aliases
      description: Additional aliases the threat actor may be known by.
      type: string
    - contextPath: FeedMISPThreatActors.ThreatActor.country
      description: The origin country of the threat actor.
      type: string
    description: Retrieves indicators from Threat Vault.
fromversion: 6.10.0
tests:
- No tests (auto formatted)