FeedMISPThreatActors

Fetches the MISP threat actor galaxy and builds it into Threat Actor indicators in Cortex Threat Intel Management (TIM).

Data Enrichment & Threat Intelligence · MISP Threat Actors · Feed

Details

ID	`FeedMISPThreatActors`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

MISP Threat Actors Feed Integration

Overview

This integration fetches threat actor information from the MISP Threat Actors Galaxy and creates indicators in Cortex TIM. It provides valuable threat intelligence about various threat actors, including their aliases, targets, origin countries, and related information.

Use Cases

Fetch and update threat actor information regularly.
Enrich your threat intelligence with detailed information about known threat actors.
Create relationships between threat actors and their targets or aliases.

Configuration

Navigate to Settings > Integrations > Instances.
Search for MISP Threat Actors Feed.
Click Add instance to create and configure a new integration instance.
- Name: A meaningful name for the integration instance.
- URL: The URL to fetch the MISP Threat Actors Galaxy file (default: https://raw.githubusercontent.com/MISP/misp-galaxy/main/galaxies/threat-actor.json)
- Feed Fetch Interval: How often the feed should be fetched and indicators created or updated.
- Reliability: Reliability of the feed source.
- TLP Color: Traffic Light Protocol color for the indicators.
- Feed Tags: Tags to be added to each indicator fetched from the feed.
- Bypass exclusion list: Whether to bypass the exclusion list when creating indicators.
Click Test to validate the URLs and connection.
Save and exit the integration instance.

Commands

This integration works in the background to fetch indicators and does not have any specific commands to execute manually.

fetch-indicators

This command runs in the background at the specified feed fetch interval to create and update threat actor indicators.

Additional Information

The integration fetches the latest version of the MISP Threat Actors Galaxy file and only processes new updates.
Indicators are created with rich metadata, including descriptions, aliases, targeted sectors and countries, and origin information when available.
The integration creates relationships between threat actors and their aliases, targets, and attributed countries.

Troubleshooting

If the integration fails to fetch data, ensure the provided URL is accessible and the network settings (including proxy if used) are correctly configured.
Check the integration logs for any error messages or debugging information.

Configuration parameters

feed — Fetch indicators
url — MISP Threat actor galaxy raw address (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color
feedTags — Tags

Commands (1)

mispthreatactors-get-indicators
Retrieves indicators from Threat Vault.

Source

FeedMISPThreatActors.py FeedMISPThreatActors_test.py FeedMISPThreatActors.yml FeedMISPThreatActors_description.md command_examples.txt

Download History Raw

import json

import FeedMISPThreatActors
from CommonServerPython import *
from FeedMISPThreatActors import Client, build_relationships, fetch_indicators_command, get_indicators_command, main, parse_refs

CLIENT = Client(base_url="example.com", verify=False, proxy=False, reliability="B - Usually reliable")


def _open_json_file(path):
    with open(path) as f:
        return json.loads(f.read())


def test_parse_refs():
    """Tests the parse_refs function.

    Scenario: Parsing reference links for an IOC

    Given:
        A list of reference links.

    When:
        Calling the parse_refs function with an original IOC and the list of references.

    Then:
        Ensure the function returns a list of parsed references with the correct structure.
    """
    refs = ["link1", "link2"]
    parsed_refs = parse_refs("original_ioc", refs)

    assert len(parsed_refs) == 2
    assert parsed_refs[0]["link"] == "link1"
    assert parsed_refs[1]["link"] == "link2"


def test_build_relationship():
    """Tests the build_relationships function.

    Scenario: Building relationships between IOCs

    Given:
        An original IOC, a list of related IOCs, their type, and a relationship name.

    When:
        Calling the build_relationships function with these parameters.

    Then:
        Ensure the function returns a list of correctly structured relationships.
    """
    original_ioc = "original_ioc"
    related_iocs = ["related_ioc1", "related_ioc2"]
    related_iocs_type = "domain"
    relationship_name = "related-to"

    relationships = build_relationships(
        original_ioc=original_ioc,
        related_iocs=related_iocs,
        related_iocs_type=related_iocs_type,
        relationship_name=relationship_name,
    )

    assert len(relationships) == 2

    for index, relationship in enumerate(relationships, start=0):
        assert relationship["entityA"] == original_ioc
        assert relationship["name"] == relationship_name
        assert relationship["entityB"] == related_iocs[index]


def test_fetch_indicators_command(mocker):
    """Tests the fetch_indicators_command function.

    Scenario: Fetching indicators from MISP Threat Actors feed

    Given:
        A mocked CLIENT object with a predefined response for get_threat_actors_galaxy_file.

    When:
        Calling the fetch_indicators_command function with the mocked CLIENT.

    Then:
        Ensure the function returns indicators matching the expected output in structure and content.
    """
    data = _open_json_file("test_data/misp_threat_actor_galaxy_example.json")
    expected = _open_json_file("test_data/fetch_indicator_results.json")

    mocker.patch.object(CLIENT, "get_threat_actors_galaxy_file", return_value=data)
    version, results = fetch_indicators_command(CLIENT, "", "WHITE")

    assert results[0]["value"] == expected[0]["value"]
    assert results[0]["type"] == expected[0]["type"]
    assert results[0]["fields"]["description"] == expected[0]["fields"]["description"]


def test_get_indicators_command(mocker):
    """Tests the get_indicators_command function.

    Scenario: Retrieving indicators from MISP Threat Actors feed

    Given:
        A mocked CLIENT object with a predefined response for get_threat_actors_galaxy_file.

    When:
        Calling the get_indicators_command function with the mocked CLIENT and empty parameters.

    Then:
        Ensure the function returns a human-readable output matching the expected format and content.
    """
    expected = "### Threat Actors\n|Name|Aliases|Country|Description|\n|---|---|---|---|\n| TEST | AKA | country | test |\n"
    data = _open_json_file("test_data/misp_threat_actor_galaxy_example.json")
    mocker.patch.object(CLIENT, "get_threat_actors_galaxy_file", return_value=data)
    results = get_indicators_command(CLIENT, {})

    assert results.to_context()["HumanReadable"] == expected


def test_feedmispthreatactors_main_command_success(mocker):
    """Tests the main function of FeedMISPThreatActors for successful execution.

    Scenario: Running the main function of FeedMISPThreatActors

    Given:
        Mocked objects for demisto.params, CLIENT.get_threat_actors_galaxy_file,
        demisto.command, and FeedMISPThreatActors.fetch_indicators_command.

    When:
        Calling the main function.

    Then:
        Ensure that the createIndicators method is called, indicating successful
        processing and creation of indicators.
    """
    raw_response = _open_json_file("test_data/misp_threat_actor_galaxy_example.json")

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://example.com",
            "proxy": False,
            "verify_certificate": False,
            "reliability": "B - Usually reliable",
        },
    )
    mocker.patch.object(CLIENT, "get_threat_actors_galaxy_file", return_value=raw_response)
    mocker.patch.object(demisto, "command", return_value="fetch-indicators")
    mocker.patch.object(
        FeedMISPThreatActors,
        "fetch_indicators_command",
        return_value=(1, _open_json_file("test_data/fetch_indicator_results.json")),
    )
    mock_createIndicators = mocker.patch.object(demisto, "createIndicators")

    main()

    assert mock_createIndicators.called