MISP V3

Malware information sharing platform and threat sharing.

Category

Data Enrichment & Threat Intelligence

Pack

MISP

Configuration parameters

• url — MISP server URL (e.g., https://192.168.0.1) (required)
• credentials —
• certificate — Client Certificate
• check_to_ids — Use IDS flag
• allowed_orgs — ORG names to use for reputation checks
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• malicious_tag_ids — Malicious tag IDs
• suspicious_tag_ids — Suspicious tag IDs
• benign_tag_ids — Benign tag IDs
• search_warninglists — Should the warninglists be considered when searching for an attribute
• integrationReliability — Source Reliability (required)
• attributes_limit — Maximum attributes to be returned

Commands (34)

• domain — Checks the reputation of the given domain.
• email — Checks the reputation of the given email address.
• file — Checks the file reputation of the given hash.
• ip — Checks the reputation of an IP address.
• misp-add-attribute — Adds an attribute to an existing MISP event.
• misp-add-custom-object — Adds custom objects to MISP.
• misp-add-domain-object — Adds a domain object to MISP.
• misp-add-email-object — Adds an email object to the specified event ID.
• misp-add-events-from-feed — Adds an OSINT feed. Only feeds in the misp format are allowed. For example have manifest.json.
• misp-add-file-object — Adds a file object to the specified event ID.
• misp-add-ip-object — Adds an IP object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".
• misp-add-object — Adds any other object to MISP.
• misp-add-sighting — Add sighting to an attribute.
• misp-add-tag-to-attribute — Adds a tag to the given UUID attribute.
• misp-add-tag-to-event — Adds a tag to the given UUID event .
• misp-add-url-object — Adds a URL object to an MISP event.
• misp-add-user — Add a new user to MISP.
• misp-change-warninglist — Changes a warninglist in MISP.
• misp-check-warninglist — Check a list of indicator values against the MISP warninglist.
• misp-create-event — Creates a new MISP event.
• misp-delete-attribute — Delete an attribute according to the given attribute ID.
• misp-delete-event — Deletes an event according to the given event ID.
• misp-get-organization-info — Display the organization IDs and names.
• misp-get-role-info — Display role names and role IDs.
• misp-get-warninglist — Get a specific warninglist by its ID.
• misp-get-warninglists — Gets all warninglists from MISP
• misp-publish-event — Publish an event.
• misp-remove-tag-from-attribute — Removes a tag from the given UUID attribute.
• misp-remove-tag-from-event — Removes a tag from the given UUID event .
• misp-search-attributes — Search for attributes in MISP.
• misp-search-events — Search for events in MISP. This search command will return only information about the matched events. To get information about attributes, use the misp-search-attributes command.
• misp-set-event-attributes — Set event attributes according to the given attributes data.
• misp-update-attribute — Update an attribute of an existing MISP event.
• url — Checks the reputation of the given URL.