adam's notes

Malware Information Sharing Platform (MISP)

Malware Information Sharing Platform (MISP) is an open-source threat information platform used to facilitate the collection and sharing of threat information.

  • used to cover more advanced threat intel needs
  • useful for:
    • keeping track of adversaries targeting your organization, cross-link between them, and share that information with partners
  • ideal tool for big and mature SOC teams or government CERTs that handle hundreds of country-wide incidents per year
  • Answers key questions like:
    • Have we seen this indicator before, and in which incident?
    • Which threat actor or campaign is this activity associated with?
    • Are multiple organizations being targeted by the same adversary right now?
    • Has a partner CERT already investigated this artifact? What did they conclude?
    • What were we dealing with over the past few months? What has changed?

Elements

  • MISP is built around events
    • collections of linked information describing a single threat, intrusion, or campaign
    • acts as a container that groups everything analysts have observed about one incident
    • e.g., event for “Phishing campaign targeting finance staff - May 2026”
    • require sharing rules
      • configure with TLP classification and event tags
  • Galaxies
    • libraries of structured knowledge with a list of countries, tools, malware families, and many more
    • more galaxies added = easier to group and link events
  • Attributes
    • fill in the event with attributes, such as IPs, domains, hashes, and free-text comments
    • good event has as many attributes as possible
    • ideal event also has text comments, references, or even exported phishing emails and malware binaries inside
  • Objects
    • containers for related attributes
    • e.g.,
      • group sender address, email subject, and phishing URL into the email object
      • file object can group file name, hash, size, and path

Taxonomies

A taxonomy is a means of classifying information based on standard features or attributes.

  • expressed in event tags
    • 3 parts:
      • namespace
        • defines the tag’s property to be used
      • predicate
        • specifies the property attached to the data
      • value
        • numerical or text details to map the property
  • e.g.,
    • tlp:red: Do not share outside the meeting
    • type:OSINT: The event is open-source intelligence
    • retention:30d: The event should expire after 30 days
    • admiralty-scale:source-reliability="a": Completely reliable source

MISP Feeds

  • by default, comes with 2 public feeds:
    • CIRCL
    • botcrij.eu initiative
  • first enable them, then decide whether to cache or fetch the events
    • fetch
      • imports full events into your MISP instance
      • useful for sync between trusted partners
    • Cache
      • saves indicators in a local cache for correlation
      • does not import full events
      • useful when you don’t want to pollute your instance with events from noisy public feeds

MISP Communities

  • MISP is most valuable when used within an active sharing community
  • usually private and membership-gated
  • regulated sectors can join their respective communities
  • e.g.,
    • NATO Cyber Security Center
    • Forum of Incident Response and Security Teams (FIRST)
    • National CERTs

Graph View

Backlinks