Release

MISP 2.4.198 released with many bugs fixed, security fixes and improvements.

MISP v2.4.198 (2024-09-13)

Based on a set of fixes including a security fix, we are pleased to announce the immediate availability of MISP 2.4.198. You can find a list of the detailed changes along with new features further below. As with any security release, we highly encourage everyone to update their instance as soon as possible.

Continue reading

MISP 2.4.197 released with many bugs fixed, a security fix and improvements.

Release Notes - v2.4.197 (2024-09-02)

New Features

  • Config Option: Added a new configuration option user_org_uuid_in_response_header to include a response header with the requesting user’s organization UUID. [Jeroen Pinoy]
  • Build: Display required STIX dependencies versions during the build process. [Jakub Onderka]
  • Bookmark now supports comment.

Changes

  • Version: Version bump. [iglocska]
  • Warning List: Updated the warning list. [Alexandre Dulaunoy]
  • Taxonomies: Updated to the latest version. [Alexandre Dulaunoy]
  • MISP Galaxy: Updated to the latest version. [Alexandre Dulaunoy]
  • PyMISP: Version bump. [Raphaël Vinot]
  • Internal Logging: Added logging when an event will not be published. [Jakub Onderka]
  • Global Menu - Bookmarks: Added comment field as the dropdown element’s title in the global menu bookmark. [Sami Mokaddem]
  • Database Upgrade - Bookmarks: Upgraded the database to support bookmark comments. [Sami Mokaddem]
  • Bookmark View: Added a missing comma for the new comment function and added a field for comments in the bookmark view. [Jan Z.]
  • Bookmark Index: Added a field to display comments in the bookmarks index. [Jan Z.]
  • Bookmark Add/Edit: Added a field to add and edit comments for bookmarks. [Jan Z.]
  • MISP Object: Updated to the latest version. [Alexandre Dulaunoy]

Fixes

  • UI/Footer: Improved UI footer to avoid confusion for some users. [Alexandre Dulaunoy]
  • IOC Import: Added a check to ensure the provided XML is valid. [Jakub Onderka]
  • Schema: Updated schema version. [Jakub Onderka]
  • UI: Fixed tag popover to return already parsed data. [Jakub Onderka]
  • Bookmarks - Add: Lower-cased the comment field. [Sami Mokaddem]
  • Sightings: Correctly retrieve sightings per the requested event. [Tom King]
  • Bookmarks - Verbose Returns: Fixed an issue with overly verbose returns from bookmarks when shared with the organization. This fix was reported by Sharad Kumar Dahal of Green Tick Nepal Pvt. Ltd. [iglocska] This fixes a security issue recorded as CVE-2024-45509.
  • Feed: When pulling feeds, events are now checked against specified rules if any rules are provided. [Benni0]

Other

  • Merged pull requests addressing issues with unpublished events logging, tag popover parsing, sightings restSearch performance, and STIX dependencies version display. [Jakub Onderka, Andras Iklody, Andrew Hicks]
  • Fixed issues related to sightings restSearch negation of organization ID. [Andrew Hicks]

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

Continue reading

MISP 2.4.196 released with many bugs fixed and improvements.

MISP 2.4.196 released with many bugs fixed and improvements.

New Features

  • Decaying Model: Introduced a new DecayingModel that leverages true positive and false positive sightings for better decision-making. [Marcel Slotema]
  • Log Search Enhancement: Added an optional hh:mm:ss accuracy to log searches, allowing for more precise time-based queries. This update also includes significant refactoring to improve code quality. [iglocska]
  • User Log Review: Improved the functionality of the “review user logs” button. It now links directly to logs relevant to the specific user, considering the new audit log system. Future enhancements will include email-based log searches. [iglocska]

Changes

  • PyMISP Update: Updated PyMISP to the latest version. [Raphaël Vinot]
  • Decaying Model Formulas: Enhanced error handling by catching undefined indexes in decaying model formulas. [Sami Mokaddem]
  • Attributes Search: Added support for sorting by publish_timestamp and introduced the X-Skipped-Elements-Count header to improve pagination during REST searches. [Benni0]
  • Reverse Proxy Handling: Fixed issues with base URL handling for reverse proxies, eliminating problematic redirects. Special thanks to Mitch Germansky for the extensive debugging. [iglocska]
  • MISP Components Update: Updated MISP Object, Galaxy, and STIX components to their latest versions. [Alexandre Dulaunoy, Christian Studer]

Fixes

  • STIX 2 Import: Updated the STIX 2 parsers following recent changes in MISP-STIX. [Christian Studer]
  • Base URL Setting: Adjusted the priority order in beforeFilter to avoid redis errors during benchmarking. [iglocska]
  • Image Helper: Allowed for variable-width organization logos without overlapping text. [iglocska]
  • Workflow Module: Ensured correct type return if redis fails to load during workflow:getEnabledModules. [Sami Mokaddem]
  • Settings Management: Fixed multiple issues related to changing instance settings, including improvements to CLI checks. [iglocska]
  • Attribute Search Ordering: Reverted ID-based sliding window ordering due to performance concerns. [iglocska]

Other

  • Merged several development branches to integrate recent changes, updates, and fixes from various contributors. Notably, the branches related to attribute search order, skipped elements count, and environment dependencies were integrated into the main branch. [iglocska, Christian Studer, Sami Mokaddem, Alexandre Dulaunoy, Stefano Ortolani, Andras Iklody]

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

Continue reading

MISP 2.4.195 - hot summer olympic release

MISP 2.4.195 - hot summer olympic release

We are pleased to announce the immediate availability of MISP v2.4.195, a summer release aiming to introduce new features, fix a long list of reported bugs and deficiencies as well as give your servers a breather in the scorching summer heat by taking a load off your CPUs thanks to a set of impactful performance fixes.

Continue reading

MISP 2.4.194 released with new functionalities and various bugs fixed

MISP 2.4.194 released with new functionalities and various bugs fixed.

New Features

  • Bookmark Functionality:
    • Users can now create bookmarks.
    • Bookmarks can be shared with all users in the same organization.
  • Heartbeat Endpoint:
    • New /users/heartbeat endpoint.
    • Accessible without authentication; returns a 200 response to indicate the instance is operational.
    • Designed for quick checks to see if the instance is up and running.
  • Skip OTP Requirement:
    • New role permission to exclude certain roles from OTP requirements.
    • Useful for filtered, local service accounts.
  • Users API Update:
    • Added a new boolean field indicating whether TOTP is set up for the user.
    • Applicable to /users/view, /admin/users/view, /admin/users/index endpoints.

Changes

  • Various Version Bumps:
    • Updates for misp-stix, schema, PyMISP, warning-lists, misp-galaxy, and misp-objects.
  • Bookmark Improvements:
    • Added title documentation for the exposed_to_org field.
    • Enhanced quick search support for bookmarks.
  • ACL and Schema Updates:
    • Heartbeat added to the ACL component.
    • Updates to schema and mysql.sql.

Fixes

  • Default Roles and Permissions:
    • Added delegation permission for sync user and publisher roles.
    • Readded default roles.
    • Fixed issues with PyMISP tests, default roles, and various editor and ingestion bugs.
  • UI and Functional Fixes:
    • Corrected event report markdown editor to display tags.
    • Included user agent in feed ingestion to address issues with specific feeds.
    • Fixed editing view for galaxycluster blocklist.
    • Readded missing org logo in the decaying model.
    • Corrected JSON response handling in the decaying tool.
    • Fixed object reference links for proper view refocus.
    • Corrected errors in the server edit view.
    • Fixed typo in bookmark description.
    • Adjusted default role settings in mysql.sql.
    • Updated local flag in EventTags to be boolean.
    • Corrected filenames in RHEL background worker migration guide.
    • Improved performance by increasing chunk size for sighting sync.

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

Continue reading

MISP 2.4.193 released with many bugs fixed, API improvements and security fixes

MISP 2.4.193 released with many bugs fixed, API improvements and security fixes

New

  • [attributes/enrich] endpoint added.

    • Simply post a list of modules you wish to enrich the attribute by.
    • URL: /attributes/enrich/[attribute_id|attribute_uuid]
    • Post body format: {"dns": 1, "foo_bar_baz": 1} listing all modules to execute.
  • [misp-community] MISP-LEA information sharing community added.

    Continue reading

MISP 2.4.192 released with many performance improvement, fixes and updates.

New Features

  • Security Enhancements:

    • Ability to disable TOTP/HTOTP when linked to an identity provider with strong authentication.
    • Introduced Fast API Authentication with temporary storage of hashed API keys in Redis to enhance endpoint performance.
  • Logging and Tracking:

    Continue reading

MISP 2.4.190 (and 2.4.191) released with new feed improvement, workflows and a new benchmarking suite.

We are excited to announce the release of MISP v2.4.190. This latest version introduces a slew of new features, improvements, and fixes designed to streamline operations and enhance security measures for our users.

Continue reading

MISP 2.4.189 released with bug fixes, performance improvements and a new blocklist feature.

We are pleased to announce the immediate release of MISP 2.4.189, released with bug fixes, performance improvements and a new blocklist feature.

Continue reading

MISP 2.4.188 released major performance improvements and many bugs fixed.

We are pleased to announce the immediate release of MISP 2.4.188, with major performance improvements and many bugs fixed.

New Features

  • Datasource Improvements:
    • Updates to some datasources with the ignoreIndexHint parameter (mysqlExtended, mysqlObserverExtended).
    • Fix for forceIndexHint.
  • Settings:
    • Added setting to temporarily disable the loading of sightings via the API (affects restsearch and /events/view endpoints). This helps with performance issues caused by large sighting data sets.

Changes

  • PyMISP:
    • Multiple version bumps.
  • Version and Internal Updates:
    • General version bump.
    • Improved error handling and marking BadRequestException as fail log in CI.
    • Attempt to fix a failing test.
    • Updated misp-galaxy, misp-object, and warning-lists.
  • Attribute Search Rework:
    • Significant performance improvement when using MysqlExtended or MysqlObserverExtended data sources.
    • Event level lookup moved to subqueries for faster queries.
    • Ignoring the deleted index to improve speed.
  • OpenAPI Updates:
    • Added content for analyst-data and event-reports.
  • Sighting Policy Support:
    • Added support of sighting policy in sightings:getLastSighting.
  • Attribute Search Performance:
    • Improved performance of includeDecayScore by a factor of 5.
  • Attribute Fetch Refactor:
    • Simplified conditions and optimizations.

Fixes

  • Attribute Search:
    • Enforced unpublishedprivate directive.
  • Internal Error Handling:
    • Error handling improvements in AttachmentScan.
  • CurlClient HEAD Request:
    • Added CURLOPT_NOBODY for HEAD requests.
  • CLI and ECS Updates:
    • Fix for redisReady in dragonfly.
    • Change type from Exception to Throwable in ECS.
  • OIDC:
    • Default organization handling if not provided by OIDC.
  • Publishing and Sync Issues:
    • Fix for publishing and sync errors.
  • Performance Improvements:
    • Bulk loading of analyst data to speed up event loading.
  • UI Update:
    • Added MISP.email_reply_to to server config.

Other

  • Multiple merges of branches and updates.
  • Fixes and changes in misp-stix, attachment scan error handling, OIDC default org handling, alert email titles, shadow attribute handling, and community additions (ICS-CSIRT.io).

Community and Contribution Updates

Details changes are available in Changelog.

Continue reading

Poppy a new Bloom filter format and open source project

Poppy a new Bloom filter format and open source library

Introduction

At CIRCL we use regularly bloom filters for some of our use cases especially in digital forensic. Such as providing a small, fast and shareable caching mechanism for Hashlookup database which can be used by incident responders.

Continue reading

MISP 2.4.187 released with security fixes, new features and bugs fixes.

We are pleased to announce the immediate release of MISP 2.4.187, including security fixes, new features and bugs fixes.

New Features

  • CLI Enhancements:
    • Added org list to shell commands.
    • New command to change user role.
    • Fixes to role management.
  • OIDC Update:
    • New option OidcAuth.update_user_role to disable role changes from OIDC.

Changes

  • Version and Software Updates:
    • Version bump.
    • Updates to PyMISP, misp-galaxy, misp-warninglists, misp-objects, and taxonomies.
  • Internal Updates:
    • Added ext-zstd to suggested PHP extensions.
    • Fixed non-focusable relationship dropdown search field in analyst data.

Fixes

  • General Fixes:
    • Corrected variable unset in events:restsearch to prevent attribute override.
    • Ensured sync pulls continue after an event save failure.
    • Database update fixes for older MySQL versions.
    • Improved API consistency.
    • Fixed pulling from remote servers when analyst data is not supported.
    • Logging fix for removeTagFromObject().
    • Security improvements for file and logo uploads. (Thanks to Rémi Matasse and Raphael Lob from Synacktiv for the report)
      • CVE-2024-29859 < MISP 2.4.187 - add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
      • CVE-2024-29858 < MISP 2.4.187 - __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
    • Correct message display when disabling a galaxy.
  • CLI Updates:
    • Added new functionalities including listing roles and creating users.

Details changes are available in Changelog.

Continue reading

MISP 2.4.186 released with analyst data feature including analyst notes, opinions and relationships.

We are pleased to announce the immediate release of MISP 2.4.186, which includes two major new feature called “Analyst Data” and “Collections” along with an extension to the MISP standard format.

Continue reading

MISP 2.4.185 released with sighting performance improvements, security and bugs fixes

We are happy to announce the immediate availability of MISP 2.4.185. This is mainly a bug fix release resolving several issues as well as tightening the security posture of the org image handling.

Continue reading

MISP 2.4.184 released with performance improvements, security and bugs fixes.

MISP 2.4.184 released with performance improvements, security and bugs fixes.

Improvements

  • Speed up improvements in ssdeep correlation and many other parts of MISP. Thanks to Jakub Onderka for the work on this.
  • [objects] restsearch first/last seen filters added.
  • [event:publication] Added new setting to block event publication if the publishing user is the creator.
  • [events:export] Make setting MISP.disable_cached_exports enabled by default. Since the /events/export has been marked deprecated for a years, we are starting the process to phase it out by first disabling the endpoint by default. The MISP ReST search API is the API to be used in the future if you still have very old scripts relying on export. We recommend to start making plans to rework those scripts.
  • [organisation:orgMerge] Added missing models for organisation handover

Security fixes

A series of security fixes were done in this release, the vulnerabilities are accessible to authenticated users, especially those with specific privileges like Org admin. We urge users to update to this version especially if you have different organisations having access to your instances.

Continue reading

MISP 2.4.183 released with new ECS log feature, improvements and bugs fixed

MISP 2.4.183 released with a new ECS log feature, improvements and bugs fixed.

  • MISP now supports Elastic Common Schema (ECS) security logging. A new option has been added Security.ecs_log to enable this new functionality. A new Security.alert_on_suspicious_logins to security audit has been added.
  • The sync configuration in MISP now supports sharing group blueprints for a simple creation of filter rules based on dynamically updated organisation lists.
  • Major improvement to STIX import handling and especially the misp-stix library such as Parsing PE binary extensions within File observable objects and many more improvements/fixes.
  • API add tag functions updated to also work with uuids, rather than just local IDs.
  • [event:view] Added option to mass local cluster tag.

Many bugs fixed and minor improvements. Feel free to read the detailed changelog

Continue reading

MISP 2.4.182 released with new features, improvements bugs fixed and an important security fix.

MISP 2.4.182 released with new features, improvements bugs fixed and an important security fix.

MISP Core

New Features

  • [event:view] Added new option show_server_correlations_for_all_users allowing non-privileged users to view server correlations. [Sami Mokaddem]

Changes

MISP 2.4.181 hot fix release to disable by default the alert on suspicious login plus some minor fixes.

MISP 2.4.181 hot fix release to disable by default the alert on suspicious login plus some minor fixes.

Changes

  • [tools:misp-delegation] Do not use self-documented expression in f-string anymore. [Sami Mokaddem]
  • [version] bump. [iglocska]
  • [warning-lists] updated to the latest version. [Alexandre Dulaunoy]
  • [misp-galaxy] updated to the latest version. [Alexandre Dulaunoy]
  • [tests] search for errors in logs. [Christophe Vandeplas]
  • [warning-lists] updated to the latest version. [Alexandre Dulaunoy]
  • [misp-galaxy] updated to the latest version. [Alexandre Dulaunoy]

Fix

  • [Alert on suspicious logins] disabled by default. [iglocska]
    • requires logs table to be better indexed currently to not be a bottleneck (user_id and action fields)
    • Will be made default in an upcoming version once the performance issues are resolved
  • [tests] fix path in logs_tests.sh. [Christophe Vandeplas]
  • [tests] fixes path of logs_tests. [Christophe Vandeplas]
  • [userloginprofiles] undefined variable #9424. [Christophe Vandeplas]
  • [customauth] missing Class init fixes #9425. [Christophe Vandeplas]

Continue reading

MISP 2.4.180 released with a new security user login profile feature, bugs fixed and many improvements.

MISP 2.4.180 released with a new security user login profile feature, bugs fixed and many improvements.

New

  • [api] added X-MISP-AUTH as an alternative header to Authorization, fixes #9418. [iglocska]

Changes

  • [VERSION] bump. [iglocska]
  • [workflows] restored 7.2 and 7.3. [iglocska]
  • [user login profile] old version compatibility. [iglocska]
  • [event index] hover over ID will show the info field, generally more useful than the threat level. [iglocska]

Fix

  • [login] fixes bad fix and catches first login after update. [Christophe Vandeplas]
  • [revert] dumb check. [iglocska]
  • [compatibility] make the ancient gods happy. [iglocska]
  • [user login profile] skip checks for ancient php versions. [iglocska]
  • [Attribute:EditPostProcessing] Make sure the ID is set. [Sami Mokaddem]
  • [attribute:editPostProcessing] Fixed typo in condition preventing tags to be detached. [Sami Mokaddem]
  • [attributes] type field added to editable fields. [iglocska]
  • [RPZ] export custom parameters ingored, fixes #9420. [iglocska]
  • [Attribute:editPostProcessing] Fixed sighting capture. [Sami Mokaddem]
  • [Attribute:EditPostProcessing] Make sure the ID is set. [Sami Mokaddem]
  • [attribute:validation] Typo in function name. [Sami Mokaddem]
  • [attribute:editPostProcessing] Fixed typo in condition preventing tags to be detached. [Sami Mokaddem]

Other

  • Merge remote-tracking branch ‘origin/develop’ into 2.4. [Christophe Vandeplas]

    Continue reading

MISP 2.4.179 released with a host of improvements a security fix and some new tooling.

MISP 2.4.179 released with a host of improvements a security fix and some new tooling.

First baby steps taken towards LLM integration

We currently included our first attempt at an LLM integration for report summarisation and extraction. The development is an outcome of our work with @aaronkaplan during hack.lu 2024 and relies on stochasticCTIExtractor for the extraction and interfacing with LLMs.

Continue reading