Tools

Software and Tools

Many open source and proprietary tools integrate MISP support (MISP format or API) in order to extend their tools or MISP itself. A series of additional software are supported and handled by the MISP project. The additional software supported by the MISP project allow the community to rely on additional tools to support their day-to-day operations. The objective is also to explore new ideas, concepts or functionality which can be integrated in MISP core software later on.

Software within the MISP project

• misp-modules - Modules for expansion services in MISP

Expansion modules

• ASN History - a hover and expansion module to expand an AS number with the ASN description and its history.
• CIRCL Passive DNS - a hover and expansion module to expand hostname and IP addresses with passive DNS information.
• CIRCL Passive SSL - a hover and expansion module to expand IP addresses with the X.509 certificate seen.
• countrycode - a hover module to tell you what country a URL belongs to.
• CrowdStrike Falcon - an expansion module to expand using CrowdStrike Falcon Intel Indicator API.
• CVE - a hover module to give more information about a vulnerability (CVE).
• DNS - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes.
• DomainTools - a hover and expansion module to get information from DomainTools whois.
• EUPI - a hover and expansion module to get information about an URL from the Phishing Initiative project.
• Farsight DNSDB Passive DNS - a hover and expansion module to expand hostname and IP addresses with passive DNS information.
• GeoIP - a hover and expansion module to get GeoIP information from geolite/maxmind.
• IPASN - a hover and expansion to get the BGP ASN of an IP address.
• iprep - an expansion module to get IP reputation from packetmail.net.
• OTX - an expansion module for OTX.
• passivetotal - a passivetotal module that queries a number of different PassiveTotal datasets.
• rbl - a module to get RBL (Real-Time Blackhost List) values from an attribute.
• shodan - a minimal shodan expansion module.
• sourcecache - a module to cache a specific link from a MISP instance.
• ThreatCrowd - an expansion module for ThreatCrowd.
• threatminer - an expansion module to expand from ThreatMiner.
• virustotal - an expansion module to pull known resolutions and malware samples related with an IP/Domain from virusTotal (this modules require a VirusTotal private API key)
• wikidata - a wikidata expansion module.
• xforce - an IBM X-Force Exchange expansion module.
• YARA syntax validator - YARA syntax validator.

Export modules

• CEF module to export Common Event Format (CEF).
• GoAML export module to export in GoAML format.
• Lite Export module to export a lite event.
• Simple PDF export module to export in PDF (required: asciidoctor-pdf).
• ThreatConnect module to export in ThreatConnect CSV format.
• ThreatStream module to export in ThreatStream format.

Import modules

• CSV import Customizable CSV import module.

• Cuckoo JSON Cuckoo JSON import.

• Email Import Email import module for MISP to import basic metadata.

• GoAML Import GoAML format import.

• OCR Optical Character Recognition (OCR) module for MISP to import attributes from images, scan or faxes.

• OpenIOC OpenIOC import based on PyMISP library.

• stiximport - An import module to process STIX xml/json.

• ThreatAnalyzer - An import module to process ThreatAnalyzer archive.zip/analysis.json sandbox exports.

• VMRay - An import module to process VMRay export.

• misp-workbench - Tools to export data out of the MISP MySQL database and use and abuse them outside of this platform.

• MISpego - Maltego Transform to put entities into MISP events.

• MISP-maltego - Set of Maltego transforms to inferface with a MISP instance.

• PyMISP - Python library using the MISP Rest API. This is the official library for MISP and can also generate offline MISP events.

• MISP-STIX-Converter - An utility repo to assist with converting between MISP and STIX formats.

• MISP-Taxii-Server - An OpenTAXII Configuration for MISP with automatic TAXII to MISP sync.

• mail_to_misp - Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.

For the additional software created by the MISP project, check our MISP project organization.

Software or Services with MISP support or Extending MISP functionalities

• AIL framework - Framework for Analysis of Information Leaks - AIL framework - Framework for Analysis of Information Leaks use MISP to share found leaks within a threat intelligence platform using MISP standard (objects).
• Automated Payload Test Controller - A set of scripts using PyMISP to extend MISP for automated payload testing.
• BTG - BTG’s purpose is to make fast and efficient search on IOC including a MISP crawler and collector.
• CrowdStrike Falcon - an expansion module to expand using CrowdStrike Falcon Intel Indicator API.
• cti-toolkit CERT Australia Cyber Threat Intelligence (CTI) Toolkit includes a transform to MISP from STIX.
• Cuckoo modified - heavily modified version of Cuckoo Sandbox including a MISP reporting module to put the information into a MISP instance.
• cve-search - a tool to perform local searches for known vulnerabilities include a MISP plug-in.
• DCSO TIE integration - DCSO integration with MISP.
• Dovehawk Bro Module - Bro+MISP for threat hunting.
• EclecticIQ Platform Integrations - Intelligence Integration.
• Elastic.co - a filebeat module for reading threat intel information from the MISP platform
• FireMISP FireEye Alert json files to MISP Malware information sharing platform (Alpha).
• FLARE MISP Service This service is provided to enable the specific use case of retrieving AIS data (in STIX 1.1.1 format) from AIS and loading the content in a MISP Server.
• Hybrid analysis exports in MISP format.
• IntelMQ support MISP to retrieve events and update tags.
• iSight MISP integration - iSight integration with MISP.
• ja3toMISP Extracts JA3 fingerprints from a PCAP and adds them to an event in MISP as objects.
• Joe Sanbox outputs analysis in MISP format.
• Kaspersky Threat Data Feeds - Kaspersky Threat Feed App for MISP is an application set that allows you to import and update Kaspersky Threat Data Feeds in a MISP instance.
• Komand - Komand integration with MISP.
• Loki - Simple IOC Scanner includes a MISP receiver.
• McAfee Active Response - McAfee Active Response integration with MISP.
• MISP-Extractor extracts information from MISP via the API and automate some tasks.
• misp-to-autofocus - script for pulling events from a MISP database and converting them to Autofocus queries.
• MISP2CbR - MISP Threat Feed into CarbonBlack Response.
• misp2cs.py - script to put MISP events/indicators in Crowdstrike.
• misp_btc - Fetch a list of BTC addresses (from MISP) in a given time range. Get the balance and all transactions recorded in Blockchain for the address. Shows the conversion rate in EUR and USD for the transaction at the date of transaction.
• misp-bulk-tag - this script performs bulk tagging operations over MISP.
• misp42splunk - A Splunk app to use one or more MISP in background. misp42splunk is also available in splunkbase.
• MISP-IOC-Validator validates the format of the different IOC from MISP and to remove false positive by comparing these IOC to existing known false positive.
• misp-extractor - Connects to a MISP instance and retrieves attributes of specific types src-ip,dst-ip,url,domain The retrieved attributes are then written to separate files.
• misp-to-sentinel (Azure Function) - Azure Function to export MISP intel to Azure Sentinel
• misp-to-sentinel (on MISP server) - The MISP to Microsoft (Azure) Sentinel integration allows you to upload indicators from MISP to Microsoft Sentinel. It relies on PyMISP to get indicators from MISP and an Azure App and Threat Intelligence Data Connector in Azure. This version supports the Upload Indicators API and the Graph API.
• eCrimeLabs MISP Purge Events tool A python script to perform cleanup of old or unwanted events, including Blacklisted Events.
• misp-takedown - A curses-style interface for automatic takedown notification based on MISP events.
• misp-scraper - A web scraper to create MISP events and reports
• misp_to_zeek - Export MISP indicators to Zeek intel framework
• OpenDXL-ATD-MISP - Automated threat intelligence collection with McAfee ATD, OpenDXL and MISP.
• OpenDXL-MISP-IntelMQ-Output - This use case is focusing on the automated real-time threat sharing with MISP (Malware Intelligence Sharing Platform), orchestration tool (IntelMQ) and OpenDXL. IntelMQ is used to collect data from the Malware Intelligence Sharing Platform (MISP), to parse and push intelligence via OpenDXL.
• otx_misp imports Alienvault OTX pulses to a MISP instance.
• phish2MISP a small python script that can be used to gather information related to a phishing site and add it as an event in MISP.
• pymisp-suricata_search - Multi-threaded Suricata search module for MISP.
• polarity MISP integration - The Polarity MISP integration allows Polarity to search your instance of MISP to return valid information about domains, IPS, and hashes.
• RTIR MISP integration - RTIR-Extension-MISP - Integrate RTIR with MISP
• Sigma2MISP - Import Sigma rules to MISP events.
• Sigma Importer - sigmai is a project designed to do the opposite of Sigma. The objective of sigmai is to convert specific data sources into the Sigma generic and open signature format.
• Slackbot - Slackbot for notification of MISP events in Slack channels.
• Splunk integration with MISP - This TA allows to check if objects/attributes in your MISP instance matches your data in Splunk.
• surimisp - Check IOC provided by a MISP instance on Suricata events.
• Symantec DeepSight Intelligence integration is integrated with MISP and used in production intelligence environments. DeepSight enables delivery of both technical indicators (e.g. malicious IPs, URLs, hashes) and adversary intelligence (e.g. actor, campaign, TTP profiles).
• TheHive A 3-in-1 Security Incident Response Platform has an extensive MISP support.
• threatingestor - An extendable tool to extract and aggregate IOCs from threat feeds.
• ThreatPinchLookup - ThreatPinch Lookup creates informational tooltips when hovering oven an item of interest on any website and contains a MISP connector.
• tie2misp - Import DCSO TIE IOCs as MISP events.
• Viper - is a binary management and analysis framework dedicated to malware and exploit researchers including a MISP module.
• vt2misp - Script to fetch data from virustotal and add it to a specific event as an object.
• yara-exporter - Exporting MISP event attributes to yara rules usable with Thor apt scanner.

Tutorials on interconnecting MISP with other tools

• ELK - Excellent guide by David Clayton, explaining how he integrated MISP with ElasticSearch/Logstash/Kibana via Memcached.

Libraries to access the MISP API

• PyMISP the official Python library using the MISP Rest API.
• misp-rb A dead simple MISP API wrapper for Ruby.
• MISP Golang - Golang Library to interact with your MISP instance.
• mispex - An Elixir wrapper around MISP’s HTTP API to provide native interaction.
• mispy - A pythonic MISP module.