Clik here to view.
There is a lot of great blog posts and reads available on the MISP platform, so I don’t want to do it injustice by writing a huge intro here… I have a plan to write a more in depth blog post about MISP in the distant future, but before then please go on over to the MISP project site:
https://www.misp-project.org
What we are interested in for our enrichment, is how to leverage MISP to produce our own threat data feeds.
MISP allows you to create your own events made up of IoC’s and then leverage these as a threat data feed.
MISP out of the box also has support for many open source threat feeds and it can aggregate these and display them in a chosen standard. This can really help with centralizing your organisations threat data.
So you can combine OSINT and your own intelligence for enrichment into ElasticSearch.
We will begin our example by working with the Ransomware Tracker CSV feed which can be enabled in MISP. This feed is well known by the community and will give a good understanding of how the integration works.
MISP Prep
To get started you can download a training MISP instance here (or use your own MISP instance):- https://www.circl.lu/misp-images/latest/
Once you have your instance running and can access the WebUI, you should navigate to “Sync Actions” and then down to “List Feeds”
Clik here to view.
This will present you with a screen showing all of the default available threat data feeds and their sources.
If you scroll through this list, eventually you will find Ransomware Tracker.
Clik here to view.
You will need to check the tick box next to the feed, and then scroll to the top and select “Enable selected”.
One the feed is enabled, you will need to return to the Ransomware Tracker section and all the way at the right handside there is a button with the tooltip “fetch all events”
Clik here to view.
This will then begin the job to fetch the entire Ransomware Tracker feed into a MISP event. To find the event highlight the “Event Actions” button and then click on the “List Events” option.
Clik here to view.
This will take you to your MISP instance’s event section. Yours will look slightly different to mine, if you are using MISP already then it will be populated with events you have been working with or synced with. If not and you are new to this, then it should be populated with only 1 event… With the Info set to “Ransomware Tracker CSV Feed”.
Clik here to view.
When you drill down into the event, you will find some information relating to the threat feed, including an item in red “Published : “No”. This means that the event is currently stored inside MISP, but is not available for distribution, via the API or a sharing method. This allows us to work on the event without fear of publishing something by accident.
Clik here to view.
You can scroll through the event and see all of the IoC’s contained within the Ransomware Tracker feed, but what we are interested in now is tagging the Ransomware Tracker feed so we can export it via the API as one feed.
To do this, we will need to create a new custom tag within MISP….
Hover over the “Event Actions” button and then click on “Add Tag”.
Clik here to view.
You will then be presented with the Add Tag section, here you can give your new tag a name. For this example we will name it “Feed-RansomwareTracker”, choose the colour the tag will have in your event view, and then ensure “Exportable” is checked. Then click “Add”.
Clik here to view.
You can then go back to your Ransomware Tracker CSV event….
Clik here to view.
As part of the event info, you can see a section called “Tags” with a + button next to it. Click on the + button, and then add your newly created Feed-RansomwareTracker tag to the event.
The last step is to then publish the event, so it can be retrieved via the API for pushing into ElasticSearch!
On the left hand side next to the event info, you can find the option for “Publish Event”. Click on this and then click “Yes” when prompted to publish the event.
This has now published the event and the tags and it is ready to be retrieved by the API.
MISP API
Alongside the amazing WebUI for MISP, there is an incredibly strong API engine running underneath. Again I won’t focus too much here on singing it’s praises, this I will save for a later post!
But in this example, we will use the MISP API to pull out the tagged Ransomware Tracker feed for use within ElasticSearch.
To prepare the API for our scripts, all we need to do is find the automation key…
Hover over the “Event Actions” button within the MISP WebUI… And click on the “Automation” button.
Clik here to view.
Within the Automation section you can find your automation key:-
Clik here to view.
Save this key, you will need it later for your Python script!
This concludes our preparation work within MISP, next up…. Python and Memcached….
The post Enriching ElasticSearch With Threat Data – Part 1 – MISP appeared first on Security Distractions.