We started the MISP instance as a testbed for developing best practices, and to determine the pain points folks would encounter when deploying such a tool. We’ve been adding notable events to it, using both internally-sourced intelligence and some reports we felt we could enrich.
But we want to ask you: what do you want from an IFIN MISP? Personally, I don’t think it makes sense to reproduce a firehose feed that contains indicators available lots of other places.
Ultimately, our objective is to teach others how to deploy tools like this to build one’s own right-sized intel apparatus. But for now, how do you imagine this could be useful for you?
It’s already done two good things for me. It inspired me to:
Play with MISP ingest for Zeek – dangerous, but cool.
Build a MISP instance of my own so I could figure out WTF was going on.
Having just figured out about 25% of MISP capabilities, I’ve got some dunning-krueger thoughts
Use for internal research.
Aggregate feeds for IFIN internal researchers.
Possibly with sponsor donated API keys for some of the proprietary feeds.
There are ways to restrict visibility if we want need to keep some feeds strictly internal.
See if we can get sponsored API keys for event enhancement modules for IFIN internal use (still working on how to make the modules go in my test deployment).
Shout out to the sponsors in related blog posts.
Sync with one of the prominent default servers that has a MISP formatted feed. ( CIRCL or Abuse.ch ).
IFIN remains creator / owner, but lets them take the traffic load.
Allows for delegation to the upstream org if IFIN wishes to submit anonymously.
Also provides a larger audience who can propose event enhancement, note sightings, etc.
Out of Band Comm channel of last resort. The discussion feature is crude, but works.
Thoughts on things that probably should happen now:
Shorten the Creator org name and add a logo. The default column width for the second column is the longest name in ‘Creator Org’ , so the full name takes most of the screen. If you add a logo, it just displays the 48x48 png.
API key the public feed, and/or do a hard rate limit. MISP events can get stupid big, especially with auto-generated IoCs, nobody wants to pay for the AI scrapers ingesting that. It’s even worse when someone calls …/events/nids/suricata/download/<event_id>
And suddenly the instance stops while converting all the IoCs to Suricata rules. It’s a very cool feature, but not something that should be waved around in public.
We’ve reached out to a few places and have yet to hear back, but this is definitely on the roadmap.
For CIRCL, it’s rather exclusive to get syncing with them. But that’s definitely a goal to strive for!
This is done. Our logo was uploaded long ago and shows as our name. The full name has been shortened to “IFIN.”
The feed must be free by design, but rate-limiting and bot-blocking are sensible. FWIW, the Suricata endpoint is only available via API key. Try it now; you’ll see you get denied.
I really appreciate this detailed response. Something we’ve been discussing is how to provide unique value rather than reproducing what’s already available from other sources. Some of that will make more sense once we start producing more original intelligence.
I use MISP in work, I just log in to our MISP instance n ad use it for search/adding/tagging etc. but have no experience with setting it up and syncing feeds.
I was going to look at setting up my own instance to sync with IFINs, is that necessary or can I just access yours without setting up my own instance?
Secondly are there any good beginner guides for getting set up running your own MISP instance?
I am currently reading through there documentation, but was wondering if there is a more streamlined guide for single user MISP instance?
Getting an instance up and synchronizing as a docker container from zero prior knowledge took me an afternoon. I still need to play with filters and tuning, which I’ll do in my Ample Spare Time[tm]