MISP (Malware Information Sharing Platform) Setup

MISP (Malware Information Sharing Platform) is a free, open source threat intelligence platform that can store, correlate, and share IoCs. Here are its features. It can be used by cyber threat intel analysts, OSINT analysts, and other InfoSec pros.

You can use explore MISP using the demo instance.

There are various ways to set up your own MISP instance, including installing it on an existing Linux machine (Ubuntu is recommended), using a Docker container, or downloading a preconfigured VM. I’ll show how to do the latter.

MISP feeds

How to Set Up a MISP VM

1. Download a MISP VM.
2. Start the VM.
3. In a browser on your host machine, open https://localhost:8443. Ignore the certificate warning (MISP uses a self-signed certificate).
4. Log in with the default username admin@admin.test and password admin. When prompted, change the password.
5. Click Edit My Profile and change email address if you want to receive emails for the default admin account.
6. Click Sync Actions > List Feeds. Click Load default feed metadata.
7. Check the boxes for any feeds you want to enable, then click Enable selected.
8. Click Fetch and store all feed data.
9. Click Administration > Jobs and ensure the fetch_feed job succeeded. If it didn’t, check the error log at /var/log/apache2/misp.local_error.log. When I first tried, mine failed because my VM lost Internet connectivity when I changed networks and enabled the VPN on my host.
10. Click Administration > Add User and create a non-admin user account for your regular use of MISP.
11. Log out, then log back in as the new user.
12. You’ll see the Home page, which shows events.

You can explore events by clicking event IDs to see details. To learn more about what you can do with MISP, read the documentation and watch the videos linked below.

Additional Resources

MISP Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing

MISP Documentation and Support