search

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)
https://misp-galaxy.org/
Other
531 stars 259 forks source link

Help wanted - Integration with MISP #2

Closed ghost closed 7 years ago

ghost commented 8 years ago

Hello,

I am looking to see if you could further explain how this is integrated into MISP? I've not seen the concept of clusters till this repo, so not sure where to begin. Interested to start looking at this, looks very promising.

adulau commented 8 years ago

This will be integrated in the next version of MISP. The concept is to attach any key/value information to existing MISP events and attributes. To ease the description of those objects, predefined elements and clusters can be used (like the ones already defined for the threat actors). So it's basically the misp-taxonomies approach with even more flexibility.

Everyone can already contribute elements or/and clusters that could fit their requirements in CTI or alike. The objective is ensure that the next version support all the expressiveness described in misp-galaxy. It's not impossible that additional would use the description without directly relying on MISP.

Your feedback is also very welcome.

adulau commented 8 years ago

For your information, the new MISP tools doing grouping started to use the galaxy:

https://github.com/MISP/misp-workbench/tree/master/grouping

to find automatically, in the indexed content, threat actors and adversary groups.

deloittem commented 8 years ago

What is the way to enable misp galaxy in the MISP GUI ? Galaxy can only be used through the misp-workbench ?

cvandeplas commented 8 years ago

As an update to this. Currently the threat-actors and tools are available as taxonomy within MISP. (misp-galaxy taxonomy). The current implementation is only with the main names (not the synonyms/aliases), this to allow easier move to the next version that will support synonyms.

adulau commented 7 years ago

@deloittem @ghost galaxy It is now implemented in MISP http://www.misp-project.org/2016/12/07/MISP.2.4.56.released.html . Feedback updates more than welcome.