search

MISP / misp-playbooks

MISP Playbooks
https://misp.github.io/misp-playbooks/
BSD 2-Clause "Simplified" License
174 stars 17 forks source link

Actor profiling #26

Closed cudeso closed 1 year ago

cudeso commented 1 year ago

The title of the playbook

Actor profiling

Purpose of the playbook

This playbook uses the MITRE Intrusion Set (Groups) as an input to query all MISP events that have a specific group attached. The group is defined by the analyst running the playbook. The playbook then returns a chronological list of all those events with context information and summarises the attributes found in these events. The playbook then summaries the other TTPs (software, technique) that were found (TTP, number of occurrences) in the MISP events. The playbook also lists all the CVE attributes found in these events. The result of the playbook is a profile an actor based on the MISP events in a local instance. The results are stored in the playbook and sent to Mattermost or Slack or as an alert in TheHive or DFIR-IRIS (to be discussed for implementation). An extension to the playbook is an interaction with OpenCTI (to be discussed).

External resources used by this playbook

MITRE, Mattermost (or Slack), TheHive (optional), DFIR-IRIS (optional)

Target audience

CTI

Breefly list the execution steps or workflow

No response

cudeso commented 1 year ago

Check if https://www.curatedintel.org/2023/07/the-threat-actor-profile-guide-for-cti.html can be integrated

cudeso commented 1 year ago

Fixed by https://github.com/MISP/misp-playbooks/commit/63ad3e7d53d105226d4f05e77be27950b74f4987