search

MISP / misp-playbooks

MISP Playbooks
https://misp.github.io/misp-playbooks/
BSD 2-Clause "Simplified" License
174 stars 17 forks source link

Query Timesketch for intel, add sighting in MISP, create a summary and notify to Mattermost or Slack #6

Closed cudeso closed 3 months ago

cudeso commented 1 year ago

The title of the playbook

Query Timesketch for intel, add sighting in MISP, create a summary and notify to Mattermost or Slack

Purpose of the playbook

A variant to the previous playbook is to query Timesketch instead of Elasticsearch. Similar as https://github.com/MISP/misp-playbooks/issues/5 This is achieved by creating a saved search in Timesketch. The saved search is created with the MISP search results. The results of the Timesketch saved search are then parsed, reported as sightings and notified to Mattermost or Slack or added as an alert in TheHive or DFIR-IRIS (to be discussed for implementation).

External resources used by this playbook

Timesketch, Mattermost (or Slack), TheHive (optional), DFIR-IRIS (optional)

Target audience

SOC, CSIRT

Breefly list the execution steps or workflow

No response

cudeso commented 3 months ago
cudeso commented 3 months ago

https://osdfir.blogspot.com/2024/04/welcoming-yeti-to-osdfir-infrastructure.html?m=1