Fetch data from MISP (Malware Information Sharing Platform)

[elhoim]

MISP is a platform to echange IOCs.

MISP has a key-authenticated REST API available, there is some documentation in this file, and a reference library implementation in python: PyMISP.

Existing MISP data types that might be of interest to be used for lookups: yara, filename, mutex, md5, sha1, sha256, email subject, email attachment. New data types to be implemented in the future: URI-regexp, filename-regexp, SSL certificates attributes.

I can arrange access to a MISP instance hosting IOCs if you need it for testing.

[Neo23x0]

Access to MISP instance would be useful. I can integrate some of the IOC types: yara, filename, md5, sha1, sha256, filename-regexp

I'll create a downloader that pulls the IOCs from the MISP and stores them in an appropriate LOKI signature format.

https://keybase.io/johngalt

[elhoim]

You will receive an email soon from circl.lu people... :)

[Neo23x0]

First version is included - see the "./threatintel" subfolder