Building a Backyard TI Platform that Works for You

Building a threat intelligence program is hard to start, and commercial platforms are expensive. The speaker proposes a self-hosted alternative built on MISP, an open-source platform for recording, correlating and sharing security events and indicators. He introduces its core ideas: events as incident records, attributes and objects holding indicators, tags and taxonomies such as TLP, galaxies that add ATT&CK techniques and malware context, and sharing groups between instances.

The deployment is quick, using a Docker Compose setup where the base URL is the main setting to change. Post-install steps include changing the default admin password, syncing galaxies, and enabling the TLP taxonomy. The talk builds an event by hand from a public malware campaign report, adding techniques and payload hashes, then covers bulk imports, feed caching, and decay models that expire stale data.

Automation comes through the MISP API using PyMISP, with Jupyter notebooks for searching and format conversion. Integrations shown include Elastic, Microsoft Sentinel through STIX conversion with compatibility caveats, Defender, and CrowdStrike indicator uploads. The takeaway is that a few containers can support practical detection workflows, and the speaker planned to publish scripts on GitHub.