Cerebrate - Learning To Run

Cerebrate is an open-source tool for running information-sharing communities among CERTs and similar groups. The talk explains that early MISP communities were small, isolated islands, but growing numbers of interconnection, organisation and enrollment requests now consume administrator time. The tool aims to give these communities a self-service, single source of truth, and it also works as a contact directory that can look up responsible contacts for an IP address and map organisations to their IP ranges and other metadata.

The middle of the talk covers management of the tools themselves. Connectors let an operator push and pull organisation and sharing group data to MISP and other systems, diagnose connected instances, manage users, and trigger custom actions from one interface. A worked example showed a central node linked to several MISP instances, flagging one that was offline and others with misconfigurations. The speaker also described community-centric key lookup, where keys are associated with organisations rather than individual email addresses, and access control that can be pushed to an identity provider such as Keycloak.

The talk closes with recent development and the roadmap. Over the past year there were six releases and many commits, with feedback from a European CERT pilot shaping the work. Upcoming items include a fleet management release with a graphical view of connected tools, reworked sharing group handling, and propagating signing keys across a community for MISP's protected mode. The practical takeaway is that teams running many separate MISP instances can consolidate administration and automate how those instances interconnect.