Cratos: Use Your Bloody Indicators

The talk starts from the incident response lifecycle and the way responders move from an initial alert to deciding whether to stay passive, monitor, or actively block. Pushing indicators quickly to DNS servers, firewalls, EDR and XDR is hard in large organisations, where change management, outsourcing partners and fear of false positives slow every step. Adversaries adapt quickly once they see blocks, so speed matters.

The middle of the talk examines the risks of letting every security device query MISP directly. Read keys expose the wider event context, many pollers can overload the instance, and devices that accept only single addresses cannot use CIDR ranges without expansion. The speaker presents Katos, a FastAPI service with Memcached as a caching layer, that sits between MISP and security tools and serves only indicators as feeds. Feeds can be filtered by tags, IDS flags, publish state and warning lists, with deduplication and regex checks on fields such as IP. A repeated one-year query dropped from about 2.3 seconds to under a second, and cache entries expire automatically.

Access is limited through IP allowlists and per-instance tokens tied to the MISP security model. Future work includes better documentation, data minimisation and more output formats. The release is aimed at community feedback, and the takeaway is that a caching proxy lets detection tools use MISP data without exposing the whole instance.