CTI Operational Procedures With Jupyter Notebooks And MISP

Koen Van Impe starts from a common problem in cyber threat intelligence work: operational procedures live in documents that quickly fall out of date. Analysts copy commands into a virtual environment, paste the output into a report, and the written steps drift away from what the tooling now requires. He describes consumer and producer versions of such procedures, such as checking an IP address against feeds and internal MISP instances, then enriching it with ownership and DNS lookups, or guiding a junior analyst to encode attributes into a MISP event.

The middle of the talk presents Jupyter notebooks as one place to hold code, its output and explanatory text, stored as JSON so version tracking works. He walks through starting a notebook server safely, including binding it to a reachable address, using the access token, keeping API keys out of the notebook, and running it in a managed environment rather than on the MISP server itself. Practical habits include a skeleton script, separating variables from logic, printing results at each step, and clearing outputs before saving. He also shows an integration example that wraps a third-party API.

He closes with limits and ideas. Notebooks are effectively single-user unless paired with JupyterHub, resource use needs watching, and future work could link notebooks with MISP workflows. The audience questions covered whether to store notebooks with or without results, and whether this kind of tooling belongs inside the MISP interface.