Ensuring IoC Quality At CERT-FR

The talk comes from the operations department of CERT-FR, the French national cybersecurity agency, where a dedicated unit maintains the central indicator of compromise base used for threat intelligence, detection and incident response. The speaker starts with the problems that build up when many analysts share one MISP instance: duplicate or meaningless traffic-light tags, events carrying incompatible classification markings, and malformed attributes such as several IP addresses packed into one field or typos in names and hashes.

To address this, the team wrote an internal Python library on top of PyMISP. It requires mandatory fields, standardizes tags and taxonomies, checks that traffic-light and classification markings are compatible, and validates formats for IPs, hashes and dates. A capitalization script driven by a structured file lets analysts create and update events step by step, and it explains clearly when a value breaks a rule. The tooling also manages an indicator lifecycle: events start as creating, become qualified once tested against internal and external sources for likely false positives, and attributes are marked archived when they go stale, so consumers filtering on qualified data receive vetted indicators. Exports are logged so the team can see what leaves the platform.

The speaker acknowledges the limits. Checks run on analysts' machines, so anyone calling the MISP API directly can bypass them, and enforcing rules through scripts adds friction for users with very different workflows. Server-side MISP workflows could close that gap, but rebuilding checks that depend on external lookups is hard. In the Q&A, the speaker described operating across instances holding millions of attributes and clarified that archiving applies to attributes rather than whole events. The main takeaway is that shared conventions and enforced checks matter as much as the tooling itself.