Integrating New Tools In Your Workflows Within Minutes In MISP

This session stood in for a scheduled talk and was a condensed version of a longer workshop. The speaker explained what prompted the demo: a colleague had received onion addresses decoded from a QR code by a framework tool, and sharing them meant manual lookups and gathering context. MISP was introduced as a threat intelligence sharing platform with several automation paths, including ZeroMQ messages, the REST API, the Python library, enrichment modules and visual workflows.

The live demonstration built an enrichment module that takes an onion address, queries an onion lookup service over HTTP, and converts the returned titles, languages, timestamps and tags into a MISP object plus tags on the original attribute. The module was copied from an existing skeleton and restricted to onion inputs. It did not finish loading on stage, so its enrichment result was not confirmed during the session. A workflow that switches an attribute's distribution to organisation-only when a specific tag is attached was then built and shown working. A second workflow, which would open a case management task through a webhook module, was described but not tested.

The speaker closed by outlining planned improvements: detecting workflows that trigger themselves, manually run workflows, and scheduled workflows. The main takeaway is that modules and workflows let teams add integrations quickly without extensive coding, and that useful workflows can be shared as blueprints with the community.