MISP General Usage Training

### Overview This session, titled "MISP General Usage Training," provides a comprehensive introduction and practical walkthrough of MISP (Malware Information Sharing Platform). Led by Alexandre Dulaunoy and Andras Iklody from CIRCL (Computer Incident Response Center Luxembourg), the presentation covers MISP's historical background, core architectural design, contextualization features, and collaborative sharing workflows, followed by a hands-on exercise modeling a phishing incident.

### Key Topics - **History and Evolution**: MISP originated in 2012 as "CyDefSIG," created by Christophe Vandeplas at the Belgian Ministry of Defence to solve information-silo issues among national and military CERTs. Initially built for reverse engineers to share raw malware indicators without duplicating work, it expanded over time into an open-source threat intelligence sharing platform supported by CIRCL and co-financed under the EU CEF project. - **Stakeholders and Expanding Use Cases**: Over time, MISP evolved from serving reverse engineers to supporting security operations analysts (feeding SIEMs, firewalls, and IDS), threat intelligence analysts (tracking threat actor infrastructure and TTPs), fraud teams in the financial sector (sharing mule account information), law enforcement/border control (seized goods, passenger data), and risk analysis teams. - **Balancing Detection, Blocking, and Intelligence**: Different consumers face conflicting requirements: detection teams want high fidelity but tolerate low false positives; ISPs require strict verification before blocking to avoid customer outage; threat intelligence teams value historical, non-fresh indicators to study adversary evolution. To resolve these conflicts, MISP emphasizes contextualization and false positive management tools (such as Warning Lists). - **Platform Architecture and Extensions**: MISP consists of four major pillars: core open-source software and modular components (`misp-modules`, `PyMISP` client library, `misp-dashboard`), knowledge bases (Taxonomies, Galaxies, Notice Lists, Warning Lists), open standards (IETF drafts, standardized object templates), and community resources (compliance documentation for GDPR/NIS directives, sharing best practices, OSINT feeds). - **Sharing and Interconnection Models**: MISP supports interconnected node synchronization, mesh topologies, air-gapped/island-mode instances, OSINT feeds, and localized enclaves (such as dedicated spam-collection clusters). To overcome reputation and trust concerns, MISP incorporates sharing groups, distribution levels, semi-anonymized delegation (e.g., via an ISAC or national CSIRT), and collaboration features like proposals and extended events.

### Technical Details - **Core Data Structures**: MISP structures data into a container called an **Event**, containing **Attributes** (individual observables/indicators like IP addresses or file hashes), **Objects** (structured composites of attributes based on standardized templates, such as files or emails), and **References** (relationships linking entities into attack graphs). - **Attributes vs. Indicators**: An attribute's operational role is controlled by an IDS flag. Benign observables (e.g., connectivity check domains like `google.com`) keep the IDS flag unset to prevent false-positive alerts, whereas malicious indicators have the flag enabled for automated export to protective tools. - **Contextualization Tools**: MISP uses **Tags** (from standardized taxonomies like TLP or custom vocabularies), **Galaxies / Galaxy Clusters** (high-level threat intelligence concepts including MITRE ATT&CK matrix mappings, threat actors, and target sectors), and **Timelines** (leveraging first-seen/last-seen timestamps). - **Quality, Lifecycles, and Sightings**: Indicators can be tracked using Sightings (positive sightings, negative/false-positive sightings, and expiration dates). High-volume sightings can be offloaded to `sightingdb` (developed by Divo). MISP also features an indicator lifecycle management engine that calculates decay scores based on models (e.g., IDS decaying models) without modifying underlying indicator data.

### Takeaways & Practical Walkthrough In the hands-on segment, the speakers demonstrate logging into a training instance (`igloo.lu`) and stepping through event creation: - Setting distribution levels (e.g., restricting initially to "Organization only" before publishing to wider communities). - Selecting subjective threat and analysis levels, while keeping event descriptions concise, readable, and free of internal ticketing references or localized non-English terms. - Populating events using standardized object templates (demonstrated by modeling a spear-phishing scenario starting with an Email object) rather than flat indicator dumps.