MISP Playbooks, Proving The Value Of Cyber Threat Intelligence And ICS-CSIRT.io

The talk opens with MISP playbooks, a public repository of about 24 Jupyter notebooks that mix Markdown documentation with Python code using PyMISP to query and change a MISP instance. Some playbooks serve analysts, covering lookups, checking indicators in Elastic or Timesketch, creating events from Sentinel incidents, malware triage, curation, and MISP concepts such as objects, warning lists and timestamps. Others serve administrators, for bulk user and organization deployment and bulk event publishing. Requested playbooks are tracked as issues, contributions are welcome, and conversion scripts can turn them into CACAO security playbooks.

The second part covers a Markdown list of practical ways cyber threat intelligence can deliver value inside an organization. It is aimed at less mature teams that need a simple way to show management the benefit of CTI. Each entry gives a high-level description, practical examples and references. The speaker suggests moving the list into a machine-readable format such as YAML or JSON and invites community input.

The final part introduces a free, community-run sharing group for industrial control system information, not tied to any vendor or government body. Members contribute content back and receive an advisory service and a MISP instance with about 15 organizations and roughly 400 events for critical infrastructure sectors. Events were seeded from public CIRCL feeds, then checked against warning lists and hash lookups, with IDS flags disabled on matches. Sharing follows the same rules as the CIRCL instance, and events without a TLP marking default to TLP Amber. Practitioners can reuse the playbooks, adopt the value framing, and consider contributing ICS intelligence.