MISP42: Connecting CTI And SOC Teams

Threat intelligence teams produce large volumes of indicators, and MISP makes them shareable across communities. Security operations teams, meanwhile, often keep a year or more of endpoint telemetry in a SIEM. The speaker wanted to search that history for indicators that were frequently weeks or months old, which led to a Splunk custom command for querying MISP and then a packaged app.

The app is installed on a Splunk search head and configured with the name, URL and API key of each MISP instance. The key is stored encrypted, so users need the right Splunk capabilities to use it. Streaming commands check whether field values have been seen in MISP and retrieve sighting data. Generating commands fetch attributes or events into lookups or indexes for more structured work. A fetch command accepts JSON payloads and can page through all results, and a generic command can call any MISP API endpoint the key is permitted to use. Alert actions create or update MISP events, grouping rows by a unique ID, and increment sighting counters by value or attribute ID.

The talk closes with a five-step retro-search workflow. Recently received attributes are collected into a lookup, historical logs are searched in two stages to find matching index, source type and time values, and the details are then retrieved. Sightings are incremented, optional events are created for new findings, and CTI and SOC analysts review the results together to decide whether an indicator is poor quality or needs investigation. The speaker also pointed to other open-source projects presented at the event as possible alternatives.