Skip to content

Latest commit

 

History

History

misp

README.md

MISP Plugins

This directory contains the plugins one can use to bind WHIDS and MISP together.

Each plugin is runnable and can be run as a service, using the service manager you prefer (systemd, initd ...).

Requirements

  1. All the plugins requirements need to be fulfilled
  2. Have a MISP instance running
  3. Have all the credentials both to access WHIDS and MISP APIs set in configuration file

List of MISP plugins

reporting.py: plugin to push to MISP the IR reports generated by WHIDS

One of the motivations behind WHIDS is to obtain "as close as incident" artifact collections (files, registries, memory dumps ...). Recently, WHIDS has been improved to also generate Incident Response ready reports, containing crucial informations such as (running processes, modules/drivers loaded, etc.).

This plugin aims at pushing those reports (and related artifacts) to MISP in the objective to be shared and analysed by other parties.

How it works: WHIDS manager exposes an API to query artifacts uploaded by the endpoints. This plugin makes regular calls to this API in order to find new artifacts uploaded with IR reports. Whenever a new report is found, the plugin creates a new report object in MISP.

NB: An event is created per day and then reports objects are appended to the event.

Example:

# to push reports collected the last 24h
./reporting -l 1
# to run the same command  as a service
./reporting.py --service -l 1

sightings.py: plugin to add MISP sightings as events are received by the EDR

This plugin takes advantage of the event's streams exposed by an EDR manager to update MISP sightings.

How it works: streams are provided through websockets and are streaming in real time the events received by the EDR manager. Multiple clients might subscribe to a stream and will receive the same events.

For performance reason, especially in high event thoughput scenario, we decided not to update sightings for an IOC at every event. Instead, by default, an IOC can be sighted at most once every minute on a per source (i.e. endpoint) basis. For example, if a host resolves 10x github.com in a minute, this will count as only one sighting. By extension, if 5 hosts resolves 10x github.com in a minute, this will count as 5 sightings. The refresh time of a sighting is configurable with --cache-ttl command line option.

NB: only attributes with IDS flag will see there sightings updated

Example:

./sightings.py