Query Elasticsearch for intel, add sighting in MISP, create a summary and notify to Mattermost or Slack

[cudeso]

The title of the playbook

Query Elasticsearch for intel, add sighting in MISP, create a summary and notify to Mattermost or Slack

Purpose of the playbook

This playbook queries an Elasticsearch index for matches with the results of a MISP search. The search input is provided by the analyst and include event ID, tags, attribute type, a timestamp or a combination of the previous elements. This search result is then a list of attributes. The query to Elasticsearch is parametrised by index name, field name on which to match and time period to take into account. The results are summarised in the playbook, added as sightings in MISP and notified to Mattermost or Slack or added as an alert in TheHive or DFIR-IRIS (to be discussed for implementation).

External resources used by this playbook

Elasticsearch, Mattermost (or Slack), TheHive (optional), DFIR-IRIS (optional)

Target audience

SOC, CSIRT

Breefly list the execution steps or workflow

No response