Skip to main content

MISP Threat Intelligence

Ingest indicators and events from a MISP instance or a published MISP feed into your organisation's private intel store. Attributes become indicators (IPs, domains, URLs, file hashes, email addresses, JA3), events become reports, tlp:* tags set the TLP and threat-actor galaxies attach the actor. Polling is incremental on the attribute timestamp.

CategoryThreat intelligence
DirectionIngestion: MISP attributes become indicators in your organisation's private intel store
Sign-inNo Authentication, Auth Key
Query languages—
Websitehttps://www.misp-project.org/

Before you start​

Huntbase signs in to MISP Threat Intelligence with Auth Key. Create the credential in MISP Threat Intelligence first, then keep it to hand for the Connect step.

  1. Use api mode. Sign in to your MISP server as a user who can see the events you want to share with Huntbase.
  2. Open Administration › List Auth Keys and select Add authentication key.
  3. Tick Read only, optionally restrict the key to the IP addresses Huntbase connects from, and copy the key. MISP shows it only once.
Watch out for
  • Attributes with the IDS flag (to_ids) switched off are still ingested, at lower confidence, so they enrich investigations without driving alerts.
  • tlp:* tags set each indicator's TLP, and threat-actor galaxies attach the actor. Tag events in MISP before Huntbase polls them.
  • Polling is incremental on the attribute timestamp, so the first poll of a large instance takes longest. Use Sync now in Intelligence › Feeds to start it straight away.

For the vendor's own instructions, see MISP automation API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect MISP Threat Intelligence​

  1. Go to Connections and click New connection, or click New connection on the MISP Threat Intelligence product page.
  2. On Product, pick MISP Threat Intelligence and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your MISP Threat Intelligence lives:

FieldRequiredNotes
MISP URLYesThe server's base URL in api mode, such as https://misp.example.com, or the feed URL that serves manifest.json in feed mode.
ModeYesfeed reads a published MISP feed and needs no credentials. api queries your MISP server's /attributes/restSearch with an auth key. One of feed, api. Defaults to feed.
Verify TLSNo
Tag FilterNoOnly ingest events with one of these tags, such as tlp:green or type:OSINT. Leave empty to ingest everything.
Published Events OnlyNoSkip events that haven't been published in MISP yet.
Minimum Threat LevelNoSkip events below this MISP threat level. Events with no threat level set are always kept. One of High only, Medium and above, Low and above, All, including undefined. Defaults to All, including undefined.
Poll IntervalYesOne of 15m, 1h, 6h, 24h. Defaults to 1h.

Credentials​

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

No Authentication​

No fields — choose this method to connect without credentials.

Auth Key​

FieldRequiredNotes
Auth KeyYesSecret — not shown again after you save it.

Query it​

MISP doesn't add a query language. What it brings in lands in Intelligence: attributes appear in Indicators, and the feed, its health and its subscription settings in Feeds. Huntbase matches the indicators against your telemetry, and on a new feed runs a 30-day retro-hunt. Ask Scout about an indicator or a MISP event to pivot into your data.

Next steps​