MISP Integrations Options
Malware Patrol offers integration with the MISP threat intelligence sharing platform. There are two ways to integrate:
- Sync our instance with yours (one-way)
- Download MISP-formatted feeds.
The following data feeds are available:
- Command & Control (C2) URLs
- DGA Domains
- Malicious IPs
- Malware URLs
- DNS-over-HTTPS (DoH) Servers
Click here to access our detailed configuration guide about how to ingest our MISP-formatted feeds.
Want To Evaluate?
Talk with our experts
Click here to access our detailed MISP configuration guide. It provides step-by-step instructions for configuring your Mikrotik device to filter malicious IPs and/or domains. This will, in turn, protect your network, computers, and users from getting infected by malware and ransomware.
The MISP threat intelligence sharing platform is a free and open-source software used to gather, share, store and correlate Indicators of Compromise, threat intelligence, and more. This reputable and powerful tool is used by thousands of organizations worldwide and has many helpful, active communities. The platform is feature-rich and boasts the following (and more) capabilities and options:
- “An efficient IoC and indicators database allowing to store technical and non-technical information about malware samples, incidents, attackers and intelligence.
- Automatic correlation finding relationships between attributes and indicators from malware, attacks campaigns or analysis.
- A flexible data model where complex objects can be expressed and linked together to express threat intelligence, incidents or connected elements.
- Built-in sharing functionality to ease data sharing using different model of distributions.
- export: generating IDS (Suricata, Snort and Bro are supported by default), OpenIOC, plain text, CSV, MISP XML or JSON output to integrate with other systems (network IDS, host IDS, custom tools)
- import: bulk-import, batch-import, free-text import, import from OpenIOC, GFI sandbox, ThreatConnect CSV or MISP format.
- feed import: flexible tool to import and integrate MISP feed and any threatintel or OSINT feed from third parties. Many default feeds are included in standard MISP installation.
- flexible API to integrate MISP with your own solutions.
- adjustable taxonomy to classify and tag events following your own classification schemes or existing taxonomies.
- intelligence vocabularies called MISP galaxy and bundled with existing threat actors, malware, RAT, ransomware or MITRE ATT&CK which can be easily linked with events in MISP.
- expansion modules in Python to expand MISP with your own services or activate already available misp-modules.”