MISP Ingestion Integration

[samnewton]

Hi Everyone,

I've set up the MISP Ingestion Integration but I'm having no luck getting events from MISP. Every time it downloads, there are 0 events. No errors, just no events.

Has anyone done this successfully? I'm pulling my hair out.

Thank you 

Sam

[cmmartin_google · Accepted solution]

You can use the CSV Extended format with something like PyMISP, e.g.,  for each indicator type you want to bring in run a scheduled job:

/python3 /home/user/misp_api/get_csv.py -f /home/user/misp_logs/ip-dst.log -t "ip-dst" -l 1d -c

And then use a Chronicle Forwarder, NXLog, or other agent to ingest into Chronicle SIEM.  This will work with the default MISP_IOC parser.

I wrote this enhanced version of the Ingestion Script (from the SIEM GitHub repo) which is a bit more involved to setup, but is more flexible and extracts more fields:

https://github.com/goog-cmmartin/thatsiemguy/tree/main/misp