| name | analyzing-threat-landscape-with-misp |
| description | Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["analyzing","threat","landscape","with"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Analyzing Threat Landscape with MISP
When to Use
- When investigating security incidents that require analyzing threat landscape with misp
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Detection Gaps & Validation
- Attribute-type coverage: counting only
ip-dst/domain/sha256 undercounts the landscape -- MISP also stores ip-src, hostname, url, md5, sha1, filename|sha256, and btc. Enumerate the full Attribute.type set or your IOC-type breakdown is biased.
- Galaxy/tag inconsistency: actor attribution lives in
galaxy clusters (mitre-intrusion-set, threat-actor) and free-text Tags applied unevenly -- APT28 may appear as "Sofacy", "Fancy Bear", or a galaxy UUID. Normalize via galaxy synonyms before ranking top actors.
- Sharing/visibility gaps: API-key org permissions and event
distribution levels mean search() returns only visible events; "top threat level" skews to what your org can see.
- Stale events: old events inflate counts unless you bound by
--days/timestamp.
To validate: confirm event totals from PyMISP search() match the MISP web UI for the same date range and filters; verify pagination is not truncating results (default page limits). Re-run the technique ranking with galaxy-synonym normalization and confirm duplicate actors collapse. Sanity-check that T1566-style technique counts come from ATT&CK galaxy clusters, not ad-hoc tags, before reporting a "top technique."
Prerequisites
- Familiarity with threat intelligence concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install pymisp
- Configure MISP URL and API key.
