Operationalizing MISP Threat Feeds
Note: This skill covers a defensive threat-intelligence platform. Handle ingested intelligence according to its Traffic Light Protocol (TLP) marking and your sharing agreements. Treat ingested IOCs as potentially sensitive.
Overview
MISP (Malware Information Sharing Platform) is the de-facto open-source threat-intelligence platform for storing, correlating, and sharing structured indicators (IOCs), events, galaxies (threat-actor/technique knowledge), and objects. Running a MISP instance is only the first step; the value comes from operationalizing it — curating high-quality feeds, suppressing false positives with warninglists, and pushing the resulting IOCs into detection tooling so intelligence actually drives blocking and alerting.
A feed in MISP is a remote source (another MISP, a CSV/freetext list, or a structured collection) that you enable and optionally cache. Caching pulls the feed's IOCs into the instance's Redis-backed cache so values can be correlated and looked up in real time (e.g., a SIEM asking "have you seen this domain?") without importing every event. Curation matters: enabling every public feed produces noise and false positives, so you select reputable feeds (CIRCL OSINT, abuse.ch, Feodo Tracker, etc.), apply warninglists (known-good ranges like RFC1918, Alexa/Tranco top sites, public DNS resolvers) to flag non-actionable indicators, and use taxonomies/tags (TLP, confidence) to scope what gets exported.
The detection-engineering payoff comes from MISP's export formats and PyMISP. MISP can render matching attributes directly as Suricata and Snort rules via the REST API, and PyMISP lets you script extraction of fresh IOCs to generate Sigma rules and Wazuh CDB lists / rules on a schedule. This skill walks the full lifecycle: feed enablement and caching, warninglist-based FP reduction, PyMISP-driven search, and automated generation of Suricata, Sigma, and Wazuh detections.
When to Use
- Standing up or maturing a MISP instance into a feed that drives detection, not just a repository.
- Curating and caching public/commercial threat feeds with quality controls.
- Reducing IOC false positives with warninglists before they reach the SIEM/IDS.
- Automating generation of Suricata/Sigma/Wazuh detections from MISP attributes.
- Integrating MISP with a SOC so DNS/IP/hash lookups can be enriched against current intel.
Prerequisites
Objectives
- Enable and cache curated threat feeds in MISP.
- Apply warninglists to suppress known-good / non-actionable indicators.
- Authenticate and query MISP with PyMISP to pull fresh, scoped IOCs.
- Export matching attributes as Suricata/Snort rules via the REST API.
- Generate Sigma rules and Wazuh CDB lists from MISP attributes on a schedule.
- Validate that generated detections load and fire in the target tooling.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Relevance |
|---|
| T1589 | Gather Victim Identity Information | Feeds capture adversary reconnaissance indicators; operationalizing them detects/contextualizes such activity. |
| T1071.001 | Application Layer Protocol: Web Protocols | C2 domain/URL IOCs from feeds become Suricata/Sigma detections for malicious HTTP(S). |
| T1071.004 | Application Layer Protocol: DNS | Malicious-domain IOCs feed DNS-based detection (Wazuh/Suricata). |
| T1105 | Ingress Tool Transfer | File-hash IOCs from feeds detect known malicious payload delivery. |
Workflow
1. Add and enable a feed
Register a reputable source and turn it on.
from pymisp import PyMISP, MISPFeed
misp = PyMISP("https://localhost", "YOUR_AUTH_KEY", ssl=False)
feed = MISPFeed()
feed.name = "CIRCL OSINT Feed"
feed.provider = "CIRCL"
feed.url = "https://www.circl.lu/doc/misp/feed-osint"
feed.source_format = "misp"
feed.input_source = "network"
feed.enabled = True
print(misp.add_feed(feed, pythonify=True))
2. Cache enabled feeds for real-time correlation
Caching loads feed IOCs into Redis so lookups are instant.
print(misp.cache_all_feeds())
print(misp.fetch_feed(1))
3. Enable warninglists to reduce false positives
Turn on known-good lists so non-actionable indicators are flagged.
for wl in misp.warninglists(pythonify=True):
if wl.name in ("List of RFC 1918 CIDR blocks",
"Top 1000 website from Cisco Umbrella",
"List of known public DNS resolvers"):
misp.toggle_warninglist(warninglist_id=wl.id, force_enable=True)
4. Authenticate and search for fresh IOCs
Pull recently published, TLP-scoped, to-IDS attributes only.
from pymisp import PyMISP
misp = PyMISP("https://localhost", "YOUR_AUTH_KEY", ssl=False)
attrs = misp.search(
controller="attributes",
type_attribute=["ip-dst", "domain", "url", "md5", "sha256"],
to_ids=True, published=True, last="7d",
enforce_warninglist=True,
pythonify=True,
)
print(f"{len(attrs)} actionable IOCs")
5. Export Suricata/Snort rules via the REST API
MISP renders matching attributes directly as IDS rules.
curl -s -k -H "Authorization: YOUR_AUTH_KEY" -H "Accept: application/json" \
"https://localhost/attributes/restSearch/returnFormat:suricata/to_ids:1/type:domain%7Cip-dst%7Curl" \
-o misp_suricata.rules
curl -s -k -H "Authorization: YOUR_AUTH_KEY" -H "Accept: application/json" \
"https://localhost/attributes/restSearch/returnFormat:snort/to_ids:1" -o misp_snort.rules
6. Deploy the Suricata rules
Load and reload.
cp misp_suricata.rules /etc/suricata/rules/
suricata -T -c /etc/suricata/suricata.yaml
suricatasc -c reload-rules
7. Generate Wazuh CDB lists from IOCs
Convert MISP domains/IPs into a Wazuh CDB lookup list referenced by a rule.
with open("misp_iocs.cdb", "w") as fh:
for a in attrs:
if a.type in ("domain", "ip-dst"):
fh.write(f"{a.value}:\n")
8. Generate Sigma rules from MISP intelligence
Emit a Sigma rule matching the exported domains.
import yaml
domains = [a.value for a in attrs if a.type == "domain"]
sigma = {
"title": "MISP feed malicious domain contact",
"status": "experimental",
"logsource": {"category": "dns"},
"detection": {"selection": {"query|contains": domains}, "condition": "selection"},
"level": "high",
"tags": ["attack.command_and_control", "attack.t1071.004"],
}
with open("misp_domains.yml", "w") as fh:
yaml.safe_dump(sigma, fh, sort_keys=False)
9. Convert and deploy Sigma to your SIEM backend
Use sigma-cli to compile to the target backend (Splunk, Elastic, etc.).
sigma convert -t splunk -p splunk_windows misp_domains.yml > misp_domains.spl
sigma convert -t elasticsearch misp_domains.yml > misp_domains.eql
10. Schedule the pipeline and run the bundled helper
agent.py searches MISP and writes Suricata/Sigma/Wazuh artifacts in one pass; schedule it via cron.
python scripts/agent.py --url https://localhost --key YOUR_AUTH_KEY \
--last 7d --outdir ./detections --insecure
Tools and Resources
Validation Criteria
