collecting-threat-intelligence-with-misp

name	collecting-threat-intelligence-with-misp
description	MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
domain	cybersecurity
subdomain	threat-intelligence
tags	["threat-intelligence","cti","ioc","mitre-attack","stix","misp","taxii","threat-sharing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Collecting Threat Intelligence with MISP

Overview

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programmatic access, and building automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

When to Use

• When managing security operations that require collecting threat intelligence with misp
• When improving security program maturity and operational processes
• When establishing standardized procedures for security team workflows
• When integrating threat intelligence or vulnerability data into operations

Detection Gaps & Validation

• Feed staleness and dedup blindness: MISP correlation fires only on exact attribute-value matches. A C2 IP stored as ip-dst will not correlate with the same value stored as ip-src or inside a network-connection object - normalize types before trusting a "no correlation" result.
• to_ids flag mismatch: attributes with to_ids=False never reach Suricata/SIEM exports. A feed that imports IOCs without setting to_ids produces silent detection gaps - audit with a search on controller='attributes', to_ids=False to surface them.
• Expired indicators: feeds like URLhaus and Feodo Tracker recycle fast; without first_seen/last_seen decay or Sighting objects, blocked IOCs go stale. Validate feed timestamp freshness, not just the enabled flag.
• Galaxy/cluster drift: threat-actor attribution via galaxies (e.g. mitre-intrusion-set) is only as current as the feed's tagging. Shared-infra IOCs (Cloudflare, bulletproof hosts) cause false attribution - confirm with a second pivot before trusting a galaxy link.
• How to validate: after fetch_feed, confirm the event count increased, spot-check that 5 attributes resolve to live IOCs, and verify a known test IOC round-trips through your STIX 2.1/CSV export before declaring the pipeline healthy.

Prerequisites

• Python 3.9+ with pymisp library installed
• Docker and Docker Compose for MISP deployment