Hello, and welcome to this course, which forms part of the blue team
tools set at Pluralsight. And in this particular course, we're going to
be taking a look at the benefits of introducing the tool of MISP into
your threat Intelligence program.
My name is Phil Chapman, and I have been involved within the world of
intelligence and threat intelligence for over 20 years. MISP, the
Threat Sharing platform, is one of those tools that really doesn't tell
you what it does on the tin, as the abbreviation stands for Malware
Information Sharing Project.
That was the early concept of this particular tool, and now MISP is a threat
intelligence sharing platform that covers all types of threat intelligence
and doesn't just focus on malware. As a blue team tool, this alleviates many
problems both from an internal threat intelligence community and a wider
audience, and the tool itself is an open source resource, and there are
plenty of ways that you can integrate this within your blue team threat
intelligence program.
The early development and the first iteration of the tool
can be attributed to Christophe Vandeplas,
who back in 2011 developed a tool which was known as the Cyber
Defense Signatures in order to alleviate the problem of sharing
threat intelligence. At the time,
it was simply done by using email or other documents and was not passable
into automatic systems. Over the next couple of years,
it was presented to NATO who saw the potential in the tool and were
able to develop it into the tool which is now MISP.
And although the original tool was the Malware Information and Sharing Project,
it has now morphed into a wider tool, which is used
throughout the threat intelligence community as a threat
intelligence platform for sharing,
storing, and correlating indicators of compromise of targeted attacks,
threat intelligence,
financial fraud information, and vulnerability
information across many threat actors.
And there are now several key team members who are all volunteers that are
involved directly within the development of the project itself. And the core
team who are now responsible for the MISP project can be found on the MISP
portal. And although we should, of course,
thank them all for their continued efforts in development of this tool,
we should also pass our thanks on to the numerous contributors who you can
also see available on the MISP project page, and, of course, that may
include you and I within this community. MISP alleviates one of the key
problems we have within the threat intelligence community either within an
internal blue team, across the different sectors, or the threat
intelligence community at large, and it's now used by multiple
organizations to store,
share, and collaborate on cybersecurity indicators of
compromise and, of course, malware analysis.
It's a relatively straightforward platform to download directly from the
misp‑project.org, and there are several different ways that this can be done,
and I'll highlight these to you when we have a demonstration. MISP is packed
with multiple features and probably too many that I would be able to cover in
the time on this course, so it's a great idea to take a look at the separate
FEATURES tab up on the MIST site. And as with all great threat intelligence
sharing platforms,
it allows you both to share with humans and also with machines. And
this ultimately was one of the key reasons why the tool was first
developed, in order for us to import and export our threat intelligence
data into our existing infrastructure.
And this can now be used and dovetailed in with your existing IDS systems.
And so Snort and Bro,
for example, are two classic examples. And it's also
compatible with the various scripting tools which are
also used on our internal systems.
And although there is a wide range of different options that
we can dovetail into our automated systems, MISP doesn't
forget the human element to this.
One of the really neat features is also the discussion feature, which allows
you to directly converse with your compatriots either internally or across
different organizations, and this allows for a wide range of analysts to
share their thoughts and hypotheses on the different TTPs and threat actors
that may be in existence.