So let's put all of this together with a demonstration where first of all
we'll have a quick overview of MISP and their online presence.
Then we'll go through the process of installing it locally to your machines
and some of the initial configuration and other areas that you may wish to
consider whilst using this tool. To begin with, it's well worth taking a look
and familiarizing yourself with the MISP home page. And here, MISP will be
showcasing all of the various features that are available to you with the
platform, and the home page allows you to take a quick look at the different
features which are available. If you want more depth and detail on these, the
FEATURES tab will then layer in all of the different features which are
available to you whilst using this platform. And it all depends upon your
organizational needs whether you select all of these features or not.
There are also several data models that can be implemented
as well, and this allows you to take a look at the
different taxonomies, for example, and the MISP galaxies,
which allows you to centralize a series of objects for easy analysis.
Of course, there's a whole series of documentation available,
and there are also other areas of interest,
such as the COMMUNITIES,
EVENTS, NEWS, and CONTACT. Within the CONTACT menu, you can also see who
the current core team are and all of those great contributors who make
MISP what it is. For this particular demonstration, we're interested in
the DOWNLOAD tab, which takes us over to a very simple site which allows
you to take a look at the different options of downloading and
installing MISP.
As you can see, it gives you the basic requirements and also
allows you to download virtual images for testing.
These are particularly useful for VirtualBox and VMware users.
There are, of course, other options available to you depending upon the
systems that you have on your internal organization. From within here, you
also get the hyperlinks to the GitHub repositories, and so this allows you
to go directly to the installation guides.
Once over into the GitHub repository,
you can see the installation instructions, and the left hand
menu allows you to take a look at the various guides for the
different operating systems available.
It's highly recommended that this is installed on Ubuntu, but you can see that
there are various flavors of Linux that you can also opt for.
And for my demonstration,
I'm simply going to use a nice, clean edition of Ubuntu, and I'm going to
follow the installer and the manual installation instructions. And this
really couldn't be any easier than copying and pasting in the dedicated
scripts that you can see in step one.
There are a couple of words of caution here, however,
as the installation process is quite lengthy, and it will
also ask you for some inputs. Of course,
you will need to be elevated to administrator, and several minutes
into the installation process you get to select whether you want to
create a new local user account, which is defaulted to the name of
MISP, or carry on with a local user that is currently established
on the machine.
This gotcha may catch you out if you leave it unattended.
However,
once you've administered those inputs, you are then safe to leave the
installation, which can take several minutes to conclude. And to save
some time on this demonstration, I've already gone ahead and gone
through the installation process. And once it's complete, you get all of
the information required for the local accounts that you will need to
access the portal.
Coming up into the home page, I can see that there is not much activity
taking place on my MISP platform at this moment in time. That's because I
have not allowed for any synchronizations from the threat intelligence
community down onto my platform. In order to enable this, I need to come over
to the Sync Actions menu where I can take a look at the listed feeds
available to this particular machine.
Once this is fired up,
I can then come in and take a look at the default feed metadata, and I can
select either all or those that are relevant to me. And you can see here that it
gives you a long list of providers and the different types of feeds which are
available to you. From within here, the first thing I need to do is to enable
these feeds which I am interested in.
And so I simply select them and then enable those that have been
selected. And once they are enabled, I can simply select them and
go and fetch and store all feed data.
And I'm going to go ahead and commit this for this demonstration.
It's now going to go away and pull down the 20 feeds which I have
enabled and collect them all in one place.
If I come over into the Administration menu,
I can take a look at the jobs which are currently running, and this will
then allow me to take a look at this synchronization job which I have
just started. And here you can see all of those job entries which I'm
currently waiting to be completed.
I'm going to go ahead and pause the demonstration here, and
we'll pick this up in the second part.