Even though the synchronization has not totally completed now,
coming over into the home portal,
you can see that this is now being populated with events.
And of course, this is one of the main reasons why I would use MISP,
which would allow me now to consume a whole host of
information and search across multiple IoCs.
And hopefully you can see from the examples that have already
been collected that it's giving me a whole depth of information
regarding each particular threat.
And so, for example, I can see the creator organization.
If I was to left select these,
it would then allow me to filter on all of the events which have
been created by this particular organization.
Under the Clusters column, I can see the particular galaxies,
remember that's a collection of different objects,
and indeed the actual object itself within the cluster.
Once again,
I'll be able to filter on all of the events within this particular cluster.
Hovering over the actual threat actor also then opens up a whole series
of different details that I would then be able to use.
Coming across into the Tags,
I can see that this has come from open source intelligence and that
the traffic light protocol is given as white.
This may be useful for me if I'm looking at disseminating
this further in the intelligence cycle.
I can then also see further information from the remaining columns,
which would be useful to me as an analyst when I'm
looking to grade this intelligence.
So, for example,
I can see the number of attributions and correlations that have been created.
I would then also be able to expand on each of these threat indicators
by taking a look at them in more depth and detail.
You can also see that this portal has the ability for me to search,
and I can also use a simple filtering mechanism.
From within here, I can also add my own event,
and so selecting the Add Event option allows me then to
put in the details that I require.
And the information that I put in here is obviously the date and the
communities to which I wish to share this information.
I can also allocate a Threat Level being High,
Medium, Low, or Undefined, and the analysis Type,
which is Initial, Ongoing, or Completed.
I have to give the event a name, and then I can simply submit this,
which will then allow it to go into the list of events that we saw previously.
At this moment in time,
this event does not hold any content in the form of attributes or objects.
And so once you have created the template,
you can then simply come down,
and you can then add these by selecting the Add attribute.
This thing allows you to come over and add the
attributes by using the built‑in template.
All you need to do is simply select the category of the
attribute that you are looking for.
So in this particular instance, I'll go for Network activity and then the Type,
which is populated in accordance with the category that you have selected,
so let's select domain.
Within here, I now need to put the value of my domain,
and I'm going to use my own blog site.
Once you have given the domain a value, you can then submit this into your event.
I can now see that the Network activity and the domain of
cyberphil.co.uk has been populated.
However, I cannot see any related events,
I'm pleased to say this, and/or any feed hits.
And this would indicate to me that at this moment in time that
cyberphil has not had any events reported upon it.
If I now add another domain within here and one that probably
will have some kind of activity against it,
I can come down and once again select Network activity and a domain,
and this time I'm going to use google.com as an example.
Submitting this now put in the list,
and I can see again that Network activity is domain
and google.com has been populated.
However, this time, if you come over and take a look at Related Events,
I can then hover over these and see the potential events which have
been reported against that particular domain.
Now, of course,
I am fairly comfortable with the fact that google.com is not a nefarious domain,
and so after further analysis of this, it's likely that it would be removed.
And as I continue to populate the various attributes
within the event that I'm reporting,
I can then further analyze them and filter based on the
type of events that are being created.
Another great option that I have for my particular events is to enrich them,
which would then allow me to utilize the plugins which are
administered through the administration portal.
And these range from basic enrichment such as creating YARA rules automatically,
or I can go through the Administration and Server Settings,
which will allow me then to add different plugins from different providers.
These can also be scripted as part of your enrichment modules or
imported as required within your organization.
Within my created event,
I may also use the facilities of creating tags or using the built‑in galaxies.
If I hover over the tags,
this will then allow you to take a look at the collections
which are built in or customize them,
and these can be used for filtering and searching.
Under the Galaxies option, I have the ability to create a new cluster,
or I can use the existing clusters which are built into the system.
And if I select Add new cluster,
I can come down and take a look at the MITRE ATT&CK options open to me.
Throughout here, I can then add all clusters,
the attack pattern, or a course of action.
And so if I was looking for a particular threat mitigation,
such as the examples that were given previously in the course,
I can then simply search against that particular technique,
which will then allow me to come in and take a look in more depth
and detail and submit this as part of my galaxy.
You can see here that I now have Exploitation for Credential Access Mitigation,
or the T1212 embedded within this particular event.
MISP also comes with a load of features which will allow
you to create your own dashboards, for example,
for your internal organizations, and, of course,
it comes with a series of search and filtering functions.
It also has built in the ability for you to create and
generate reports and graphs and, of course,
also creating scripts,
which can then be embedded within your internal security systems.
MISP as a blue team tool is a very important asset to your organization,
and there are also plenty more capabilities that can be
discovered once you get up and running with the tool.
And of course, remember that it is jammed packed with a series of features,
and it's a good idea to check these out under the
FEATURES section upon the home website.
And this can also be used in conjunction with the project book,
which you can download from GitHub.
The tool itself is widely used as a threat sharing platform and obviously
dovetails in with other tools within your blue team arsenal.
And examples of these include the AIS, or the Automated Indicator Sharing tool,
which is part of the CISA.
You may also use it with VirusTotal,
and there are direct plugins that you may use with VirusTotal and MISP.
That's also true to say, of course,
with MITRE ATT&CK and other great tools such as Maltego.
And all of these would come together, of course,
to create a great set of tools within your blue team.
If you wish to find out more about how MISP and some of these
other great blue team tools can form part of your threat
intelligence analyst infrastructure,
then why not check out some of the great learning to
be had on the Pluralsight platform.
And in particular,
take a look at the EC‑Council Certified Threat Intelligence Analyst course,
which will also take you up to examination status.
It's been my pleasure to be with you on this course on MISP,
and I look forward to being with you again on another
Pluralsight course in the near future.