MISP Cloud Device

Configure a MISP cloud device to pull IOCs from Threat Command.

The following table shows IOC pull characteristics:

IOCs are pulled, together with the following Rapid7 enrichment data:

• First seen
• Last seen
• Source name
• Source confidence
• Severity
• Alert ID
• User tags
• System tags
• Threat actors
• Campaigns
• Associated malware families

You must first add the device to Threat Command and then configure the device to pull IOCs from Threat Command.

Add a MISP cloud device to Threat Command

Add a cloud device to Threat Command.

Prerequisites

• You have the credentials to access the device.
• You have administrative credentials to access Threat Command with a subscription to the Automation and TIP modules.

To add a cloud device to Threat Command:

1. Log in to Threat Command at https://dashboard.ti.insight.rapid7.com
2. From the main menu, select Automation -> Integrations.
3. From the Integrations page, click Cloud.
4. Click Add new device.
5. In the Add New Cloud Device dialog, type a user-defined name for the device.
   The name can contain a maximum of 50 letters, spaces, numbers, and underscores.
6. Select the Device type.
   The default device IOCs limit is displayed.
7. (Optional) You can change the IOCs limit.
8. Click Add.
9. To verify that the new device is added, refresh the Automation > Integrations page.
   The new device is added to the cloud integrations device list. Next to the device name, there is a red dot, indicating that communication has not yet been established. The dot will change to green when the device is synchronized. If the device cannot synchronize for more than 48 hours, an email warning is sent to the account administrator.

Configure a MISP cloud device to pull IOCs

After a device has been added, you must enable the pulling of IOCs by the MISP device from Threat Command.

Before you begin, ensure:

• You have the device login credentials.
• The device has been added.
• You have administrative credentials to access Threat Command with a subscription to the Automation and TIP modules.
• An IOC group for this device exists in Threat Command.
  Creating IOC groups is described in Create an IOC group

• You have the Threat Command account ID and appliance key, as described in API key, account ID, and appliance key.

To configure a MISP cloud device:

1. From Threat Command, copy the IOC group URL into MISP:

   1. From the main menu, select Automation > Integrations.
   2. From the Cloud device list, select the MISP  device.
   3. Click the link icon to the far right of the device IOC group.
      
      The IOC Group URL dialog is displayed.
   4. From the IOC Group URL dialog, copy the URL.

2. Log in to the MISP device.

3. Choose Sync Actions > List Feed, then select Add Feed.

4. Configure the feed:

   1. Select Enabled.
   2. Enter a feed name and the provider name (for example, Rapid7).
   3. For Input Source, ensure that Network is selected.
   4. In the URL field, paste the IOC Group URL.
   5. Click Add Basic Auth.
   6. Type the Threat Command account ID and appliance key.
      

5. Trigger event fetching:

   1. Click Add basic auth header.
      In the List Feeds, all events should be listed as being pulled after some time.
   2. To trigger event pull, click Fetch all events :
      

   Events will start to pull into MISP as MISP events.

   The name of the MISP event will indicate the IOC group name and the current date, for example: #IOC_group_name - #current_date