MISP

Real-time Scenario Integration

You can configure real-time detection of threat indicators received from MISP by selecting a rule such as "IP address is in a specific reputation DB" or "IP address is in a reputation DB", as shown below:

Batch Scenario Integration

To query only records that match IP threat indicators from MISP for source IP (src_ip) or destination IP (dst_ip) in firewall logs from the past 10 minutes using the local MISP profile, use the following query:

table duration=10m FW 
| matchfeed name="misp_ip_local" fields="src_ip, dst_ip"

Checking MISP Feed Data

To view MISP feed data synchronized on the analysis server, run:

table sonar_ioc_misp_*

To check feed data synchronized to each cluster node from the MISP platform, use:

node-feed name="misp_ip_local"