MISP (Malware Information Sharing Platform) is an open-source platform used for sharing, storing, and correlating indicators of compromise (IOCs) of targeted attacks and threat intelligence.

How does this skill help with SIEM integration?

It provides Python-based workflows using the PyMISP API to export correlated indicators directly to platforms like Splunk or Elasticsearch via HEC (HTTP Event Collector).

Is PyMISP required for this skill?

Yes, this skill utilizes the PyMISP Python library for programmatic interaction with the MISP API to automate feed management and searching.

Can I use this for private threat feeds?

Yes, the skill includes patterns for adding custom, non-public feeds via CSV, JSON, or structured API inputs with specific distribution settings.

Does it support Docker deployment?

Yes, it includes a production-ready Docker Compose configuration for MISP, including required dependencies like MariaDB and Redis.

MISP Threat Intelligence Aggregator

Name: MISP Threat Intelligence Aggregator
Author: micsapp

bymicsapp

0•

安全与测试

Automates the deployment and management of MISP to aggregate, correlate, and distribute threat intelligence feeds across security infrastructures.

This skill enables security teams to implement a centralized threat intelligence hub using MISP (Malware Information Sharing Platform). It provides comprehensive guidance on deploying MISP via Docker, automating OSINT feed ingestion using the PyMISP API, and establishing automated correlation between disparate threat indicators. By facilitating seamless integration with SIEMs like Splunk and generating actionable blocklists, this skill bridges the gap between raw threat data and proactive defense measures, allowing for a more responsive security posture.

主要功能

01Seamless SIEM integration for Splunk and Elasticsearch platforms

020 GitHub stars

03Automated blocklist generation for firewall and proxy enforcement

04Cross-event indicator correlation and MITRE ATT&CK mapping

05Programmatic feed management via PyMISP API for OSINT and custom sources

06Automated Docker-based MISP deployment and configuration

使用场景

01Correlating internal security incidents with global threat intelligence indicators

02Establishing a centralized Threat Intelligence Platform (TIP) for SOC operations

03Automating the ingestion and validation of diverse OSINT and commercial threat feeds

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills building-threat-feed-aggregation-with-misp

For use in Claude.ai and ChatGPT

主要功能

01Seamless SIEM integration for Splunk and Elasticsearch platforms

020 GitHub stars

03Automated blocklist generation for firewall and proxy enforcement

04Cross-event indicator correlation and MITRE ATT&CK mapping

05Programmatic feed management via PyMISP API for OSINT and custom sources

06Automated Docker-based MISP deployment and configuration

使用场景

01Correlating internal security incidents with global threat intelligence indicators

02Establishing a centralized Threat Intelligence Platform (TIP) for SOC operations

03Automating the ingestion and validation of diverse OSINT and commercial threat feeds

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills building-threat-feed-aggregation-with-misp

For use in Claude.ai and ChatGPT