Cuckoo: Integrate with Malware Information Sharing Platform (MISP)

[elhoim]

MISP is a platform to echange IOCs.
It would be great to have integration with it, more specifically:

• import sample from MISP into cuckoo
• export report to a MISP event
• lookup samples hashes (MD5/SHA1/SHA256) from MISP inside Cuckoo
• save output of analysis from a cuckoo report into MISP attributes
• use yara rules from MISP in Cuckoo

[botherder]

It seems that it might mostly be work to be done on MISP side and eventually interfacing with Cuckoo's API.

[SpoonBoy]

duplicate of #344 ?

[elhoim]

Not really since #344 is only about OpenIOC ingestion by cuckoo, while if you go for the MISP integration, you can ingest openIOC and other data feeds via MISP.

[adulau]

To summarize, there is a current misp processing modules in cuckoo. This module does a lookup against a MISP instance to find existing indicators.

There is also a misp reporting module pushing an analysis back to a MISP instance in the cuckoo-modified version of spender-sandbox.

I think @jbremer did some work on the MISP reporting module too. Could we have the reporting module into the main cuckoo reporting module? That would be awesome.

[doomedraven]

It is already in PR, i did that for mod and for official, @jbremer improved my procesing, now waiting for accept the reporting one, see PRs

[jbremer]

@adulau The MISP reporting module that I did is currently only part of the package branch. I'll see if I can merge that thing back to master (for the upcoming 2.0-RC2 release) and merge @doomedraven's PR into it as well.

[adulau]

Great news! Thank you for the feedback.

[adulau]

Any date foreseen for the merge in the release? ;-)

[doomedraven]

https://github.com/cuckoosandbox/cuckoo/pull/1012

[jbremer]

@adulau @doomedraven As per #1012, I've manually merged @doomedraven's code into what we already had present, bumped to the latest PyMISP version, added some unit tests, and suppressed the Python 2 related warning from PyMISP.
See also commit on master (https://github.com/cuckoosandbox/cuckoo/commit/bb78d5deb1c868e50f84210302686f3a87bdd822) and the commit on package (https://github.com/jbremer/cuckoo/commit/f76304c4967e2c11e5a68481ca19c3135b1743f0, which will be pushed upstream shortly).

@adulau I understand that PyMISP has a preference for Python 3.3+, but will you remain support for Python 2.7 as well?

As per official release of Cuckoo including this MISP module, won't be soon I guess. People could download master.zip from Github though, that'd do the same. We hope to release the first version of package within 2 months and as part of that, the MISP reporting module would be included as well.

[jbremer]

Closing this issue as resolved.