Misp: Simple question

Created on 2 Feb 2017 · 6Comments · Source: MISP/MISP

Hello,
Can anybody install MISP and use of all feature?

support

Source

dpicollege

Most helpful comment

Agreed, that you should have a look at PyMISP, esp. since it integrates nicely with the Viper framework which is a great framework for organizing malware collections: https://github.com/viper-framework/viper

StefanKelm on 2 Feb 2017

👍2

All 6 comments

Yes, we do.

PS: Maybe you want to elaborate the question? if you need some support.

adulau on 2 Feb 2017

🎉1

Thanks indeed. I have 20TB of malware and I need make stix or ioc of that file. is it possible with MISP?
another question does MISP have clustering or AI System for find new IOC of malware?

dpicollege on 2 Feb 2017

That is quite the collection of malware. Depends what exactly you need. You could ingest your malware zoo indeed (just read up on PyMISP to write a simple script that loops through your samples and pushes them to MISP). At this point you will get file hashes out of the sample and you can start running enrichment on them and MISP will create correlations on any similar IOCs from the set that you have obtained through the enrichment. Once you are done, you can start exporting the IOCs that you found this way in STIX format.

But it all depends on what exactly you are after.