From asi
Deploys MISP via Docker, configures threat feeds, and uses PyMISP API to collect, store, and correlate IOCs from community and commercial sources. For security operations building threat intelligence pipelines.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programm...
Deploys MISP via Docker, configures threat feeds, and uses PyMISP API to collect, correlate IOCs from community/commercial sources for security operations.
Deploys MISP via Docker, configures threat feeds like CIRCL OSINT and abuse.ch, collects/searches IOCs with PyMISP API, exports to STIX/TAXII.
Deploys MISP via Docker to aggregate threat intelligence feeds from OSINT sources like abuse.ch and AlienVault OTX, correlate IOCs, and integrate with SIEMs like Splunk and Elasticsearch.
Share bugs, ideas, or general feedback.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programmatic access, and building automated collection pipelines that aggregate IOCs from multiple community and commercial sources.
pymisp library installedMISP operates on an event-based model where threat intelligence is organized into events containing attributes (IOCs), objects (structured groupings of attributes), galaxies (threat actor/malware clusters linked to MITRE ATT&CK), and tags for classification. Synchronization between MISP instances uses a pull/push model over HTTPS with API key authentication.
PyMISP is the official Python library to access MISP platforms via their REST API. It supports fetching events, adding/updating events and attributes, uploading samples, and searching across the entire MISP dataset. Authentication uses an API key passed in the Authorization header.
git clone https://github.com/MISP/misp-docker.git
cd misp-docker
cp template.env .env
# Edit .env to set MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE
docker compose up -d
Enable built-in MISP feeds via the web UI or API:
from pymisp import PyMISP
misp = PyMISP('https://misp.local', 'YOUR_API_KEY', ssl=False)
# List available feeds
feeds = misp.feeds()
for feed in feeds:
print(f"{feed['Feed']['id']}: {feed['Feed']['name']} - Enabled: {feed['Feed']['enabled']}")
# Enable CIRCL OSINT Feed
misp.enable_feed(feed_id=1)
misp.cache_feed(feed_id=1)
misp.fetch_feed(feed_id=1)
# Add abuse.ch URLhaus feed
feed_data = {
'name': 'URLhaus Recent URLs',
'provider': 'abuse.ch',
'url': 'https://urlhaus.abuse.ch/downloads/csv_recent/',
'source_format': 'csv',
'input_source': 'network',
'publish': False,
'enabled': True,
'headers': '',
'distribution': 0,
'sharing_group_id': 0,
'tag_id': 0,
'default': False,
'lookup_visible': True
}
result = misp.add_feed(feed_data)
print(f"Feed added: {result}")
from pymisp import PyMISP, MISPEvent
from datetime import datetime, timedelta
misp = PyMISP('https://misp.local', 'YOUR_API_KEY', ssl=False)
# Search for events from the last 7 days
result = misp.search(
controller='events',
date_from=(datetime.now() - timedelta(days=7)).strftime('%Y-%m-%d'),
type_attribute='ip-dst',
to_ids=True,
pythonify=True
)
for event in result:
print(f"Event {event.id}: {event.info}")
for attr in event.attributes:
if attr.type == 'ip-dst' and attr.to_ids:
print(f" IOC: {attr.value} (category: {attr.category})")
# Export as STIX 2.1 bundle
stix_output = misp.search(
controller='events',
return_format='stix2',
tags=['tlp:white'],
published=True
)
# Export IDS-flagged attributes as Suricata rules
suricata_rules = misp.search(
controller='attributes',
return_format='suricata',
to_ids=True,
type_attribute=['ip-dst', 'domain', 'url']
)
# Export as CSV for SIEM ingestion
csv_output = misp.search(
controller='attributes',
return_format='csv',
type_attribute='ip-dst',
to_ids=True
)