misp2cbr's Introduction

MISP Threat Feed into CarbonBlack Response

Utilizing your Threat data from a MISP instance into CarbonBlack Response by exposing the data in the Threat Intelligence Feed.

The following data types from MISP is exported into the feed

ip-src
ip-dst
domain
hostname
md5 checksum
sha256 checksum

The above MISP data types are converted into CarbonBlack's data types

IPv4
IPv6
DNS
MD5
SHA256

Remember to create the file "keys.py":

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

misp_url = 'https://misp_instance'
misp_key = 'auth_key_value'
misp_verifycert = True
misp_tag = 'CarbonBlackResponse'

flask_cert = ''
flask_key = ''
app_debug = False

proxies = {
    'https://127.0.0.1:8090',
    'http://127.0.0.1:8090',
}

###Installation:

pip3 install -r requirements.txt

You can choose to add your own certificates, alternate these will be autogenerated. To use ad hoc certificates with Flask, you need to install an additional dependency in your environment:

pip install pyopenssl

Sample Usage:

~# # python3 MISP2CBR.py -h

Expose MISP attributes to CarbonBlack Response
(c)2022 eCrimeLabs
https://www.ecrimelabs.com
----------------------------------------

usage: MISP2CBR.py [-h] [-i IP] [-p PORT]

Providing Threat Data from MISP to Cb Response EDR tool

optional arguments:
  -h, --help            show this help message and exit
  -i IP, --ip IP        Hostname or IP of the service (default 127.0.0.1)
  -p PORT, --port PORT  Portname the service will listen on (default 8443)

Recommend Projects