The Malware Information Sharing Platform (MISP) can receive events and indicators
from the Threat Intelligence Feed.
Prerequisites:
-
MISP version 2.4 or later
-
-
Perm site admin
-
Perm auth
-
Galaxy editor
-
Write access at the operating system level
-
Add the feed in MISP 
Access the Threat Intelligence Feed through the built-in feeds functionality in MISP.
Procedure
- In the MISP web interface, select .
- Click Add Feed to display the configuration page.
- Select Enabled.
- Enter the Name and Provider for the feed.
- Enter the regional feed URL from the table below.
Feed URLs
RegionMISP feed URLAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States - Enter the API token as follows:
Authorization: Bearer <your_token> - Click Submit to save the configuration.
Add custom galaxies
After adding the Threat Intelligence Feed in MISP, you can add or update TrendAI™
galaxies using the Python script available here.
Alternatively, you can manually add custom galaxies by following the steps below.
Procedure
- Download the relevant galaxy JavaScript Object Notation (JSON) files from the URL
for your region shown in the table below.Available TrendAI™ galaxy types:
-
trendmicro-campaign-galaxy
-
trendmicro-intrusion-set-galaxy
-
trendmicro-malware-galaxy
-
trendmicro-tool-galaxy
-
trendmicro-vulnerability-galaxy
Galaxy URLs
RegionGalaxy URL templateAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States -
- Copy the files to the galaxies folder (location may vary):
/var/www/MISP/app/files/misp-galaxy/galaxies/ - Click Force Update Galaxies to save changes.
Add custom clusters
After adding the Threat Intelligence Feed in MISP, you can add or update TrendAI™
clusters using the Python script available here.
Alternatively, you can manually add custom galaxies by following the steps below.
Procedure
- Download the relevant cluster JSON files from the URL for your region shown in the
table below.
Cluster URLs
RegionCluster URL templateAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States - Copy the files to the clusters folder (location may vary):
/var/www/MISP/app/files/misp-galaxy/clusters/ - Click Force Update Galaxies to save changes.