---
title: "MISP — Threat Intelligence & Partage d'IOC"
domain: security
subdomain: soc
phase: 04-detection
type: snippet
tags: [misp, threat-intelligence, ioc, stix, taxii, soc]
difficulty: intermediate
status: stable
updated: "Sat May 30 2026 00:00:00 GMT+0000 (Coordinated Universal Time)"
---
## Déploiement Docker

```bash
git clone https://github.com/MISP/misp-docker
cd misp-docker
cp template.env .env

# Éditer .env : URL, admin email, password
docker compose up -d

# Accès : https://localhost
# Compte : admin@admin.test / admin (à changer)
```

```yaml
# docker-compose.yml (extrait clé)
services:
  misp:
    image: ghcr.io/misp/misp-docker/misp-core:latest
    ports:
      - "443:443"
      - "80:80"
    environment:
      - MISP_BASEURL=https://misp.local
      - MISP_ADMIN_EMAIL=admin@org.local
      - MISP_ADMIN_PASSPHRASE=ChangeMe!2026
    volumes:
      - misp_data:/var/www/MISP/app/files

  misp-modules:
    image: ghcr.io/misp/misp-docker/misp-modules:latest
    environment:
      - REDIS_BACKEND=redis
```

---

## Concepts clés

### Structure d'un événement
```
Event
├── Info (titre)
├── Distribution (org, community, connected, all, sharing-group)
├── Threat level (1=High, 2=Med, 3=Low, 4=Undefined)
├── Analysis (0=Initial, 1=Ongoing, 2=Completed)
└── Attributes (IOC)
    ├── ip-src / ip-dst
    ├── domain
    ├── url
    ├── md5 / sha1 / sha256
    ├── email-src / email-subject
    └── filename
```

### Catégories d'attributs

| Catégorie | Exemples |
|-----------|----------|
| Network activity | ip-src, ip-dst, domain, url |
| Payload delivery | md5, sha256, filename |
| Artifacts dropped | regkey, mutex |
| External analysis | link, comment |
| Antivirus detection | yara, sigma |

---

## API MISP

### Authentification
```bash
MISP_URL="https://misp.local"
API_KEY="votre_authkey"

curl -k -H "Authorization: $API_KEY" \
     -H "Accept: application/json" \
     $MISP_URL/users/view/me
```

### Créer un événement
```bash
curl -k -X POST \
  -H "Authorization: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Event": {
      "info": "Campagne phishing Q1 2026",
      "threat_level_id": 2,
      "analysis": 1,
      "distribution": 1,
      "Attribute": [
        {"type": "ip-dst", "category": "Network activity", "value": "185.220.101.45"},
        {"type": "domain", "category": "Network activity", "value": "evil-domain.xyz"},
        {"type": "sha256", "category": "Payload delivery",
         "value": "a3f5b2c8d1e4f7a9b0c3d6e9f2a5b8c1d4e7f0a3b6c9d2e5f8a1b4c7d0e3f6"}
      ]
    }
  }' \
  $MISP_URL/events/add
```

### Recherche d'IOC
```bash
# Rechercher une IP
curl -k -X POST \
  -H "Authorization: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value": "185.220.101.45", "type": "ip-dst"}' \
  $MISP_URL/attributes/restSearch

# Rechercher par tag
curl -k -X POST \
  -H "Authorization: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tags": ["tlp:red", "apt:lazarus"]}' \
  $MISP_URL/events/restSearch
```

### Export STIX 2.1
```bash
curl -k -H "Authorization: $API_KEY" \
  -H "Accept: application/json" \
  "$MISP_URL/events/restSearch/download/stix2"
```

---

## Feeds — Threat Intelligence automatisée

```bash
# Feeds recommandés (Administration > Feeds)
- Abuse.ch URLhaus         : URLs malveillantes
- Abuse.ch MalwareBazaar   : Hashes malware
- Abuse.ch ThreatFox       : IOC multi-types
- CIRCL OSINT Feed         : Events MISP publics
- Botvrij.eu               : Domaines/IPs malveillants
- DigitalSide Threat-Intel : APT indicators

# Mise à jour manuelle
curl -k -X GET -H "Authorization: $API_KEY" \
  $MISP_URL/feeds/fetchFromAllFeeds
```

---

## Intégration TheHive ↔ MISP

### Configuration côté TheHive
```hocon
# application.conf
misp {
  servers = [
    {
      name = production
      url = "https://misp.local"
      auth {
        type = key
        key = "MISP_API_KEY"
      }
      wsConfig.ssl.loose.acceptAnyCertificate: true
    }
  ]
  interval = 5 minutes
}
```

### Workflow automatique
```
1. MISP détecte un événement → exporte vers TheHive
2. TheHive crée une alerte
3. SOC analyse → transforme en Case si confirmé
4. Post-incident → enrichit MISP avec nouveaux IOC
```

---

## Tags & Taxonomies

```bash
# Taxonomies importantes à activer
- tlp        : Traffic Light Protocol
- misp       : Niveaux de confiance
- admiralty-scale : Fiabilité de la source
- kill-chain : MITRE Kill Chain phases
- workflow   : Statut de traitement

# Application d'un tag sur un événement
Administration > Taxonomies > Enable
Event > Tags > Add tag
```

---

## PyMISP — Intégration Python

```python
from pymisp import PyMISP, MISPEvent, MISPAttribute

misp = PyMISP("https://misp.local", "API_KEY", False)

# Créer un événement
event = MISPEvent()
event.info = "IOC from SIEM correlation"
event.threat_level_id = 2

attr = MISPAttribute()
attr.type = "ip-src"
attr.value = "10.0.0.50"
attr.comment = "Source interne compromise"
event.add_attribute(**attr.to_dict())

misp.add_event(event)

# Chercher un IOC
result = misp.search(value="185.220.101.45", type_attribute="ip-dst")
for attr in result:
    print(f"Trouvé dans event {attr['Event']['id']}: {attr['value']}")
```