MISP — Threat Intelligence & Partage d'IOC

git clone https//github.com/MISP/misp-docker
cd misp-docker
cp templateenv env
# Éditer .env : URL, admin email, password
docker compose up -d
# Accès : https://localhost
# Compte : admin@admin.test / admin (à changer)

# docker-compose.yml (extrait clé)
services:
  misp:
    image: ghcr.io/misp/misp-docker/misp-core:latest
    ports:
      - "443:443"
      - "80:80"
    environment:
      - MISP_BASEURL=https://misp.local
      - MISP_ADMIN_EMAIL=admin@org.local
      - MISP_ADMIN_PASSPHRASE=ChangeMe!2026
    volumes:
      - misp_data:/var/www/MISP/app/files
  misp-modules:
    image: ghcr.io/misp/misp-docker/misp-modules:latest
    environment:
      - REDIS_BACKEND=redis

Event
 Info titre
 Distribution org community connected all sharing-group)
 Threat level 1High 2Med 3Low 4Undefined
 Analysis 0Initial 1Ongoing 2Completed
 Attributes IOC
     ip-src  ip-dst
     domain
     url
     md5  sha1  sha256
     email-src  email-subject
     filename

MISP_URL"https://misp.local"
API_KEY"votre_authkey"
curl -k -H "Authorization: $API_KEY" 
     -H "Accept: application/json" 
     $MISP_URL/users/view/me

curl -k -X POST 
  -H "Authorization: $API_KEY" 
  -H "Content-Type: application/json" 
  -d 
    "Event" 
      "info" "Campagne phishing Q1 2026"
      "threat_level_id" 2
      "analysis" 1
      "distribution" 1
      "Attribute" 
        "type" "ip-dst" "category" "Network activity" "value" "185.220.101.45"
        "type" "domain" "category" "Network activity" "value" "evil-domain.xyz"
        "type" "sha256" "category" "Payload delivery"
         "value" "a3f5b2c8d1e4f7a9b0c3d6e9f2a5b8c1d4e7f0a3b6c9d2e5f8a1b4c7d0e3f6"
      
    
   
  $MISP_URL/events/add

# Rechercher une IP
curl -k -X POST 
  -H "Authorization: $API_KEY" 
  -H "Content-Type: application/json" 
  -d '{"value": "185.220.101.45", "type": "ip-dst"}' 
  $MISP_URL/attributes/restSearch
# Rechercher par tag
curl -k -X POST 
  -H "Authorization: $API_KEY" 
  -H "Content-Type: application/json" 
  -d '{"tags": ["tlp:red", "apt:lazarus"]}' 
  $MISP_URL/events/restSearch

curl -k -H "Authorization: $API_KEY" 
  -H "Accept: application/json" 
  "$MISP_URL/events/restSearch/download/stix2"

# Feeds recommandés (Administration > Feeds)
 Abusech URLhaus          URLs malveillantes
 Abusech MalwareBazaar    Hashes malware
 Abusech ThreatFox        IOC multi-types
 CIRCL OSINT Feed          Events MISP publics
 Botvrijeu                Domaines/IPs malveillants
 DigitalSide Threat-Intel  APT indicators
# Mise à jour manuelle
curl -k -X GET -H "Authorization: $API_KEY" 
  $MISP_URL/feeds/fetchFromAllFeeds

# application.conf
misp {
  servers = [
    {
      name = production
      url = "https://misp.local"
      auth {
        type = key
        key = "MISP_API_KEY"
      }
      wsConfig.ssl.loose.acceptAnyCertificate: true
    }
  ]
  interval = 5 minutes
}

1 MISP dtecte un vnement  exporte vers TheHive
2 TheHive cre une alerte
3 SOC analyse  transforme en Case si confirm
4 Post-incident  enrichit MISP avec nouveaux IOC

# Taxonomies importantes à activer
 tlp         Traffic Light Protocol
 misp        Niveaux de confiance
 admiralty-scale  Fiabilit de la source
 kill-chain  MITRE Kill Chain phases
 workflow    Statut de traitement
# Application d'un tag sur un événement
Administration > Taxonomies > Enable
Event > Tags > Add tag

from pymisp import PyMISP, MISPEvent, MISPAttribute
misp = PyMISP("https://misp.local", "API_KEY", False)
# Créer un événement
event = MISPEvent()
event.info = "IOC from SIEM correlation"
event.threat_level_id = 2
attr = MISPAttribute()
attr.type = "ip-src"
attr.value = "10.0.0.50"
attr.comment = "Source interne compromise"
event.add_attribute(**attr.to_dict())
misp.add_event(event)
# Chercher un IOC
result = misp.search(value="185.220.101.45", type_attribute="ip-dst")
for attr in result:
    print(f"Trouvé dans event {attr['Event']['id']}: {attr['value']}")