Threat hunting scripts

About the MISP setup and automating event creation using PyMISP

(Unofficial) Script to convert and push Kaspersky APT IoC Hash Data Feeds to MISP (Malware Information Sharing Platform)

(Unofficial) Script to convert and push Kaspersky APT IoC URL Data Feeds to MISP (Malware Information Sharing Platform)

(Unofficial) Script to convert and push Kaspersky APT IoC IP Data Feeds to MISP (Malware Information Sharing Platform)

An AWS Lambda function to export NIDS IOCs from a MISP instance

Enhancing MISP (Malware Information Sharing Platform & Threat Sharing)

A self-contained docker image for integration tests against MISP

Retrieves analysis information for a set of iocs (IP/Hash/URL/Domain) from VirusTotal API.

This script it's used to disable the attribute 'to_ids' on MISP events, features removal of the IDS tag on old events or based on Reputational datasets results.

An alternative frontend for MISP

Import, Update, and Categorize malware samples from Malpedia (https://malpedia.caad.fkie.fraunhofer.de/) to a MISP (https://www.misp-project.org/) instance.

An elixir wrapper to MISP's API

Simple and secure synchronisation of MISP instances

This project is a phishing classification ML system that can detect attacks through a hybrid URL and language models. It can also be connected to a MISP instance where it can take in new threats and classifying them automatically.

PySight2MISP is a project that can be run to be used as glue between iSight intel API and MISP API

Script to fetch data from virustotal and add it to a specific event as an object

Import, Update, and Categorize malware samples from Malpedia (https://malpedia.caad.fkie.fraunhofer.de/) to a MISP (https://www.misp-project.org/) instance.

Simple and secure synchronisation of MISP instances with mobile phones

misp-guard is a mitmproxy addon that inspects and blocks outgoing events to external MISP instances via sync mechanisms (pull/push) based on a set of customizable block rules.