MISP API¶
The MISP Platform is a very popular open source Threat Intelligence Management and sharing platform, IDSTower support importing IOCs stored in MISP via the MISP API, this guide explain how to add a MISP API feed to IDSTower.
To add a MISP API feed to IDSTower, please follow the below steps:
Navigate to Settings->Feeds Tab->Add New Feed.
Set the Feed Name and Feed url.
If you MISP instance uses self-signed certificates, enable the “Ignore TLS Errors” option.
Under type select “MISP API”.
Under authentication, select “API Key” as authentication type.
Enter the API Key for the MISP feed.
Click on “Verify Connection”, in this step IDSTower will verify that both the URL and the authentication credentials provided are valid.
Update the feed import settings if needed, then click on “Add Feed”.
The feed is now added and the IOCs will be imported periodically to IDSTower and send to Suricata hosts, you can trigger the feed download immediately by clicking on “Update” on the feed section.
In the following video, you can see the steps to add a local MISP API feed to IDSTower:
