Using as example to add MISP feeds

This article demonstrates how to quickly add new MISP feeds, either to your own MISP server or as a contributor to the MISP project. I use the feeds from as an example. provides daily feeds on IPs, domains, URLs, and file hashes, as well as a C2 hunt feed.

MISP feeds are remote or local resources containing indicators that can be either imported into MISP or used for correlations without importing them intoRead more.

Presentation of MISP playbooks at the Jupyterthon

I did a presentation on the MISP playbooks at Jupyterthon. Have a look at the recording at

Don’t hesitate to provide your feedback on the playbooks, or suggest extra additions with the GitHub issue tracker.

Ivanti vulnerabilties – recap

Formerly known as Pulse Connect Secure, or simply Pulse Secure VPN software All supported versions (9.x and 22.x) of Ivanti Connect Secure and Ivanti Policy Secure are vulnerable to CVE-2023-46805 and CVE-2024-21887 CVE-2023-46805 an authentication-bypass vulnerability with a CVSS score of 8.2 in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure that allows a remote attacker to access restricted resources by bypassing control checks. CVE-2024-21887 a command-injection vulnerability found intoRead more.

Current state of the MISP playbooks

I published an overview of the current state of the MISP playbooks, covering the work that has been done in 2023 and the features you can expect in 2024.

Activity 4: MISP workflow integration, Elasticsearch, MDTI and support for curation Activity 5: Timesketch, conversions with CACAO and Microsoft Sentinel Activity 6: Scheduled playbooks, timelines,

Read the full details at the MISP project website at

MISP playbook: Malware triage

I shared the MISP playbook for malware triage that I regularly use for a first assessment on new samples. It uses MISP, VirusTotal, MalwareBazaar, Hashlookupand pefile. It then uploads the samples to MWDB and alerts to Mattermost.

The MISP playbook on malware triage is one of many playbooks that address common use-cases encountered by SOCs, CSIRTs or CTI teams to detect, react and analyse specific intelligence received by MISP.

ENISA Threat Landscape 2023

I contributed to the ENISA Threat Landscape 2023.

The ETL is an annual report on the status of the cybersecurity threat landscape. It identifies the top threats, major trends observed with respect to threats, threat actors and attack techniques, as well as impact and motivation analysis. It also describes relevant mitigation measures.

In the latter part of 2022 and the first half of 2023, the cybersecurity landscape witnessed a significant increase in both the varietyRead more.

MISP to Microsoft Sentinel integration with Upload Indicators API

The MISP2Sentinel integration allows you to sync indicators from MISP to Microsoft Sentinel. The old integration relied on the Microsoft Graph API. Microsoft prefers new integrations to rely on the Upload Indicators API. The new MISP to Microsoft (previously Azure) Sentinel or misp2sentinel does just that, it

Supports integration with the old Graph API, but also It supports the new, and preferred, Upload Indicators API.

Read the installation and configuration documentation at forRead more.

MISP to Sentinel integration

I published a blog article on the MISP project website on how to do the MISP to Azure / Sentinel integration. This integration allows you to upload indicators from MISP to Microsoft Sentinel. It relies on PyMISP to get indicators from MISP and an Azure App and Threat Intelligence Data Connector in Azure.

Read the full article at MISP project website : MISP to Sentinel integration.

The integration is available via GitHub at

ThisRead more.

Migrating your MISP database from a local MySQL to Azure Database for MySQL

In most MISP instances the database (MySQL or MariaDB) is on a local network, either directly on the machine or on a local DB-cluster. As a lot of organisations are moving towards a “full cloud” environment, this also means that they want to start making use of the database features offered by their cloud providers.

Microsoft offers Azure Database for MySQL and in this post I list the (limited) steps required to migrate the MISPRead more.

Include threat information from MISP in Zeek network visibility

Zeek (formerly Bro) is a free and open-source software network analysis framework. It gives insights on DNS queries, HTTP and TLS information and details on transmitted files. I find Zeek one of the best network monitoring tools available to provide detailed visibility on network traffic.

Zeek has a built-in intelligence framework. This framework allows you to add information received via MISP directly into the network visibility capabilities of Zeek. This includes

Visits to URLs orRead more.