Anthropic-Cybersecurity-Skills/skills/collecting-threat-intelligence-with-misp/references/workflows.md

MISP Threat Intelligence Collection Workflows

Workflow 1: Automated Feed Collection Pipeline

[Community Feeds] --> [MISP Feed Manager] --> [Event Creation] --> [Correlation Engine]
     |                      |                       |                      |
     v                      v                       v                      v
- CIRCL OSINT        - Schedule fetch         - Auto-tag with       - Deduplicate
- Botvrij.eu         - Parse formats            TLP/PAP             - Cross-reference
- abuse.ch           - Validate IOCs          - Set distribution    - Cluster similar
- PhishTank          - Filter warninglists    - Publish/unpublish     events

Steps:

1. Feed Registration: Add feeds via UI or PyMISP API with source_format, URL, and headers
2. Scheduled Fetch: Configure cron job or MISP scheduler to pull feeds at intervals
3. Parsing and Validation: MISP parses feed content, validates IOC formats, checks against warninglists
4. Event Generation: Each feed pull creates or updates events with parsed attributes
5. Correlation: MISP correlates new attributes against existing data, identifying overlaps
6. Distribution: Events are distributed based on TLP and sharing group configurations

Workflow 2: Manual Intelligence Collection

[Analyst Report] --> [Manual Event Creation] --> [Attribute Addition] --> [Enrichment]
                                                                              |
                                                                              v
                                                                    [Galaxy Tagging]
                                                                              |
                                                                              v
                                                                    [Publication]

Steps:

1. Event Creation: Create event with descriptive info, date, distribution, TLP tag
2. IOC Entry: Add attributes (IP, domain, hash, URL) with correct category and type
3. Object Construction: Group related attributes into MISP objects (file, domain-ip, email)
4. Galaxy Linking: Link event to MITRE ATT&CK techniques, threat actor clusters, malware families
5. Enrichment: Use MISP modules (VirusTotal, Shodan, CIRCL PassiveDNS) to enrich attributes
6. Review and Publish: Analyst reviews, sets to_ids flags, publishes for community sharing

Workflow 3: TAXII Feed Integration

[TAXII Server] --> [TAXII Client] --> [STIX Parser] --> [MISP Import] --> [Correlation]

Steps:

1. Discovery: Query TAXII server discovery endpoint for available API roots
2. Collection Enumeration: List available collections and their metadata
3. Object Retrieval: Fetch STIX 2.1 objects from collections with pagination
4. STIX-to-MISP Mapping: Map STIX Indicator, Malware, Threat Actor to MISP event/attributes
5. Import: Create MISP events from STIX bundles
6. Correlation: Run correlation against existing MISP data

Workflow 4: Instance Synchronization

[MISP Instance A] <--sync--> [MISP Instance B] <--sync--> [MISP Instance C]
       |                              |                            |
       v                              v                            v
  [Org A Events]              [Shared Events]               [Org C Events]

Steps:

1. Server Registration: Register remote MISP instance with URL, API key, organization
2. Sync Configuration: Set sync direction (push/pull), filter rules, preview mode
3. Pull Sync: Pull events from remote instance matching filter criteria
4. Push Sync: Push local events to remote instance based on distribution level
5. Conflict Resolution: Handle attribute conflicts with priority rules
6. Audit Logging: Log all sync activities for compliance and troubleshooting

Workflow 5: IOC Export for Defensive Tools

[MISP Events] --> [Export Module] --> [Format Conversion] --> [Defensive Tool]
                                             |
                                    +--------+--------+
                                    |        |        |
                                    v        v        v
                              [Suricata] [Bro/Zeek] [SIEM]
                               Rules     Intel      CSV/JSON

Steps:

1. Filter Selection: Select events by tag, date range, threat level, to_ids flag
2. Format Selection: Choose output format (Suricata, Snort, Bro/Zeek, CSV, STIX, OpenIOC)
3. Rule Generation: Generate IDS/IPS rules from network IOCs
4. SIEM Export: Export to CSV/JSON for SIEM ingestion (Splunk, Elastic, QRadar)
5. Automation: Set up ZMQ/Kafka publishing for real-time IOC distribution
6. Feedback Loop: Track hit counts on exported IOCs, feed back to MISP for scoring