http://open-source-security-software.net/news.atom 2024-04-27T10:27:57.990904+00:00 python-feedgen https://www.misp-project.org/2021/04/27/MISP.2.4.142.released.html/ 2021-04-27T01:00:00+00:00 MISP 2.4.142 released MISP 2.4.142 released including many new features, a security fix and a long list of quality of life improvements. 2021-04-27T01:00:00+00:00 tag:www.monarc.lu,2021-05-12:/news/2021/05/12/monarc-2103-released/ 2021-05-11T23:00:00+00:00 <p>Release 2.10.3 of <span class="caps">MONARC</span></p> 2021-05-11T23:00:00+00:00 https://www.misp-project.org/2021/05/15/MISP.2.4.143.released 2021-05-14T23:00:00+00:00 <h1 id="misp-24143-released">MISP 2.4.143 released</h1> <p>MISP 2.4.143 released including a new audit subsystem, various quality of life improvements and bug fixes.</p> <h1 id="10-year-anniversary">10 year anniversary</h1> <p><a href="https://twitter.com/MISPProject/status/1393141380369821697">MISP has, as of the 15th of May, turned 10,</a> to celebrate the occasion we have a celebratory MISP logo acting as a temporary replacement of the usual one for the duration of this release.</p> <p>It has been a long road since Christophe Vandeplas released the initial version of CyDefsig (later renamed to MISP) in 2011. We would hereby like to thank all contributors and supporters for making MISP what it is today. Looking back at how the tooling and the communities evolved over the decade, we can see how threats and threat intelligence has changed and evolved over the years, molding the platform in the process. Here’s to at least another 10 years of active sharing and bringing communities together!</p> <h1 id="new-audit-system">New audit system</h1> <p>Thanks to @JakubOnderka, we now have a whole new audit system, storing relevant audit logs in a more concise yet easily machine-parsable way (all changes will be logged as JSON objects). This feature is disabled by default and needs to be enabled in the server settings, though keep in mind that it will not convert existing entries. Especially for new instances, we highly recommend switching to the new system!</p> <h1 id="event-republish-alert-flood-protection">Event republish-alert flood protection</h1> <p>As our communities grow and we all build our own internal tooling for processing data in MISP, the more likely it is to run into some slightly frustrating issues. One such issue we’ve encountered recently came from a tool that seems to have regularly (and frequently!) modified certain events and republished them consecutively. This in itself is not an issue, however, it can generate a lot of noise in terms of alert emails. We have now added a protective measure to counter this, make sure you have a look at the appropriate settings to create lockout timers for alerts that can be issued for a single event.</p> <h1 id="improvements">Improvements</h1> <ul> <li>Event report hints autocomplete while typing in the Markdown has been improved</li> <li>Server rules element improved</li> <li>MISP modules results now point to the original object itself</li> </ul> <h1 id="misp-modules">MISP Modules</h1> <p>Two new MISP modules were introduced:</p> <ul> <li>cof2misp module to allow the import of Passive DNS in <a href="https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-08.html">JSON COF Format</a> into MISP</li> <li>An improved <a href="https://github.com/MISP/misp-modules/blob/main/misp_modules/modules/expansion/onyphe.py">onyphe module</a> to do expansion in MISP with full MISP object support</li> </ul> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-05-14T23:00:00+00:00 https://www.misp-project.org/2021/05/15/MISP.2.4.143.released.html/ 2021-05-15T01:00:00+00:00 MISP 2.4.143 released MISP 2.4.143 released including a new audit subsystem, various quality of life improvements and bug fixes. 10 year anniversary MISP has, as of the 15th of May, turned 10, to celebrate the occasion we have a celebratory MISP logo acting as a temporary replacement of the usual one for the duration of this release. 2021-05-15T01:00:00+00:00 https://www.misp-project.org/2021/06/07/MISP.2.4.144.released 2021-06-06T23:00:00+00:00 <h1 id="misp-24144-released">MISP 2.4.144 released</h1> <p>MISP 2.4.144 released including a massive update to the documentation along with <a href="https://www.cycat.org/">CyCAT.org</a> integration, improvements and fixes including security related fixes.</p> <h1 id="openapi-integration">OpenAPI integration</h1> <p>We have a new core team member at MISP Project, Luciano (@righel), who kicked off his tenure with an impressive mapping of all the most important endpoints of MISP to OpenAPI. As of this release, the API documentation is directly available in MISP, along with example payloads and responses. You can also find <a href="https://www.misp-project.org/documentation/openapi.html">this information directly on the misp-project website</a>. To all integrators and developers wrangling with the API, we highly recommend you take a look at the API menu in MISP and we wish you happy and headache-free hacking!</p> <h1 id="new-diagrams-and-descriptions">New diagrams and descriptions</h1> <p>Thanks to the thorough investigations of @mokaddem, we now have the entire synchronisation and authentication flows of MISP mapped in an easy to understand graph - both of these are included as of now directly in your MISP installation, so if you’re in doubt about what’s going on under the hood, but don’t feel adventurous enough to replace your night time reading materials with a hefty chunk of PHP code, have a look at the new graphs!</p> <ul> <li><a href="https://github.com/MISP/MISP/tree/2.4/docs/generic/Authentication%20Diagram">Authentication Diagram</a></li> <li><a href="https://github.com/MISP/MISP/tree/2.4/docs/generic/Synchronisation">Data visibility for Sync-users and MISP synchronisation</a></li> </ul> <h1 id="cycat-integration-v1">CyCAT integration v1</h1> <p><img src="https://www.misp-project.org/assets/images/misp/blog/cycat-misp.png" alt="MISP and CyCAT integration" /></p> <p>CyCAT is a new initiative built by a group of individuals with the aim of cataloguing all the techniques and libraries around cyber-security, mostly with the selfish desire to make their own confusing lives easier (along with all those that are in a similar situation). As of this release, you’ll be able to enable a first version of the CyCAT integration in MISP directly, allowing you to directly see relations to your galaxy clusters via CyCAT’s own relationship system, giving you an extra layer of background information with the clusters already in use.</p> <p>If you are interested in CyCAT and what it can do for you, head over to the <a href="https://cycat.org/">CyCAT website</a>.</p> <p>To enable the CyCAT integration, got to the Plugin settings <img src="https://www.misp-project.org/assets/images/misp/blog/cycat-enabled.png" alt="" /> and enable the feature.</p> <h1 id="improvements">Improvements</h1> <ul> <li>Various quality of life improvements and bug fixes, related to synchronisation, sharing groups, event reports and more!</li> <li>A security fix that would under certain circumstances result in attributes of an object being misassociated to the wrong sharing group after synchronisation. A massive thank you to Jeroen Pinoy for his diligent work in uncovering this issue!</li> </ul> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-06-06T23:00:00+00:00 https://www.misp-project.org/2021/06/07/MISP.2.4.144.released.html/ 2021-06-07T01:00:00+00:00 MISP 2.4.144 released MISP 2.4.144 released including a massive update to the documentation along with CyCAT.org integration, improvements and fixes including security related fixes. 2021-06-07T01:00:00+00:00 tag:www.monarc.lu,2021-06-24:/news/2021/06/24/monarc-2104-released/ 2021-06-23T23:00:00+00:00 <p>Release 2.10.4 of <span class="caps">MONARC</span></p> 2021-06-23T23:00:00+00:00 https://www.misp-project.org/2021/07/05/MISP.2.4.145-and-2.4.146.released 2021-07-04T23:00:00+00:00 <h1 id="misp-24145-and-24146-released">MISP 2.4.145 and 2.4.146 released</h1> <p>MISP 2.4.145 and 2.4.146 released including a massive update to the MISP warning-lists, various improvements and security fixes.</p> <h1 id="misp-warning-lists-improvements">MISP warning-lists improvements.</h1> <p><a href="https://github.com/misp/misp-warninglists">Warning lists</a> system has been significantly improved (thanks to Jakub Onderka).</p> <ul> <li>Custom warning lists can be created and managed in the MISP user-interface</li> <li>Warning lists can be now imported via the API</li> <li>Warning lists changes are exported in the ZMQ channel</li> <li>Warning lists include new categories to describe the scope</li> </ul> <h1 id="new-features">New features</h1> <h2 id="summary-email-notification">Summary email notification</h2> <p>Email notifications have received a new configuration setting: New event summaries only. This feature publishes the normal alert reports excluding attributes and objects, thereby only describing a summary of the alert. This can be used when encryption cannot be enabled and organisations still require email alerting.</p> <h2 id="documentation">Documentation</h2> <p>New documentation has been added to describe the <a href="https://raw.githubusercontent.com/MISP/MISP/2.4/docs/generic/Authentication%20Diagram/MISP%20Authentication%20Diagram.png">session and cookie handling in MISP</a>.</p> <h2 id="api">API</h2> <ul> <li>Thanks to a new feature, you can now create read only authentication keys (don’t forget to enable the advanced authentication key feature for this to work).</li> </ul> <h1 id="security-fixes">Security Fixes</h1> <ul> <li>Various fixes regarding XSS and potential escaping issues including <a href="https://cvepremium.circl.lu/cve/CVE-2021-35502">CVE-2021-35502</a>.</li> </ul> <p>Thanks to the reporters including Nicolas Vidal from TEHTRIS.</p> <h1 id="various-improvements">Various improvements</h1> <ul> <li>[OpenAPI] - Missing return formats added to the documentation</li> <li>[server caching] only push data to redis / logs if there’s something to push</li> <li>[attribute] validation tightened for empty strings. A value containing only control characters will now be blocked from entry.</li> <li>[feeds] Added 3 daily feeds (ssh bruteforce, telnet bruteforce, URLs seen) from the APNIC Community Honeynet Project</li> </ul> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-07-04T23:00:00+00:00 https://www.misp-project.org/2021/07/05/MISP.2.4.145-and-2.4.146.released.html/ 2021-07-05T01:00:00+00:00 MISP 2.4.145 and 2.4.146 released MISP 2.4.145 and 2.4.146 released including a massive update to the MISP warning-lists, various improvements and security fixes. 2021-07-05T01:00:00+00:00 https://www.misp-project.org/2021/07/27/MISP.2.4.147.released 2021-07-26T23:00:00+00:00 <h1 id="misp-24147-released">MISP 2.4.147 released</h1> <p>MISP 2.4.147 released including a massive number of small improvements, bug and security fixes. We strongly recommend all MISP users to upgrade as soon as possible. This release fixes <a href="https://cvepremium.circl.lu/cve/CVE-2021-37534">CVE-2021-37534</a>.</p> <h1 id="sync-improvements">Sync improvements</h1> <p>Many improvements were done in the synchronisation such as:</p> <ul> <li>When saving sightings, only push the new sightings.</li> <li>Filter out existing sightings if remote sever supports that method.</li> <li>Check if event exists before pushing.</li> <li>Check event existence before pushing sightings.</li> <li>Optimise event filtering.</li> </ul> <h1 id="apicli">API/CLI</h1> <p>Many improvements in the API and CLI.</p> <p>This release also includes refactoring of various forms to support future major improvements in MISP.</p> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-07-26T23:00:00+00:00 https://www.misp-project.org/2021/07/27/MISP.2.4.147.released.html/ 2021-07-27T01:00:00+00:00 MISP 2.4.147 released MISP 2.4.147 released including a massive number of small improvements, bug and security fixes. We strongly recommend all MISP users to upgrade as soon as possible. 2021-07-27T01:00:00+00:00 https://www.misp-project.org/2021/08/09/MISP.2.4.148.released 2021-08-08T23:00:00+00:00 <h1 id="misp-24148-released">MISP 2.4.148 released</h1> <p>MISP 2.4.148 released including many bugs fixed along with security fixes. This release fixes <a href="https://cvepremium.circl.lu/cve/CVE-2021-37742">CVE-2021-37742</a> and <a href="https://cvepremium.circl.lu/cve/CVE-2021-37743">CVE-2021-37743</a>.</p> <h1 id="new-feature">New feature</h1> <ul> <li>added option to block organisation changes at login on ApacheShibbAuth</li> <li>Open data export has been refactored</li> <li>Fix Suricata export concerning sticky buffers</li> <li>ZMQ now includes misp_json_warninglist topic in the pub-sub channels</li> </ul> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-08-08T23:00:00+00:00 https://www.misp-project.org/2021/08/09/MISP.2.4.148.released.html/ 2021-08-09T01:00:00+00:00 MISP 2.4.148 released MISP 2.4.148 released including many bugs fixed along with security fixes. This release fixes CVE-2021-37742 and CVE-2021-37743. 2021-08-09T01:00:00+00:00 tag:www.monarc.lu,2021-09-02:/news/2021/09/02/monarc-2110-released/ 2021-09-01T23:00:00+00:00 <p>Release 2.11.0 of <span class="caps">MONARC</span></p> 2021-09-01T23:00:00+00:00 https://www.misp-project.org/2021/10/11/MISP.2.4.149.released 2021-10-10T23:00:00+00:00 <h1 id="misp-24149-released">MISP 2.4.149 released</h1> <p>MISP 2.4.149 released including many bugs fixed along with some new and improved functionalities</p> <h1 id="new-features">New features</h1> <ul> <li>First stage of a massive rework of our STIX integration</li> <li>Various improvements to the integration with Cerebrate</li> </ul> <h1 id="new-stix-libraries">New STIX libraries</h1> <ul> <li>The first version of a long ongoing project to rework our entire STIX integration has finally been merged, thanks to the tireless work of @chrisr3d</li> <li>Our converter libraries have embarked on a path of their own, becoming a standalone repository included by default in MISP, but also serving as a useful tool for anyone looking for a clean way of converting between the <a href="https://www.misp-standard.org/">MISP standard format</a> and various STIX versions (1.1.1, 1.2, 2.0, 2.1).</li> <li>The libraries are still work in progress, but continuously improved, follow <a href="https://github.com/MISP/misp-stix">misp-stix</a></li> <li>Included is also a detailed documentation, which also serves as a knowledge base for the mapping between the two formats, available under the <a href="https://github.com/MISP/misp-stix/tree/main/documentation">documentation</a> sub-directory</li> <li>From this release on, you have more control over which STIX version is used when exporting STIX data from MISP, by specifying the “stix_version” to be returned (supported versions for STIX 1: 1.1.1 and 1.2. For STIX 2: 2.0 and 2.1)</li> </ul> <h1 id="cerebrate-integration">Cerebrate integration</h1> <ul> <li>Allow the fetching of sharing group data from Cerebrate instances, our new open source tool in development aiming to solve a host of issues revolving around community management and orchestration. Our first official release of the tool is scheduled for the MISP summit coming up this month</li> <li>To follow the cerebrate project, head over to its <a href="https://github.com/cerebrate-project/cerebrate">github page</a></li> <li>For the MISP summit to be held on the 21st of October, don’t forget to watch the <a href="https://www.misp-project.org/misp-summit">misp-summit</a>. You can still apply for the <a href="https://cfp.hack.lu/misp-2021/cfp">Call-for-Presentation</a>.</li> </ul> <h1 id="mail2misp-release-10">mail2misp release 1.0</h1> <p>First <a href="https://github.com/MISP/mail_to_misp/releases/tag/v1.0">official release 1.0 of mail2misp</a>, it’s a tool to connect your mail infrastructure to MISP to create events based on the information contained within mail. The solution can be also used to feed MISP instance with honeypot receiving emails.</p> <h1 id="various-improvements">Various improvements</h1> <ul> <li>A long list of improvements, massive thanks to @JakubOnderka for the continuous stream of improvements and quality of life changes</li> <li>Thanks to the work of @righel, our <a href="https://www.misp-project.org/documentation/openapi.html">OpenAPI documentation</a> is becoming more and more complete, now covering a long list of the more exotic endpoints and options</li> </ul> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-10-10T23:00:00+00:00 https://www.misp-project.org/2021/10/11/MISP.2.4.149.released.html/ 2021-10-11T01:00:00+00:00 MISP 2.4.149 released MISP 2.4.149 released including many bugs fixed along with some new and improved functionalities New features First stage of a massive rework of our STIX integration Various improvements to the integration with Cerebrate New STIX libraries The first version of a long ongoing project to rework our entire STIX integration has finally been merged, thanks to the tireless work of @chrisr3d Our converter libraries have embarked on a path of their own, becoming a standalone repository included by default in MISP, but also serving as a useful tool for anyone looking for a clean way of converting between the MISP standard format and various STIX versions (1. 2021-10-11T01:00:00+00:00 https://www.misp-project.org/2021/10/12/MISP.2.4.150 2021-10-11T23:00:00+00:00 <h1 id="misp-24150-released">MISP 2.4.150 released</h1> <p>MISP 2.4.150 released, including a new CA bundle to combat the issues with the Letsencrypt root CA expiration. This is a follow-up release to 2.4.149 and has no other major changes besides pointing to our own repository of the framework that includes the new CA bundle.</p> <h1 id="sync-issues-due-to-the-expiration-of-a-letsencrypt-root-ca">Sync issues due to the expiration of a Letsencrypt root CA</h1> <p>As described in their <a href="https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/#:~:text=On%20September%2030%202021%2C%20there,accept%20your%20Let's%20Encrypt%20certificate">blog post</a>, Letsencrpyt had to retire an old Root CA, meaning that that SSL connections when synchronising MISP with other instances would fail if the remote side used letsencrypt. This update includes a new CA bundle that should help you avoid any issues with this.# Acknowledgement</p> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-10-11T23:00:00+00:00 https://www.misp-project.org/2021/10/12/MISP.2.4.150.html/ 2021-10-12T01:00:00+00:00 MISP 2.4.150 released MISP 2.4.150 released, including a new CA bundle to combat the issues with the Letsencrypt root CA expiration. 2021-10-12T01:00:00+00:00 tag:www.monarc.lu,2021-10-28:/news/2021/10/28/monarc-2111-released/ 2021-10-27T23:00:00+00:00 <p>Release 2.11.1 of <span class="caps">MONARC</span></p> 2021-10-27T23:00:00+00:00 https://www.misp-project.org/2021/11/23/MISP.2.4.151.released 2021-11-22T23:00:00+00:00 <h1 id="misp-24151-released">MISP 2.4.151 released</h1> <p>MISP 2.4.151 released including a host of bug fixes and a bunch of new features</p> <h1 id="new-features">New features</h1> <ul> <li>New background processor by @righel</li> <li>Improvements to the CLI tools</li> <li>Bug fixes and improvements</li> </ul> <h1 id="new-background-processor">New background processor</h1> <ul> <li>MISP has been using CakeResque for its background jobs for the better part of a decade. Whilst it has served us well, the library has been stale for a long time and carries a (for us) unnecessary complexity and is generally the most difficult part of the application to debug</li> <li>Luciano “@righel” Righetti has implemented a completely new, compatible background processing engine using Supervisord</li> <li>Queue and execute jobs the same way as you are used to from before, monitor worker progress via the tools provided by supervisord in addition to MISP</li> <li>No scheduling capabilities, these were an unnecessary overhead for us before as we relied on corn jobs as our preferred scheduling mechanism anyway</li> <li>Expect more improvements to this library over the course of the next months, but feel free to switch to using it already now</li> <li>Currently it is completely optional and the old background processor will still be supported for a while</li> <li>Be aware that manual setup steps are required to get the new processor working, refer to <a href="https://gist.github.com/righel/8ebc6c84341f2aea7d0bfa124e535ef8">the upgrade guide</a> on the procedure, if you decide to start using it already now</li> </ul> <h1 id="various-cli-changes">Various CLI changes</h1> <ul> <li>Jakub Onderka has been doing a fair bit of refactoring and improvement of the CLI libraries</li> <li>additional administrative tools added to help monitor and manage your MISP instance (such as redis memory diagnostics, mysql table optimisation tool, etc)</li> </ul> <h1 id="option-to-move-the-system-settings-to-the-database">Option to move the system settings to the database</h1> <ul> <li>Traditionally all system config settings were stored in the config.php file, with a new configuration thanks to Jakub Onderka’s implementation the settings can be moved to the database rather than the file.</li> <li>This should help with persistence for containerised installations</li> </ul> <h1 id="various-improvements">Various improvements</h1> <ul> <li>The previous version introduced a new STIX library as a replacement for the old one. This change did end up causing some update issues for some installations, the built in updater is now aware of this change and should allow you to easily update via the UI/API updater, with the new STIX library working as intended</li> <li>A long list of improvements, thanks to all contributors! For a detailed list of changes, head over to the <a href="https://www.misp-project.org/Changelog.txt">changelog</a></li> </ul> <h1 id="misp-modules">MISP Modules</h1> <ul> <li>New <a href="https://github.com/D4-project/passive-ssh">Passive SSH expansion</a> expansion module.</li> <li>Updated <a href="https://misp.github.io/misp-modules/expansion/#recordedfuture">Recorded Future</a> expansion module included links and related data.</li> <li>New <a href="https://circl.lu/services/hashlookup/">CIRCL hashlookup expansion</a> module added.</li> </ul> <p>The <a href="https://www.misp-project.org/Changelog-misp-modules.txt">MISP modules changelog is available</a>.</p> <h1 id="misp-taxonomies">MISP Taxonomies</h1> <ul> <li>Updated taxonomies for <a href="https://www.misp-project.org/taxonomies.html#_interactive_cyber_training_audience">Interactive Cyber Training setup and environment</a>.</li> <li>Updated <a href="https://www.misp-project.org/taxonomies.html#_fr_classif">fr-classification</a> to match IGI1300.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-taxonomies.txt">MISP Taxonomies changelog</a> is available.</p> <h1 id="misp-galaxy">MISP Galaxy</h1> <ul> <li>Updated to MITRE ATT&amp;CK version 10.</li> <li>Multiple updates in malpedia, threat actor galaxy and Office 365 techniques.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-galaxy.txt">MISP Galaxy changelog</a></p> <h1 id="misp-objects">MISP Objects</h1> <ul> <li>New JA3 server object added.</li> <li>New Security playbook object added.</li> <li>New submarine object added</li> <li>New Passive SSH object added.</li> <li>Updated device object.</li> <li>New hashlookup object added.</li> <li>New edr-report object added.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-objects.txt">MISP objects changelog</a></p> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements.</p> 2021-11-22T23:00:00+00:00 https://www.misp-project.org/2021/11/23/MISP.2.4.151.released.html/ 2021-11-23T00:00:00+00:00 MISP 2.4.151 released MISP 2.4.151 released including a host of bug fixes and a bunch of new features New features New background processor by @righel Improvements to the CLI tools Bug fixes and improvements New background processor MISP has been using CakeResque for its background jobs for the better part of a decade. 2021-11-23T00:00:00+00:00 https://www.misp-project.org/2021/12/22/MISP.2.4.152.released 2021-12-21T23:00:00+00:00 <h1 id="misp-24152-released">MISP 2.4.152 released</h1> <p>MISP 2.4.152 released with timeline improvements, optional filtering on sync, LinOTP improvements and more.</p> <p>The LinOTP authentication module has been improved to include a mixed mode where both OTP and MISP’s usual password authentication can be used together.</p> <p>The timelining has been improved in several ways, such as the inclusion of images from objects, as well as various improvements in the timeline’s sighting view. Several bugs were affecting this feature have also been fixed.</p> <p>A new optional synchronisation filtering has been added to allow for the removal of specific attribute or object types when syncing. The functionality is meant to be used by the final recipient organisations of a synchronisation chain, in order to filter out specific types of information due to legal or specific internal policies. The filtering feature is disabled by default and needs to be enabled in the general configuration. This feature is for ISACs or consumer organisations, not redistributing information to other MISP communities.</p> <p>A new STIX 1 and 2 export for attribute restSearch has been added in complement to the existing event export in STIX 1 and 2. The export works just like the other event level STIX export, all you need to do is specify the given STIX format as the return type when querying the attribute restSearch endpoint.</p> <p>Many internal improvements and bugs fixed.</p> <h1 id="misp-modules">MISP Modules</h1> <ul> <li>New <a href="https://misp.github.io/misp-modules/expansion/#qintel_qsentry">Qintel sentry module</a> added.</li> <li><a href="https://circl.lu/services/hashlookup/">CIRCL hashlookup expansion</a> SHA-256 support added.</li> </ul> <p>The <a href="https://www.misp-project.org/Changelog-misp-modules.txt">MISP modules changelog is available</a>.</p> <h1 id="misp-taxonomies">MISP Taxonomies</h1> <ul> <li>New <a href="https://www.misp-project.org/taxonomies.html#_political_spectrum">political spectrum taxonomy</a> added.</li> <li>Improvement in exercise taxonomy.</li> <li>New <a href="https://www.misp-project.org/taxonomies.html#_deception">deception taxonomy</a> added.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-taxonomies.txt">MISP Taxonomies changelog</a> is available.</p> <h1 id="misp-galaxy">MISP Galaxy</h1> <ul> <li>New matrix <a href="https://www.misp-project.org/galaxy.html#_concordia_mobile_modelling_framework_attack_pattern">CONCORDIA Mobile Modelling Framework - Attack Pattern</a> added (thanks to <a href="https://www.concordia-h2020.eu/">Concordia H2020 project</a>).</li> <li>Many update in threat actor, RAT and tools galaxy.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-galaxy.txt">MISP Galaxy changelog</a></p> <h1 id="misp-objects">MISP Objects</h1> <ul> <li>New Concordia intrusion set object.</li> <li>New temporal event object.</li> <li>Many improvements in user, person, postal-address, email object.</li> <li>New relationships added such as <code class="language-plaintext highlighter-rouge">found-in</code>, <code class="language-plaintext highlighter-rouge">works-with</code>, <code class="language-plaintext highlighter-rouge">drives</code>.</li> </ul> <p><a href="https://www.misp-project.org/Changelog-misp-objects.txt">MISP objects changelog</a></p> <h1 id="acknowledgement">Acknowledgement</h1> <p>We would like to thank all the <a href="https://www.misp-project.org/contributors">contributors</a>, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in <a href="https://www.misp-project.org/objects.html">misp-objects</a>, <a href="https://www.misp-project.org/taxonomies.html">misp-taxonomies</a> and <a href="https://www.misp-project.org/galaxy.html">misp-galaxy</a> .</p> <p>As always, a detailed and <a href="https://www.misp-project.org/Changelog.txt">complete changelog is available</a> with all the fixes, changes and improvements in MISP core.</p> 2021-12-21T23:00:00+00:00 https://www.misp-project.org/2021/12/22/MISP.2.4.152.released.html/ 2021-12-22T00:00:00+00:00 MISP 2.4.152 released MISP 2.4.152 released with timeline improvements, optional filtering on sync, LinOTP improvements and more. The LinOTP authentication module has been improved to include a mixed mode where both OTP and MISP&rsquo;s usual password authentication can be used together. 2021-12-22T00:00:00+00:00 https://www.misp-project.org/contributing/ 2022-02-02T05:00:03.864940+00:00 Contributing to MISP Project MISP project is a large free software project composed of multiple sub-projects which are contributed by different contributors who are generally active users of the MISP project. 2022-02-02T05:00:03.864940+00:00 https://www.misp-project.org/covid-19-misp/ 2022-02-02T05:00:03.869208+00:00 COVID-19 MISP Information Sharing Community COVID-19 MISP is a MISP instance retrofitted for a COVID-19 information sharing community, focusing on two areas of sharing: 2022-02-02T05:00:03.869208+00:00 https://www.misp-project.org/download/ 2022-02-02T05:00:03.873695+00:00 Download and Install MISP MISP source code is available on GitHub including documentation and scripts for installation. ChangeLog contains a detailed list of updates for each software release in the core of the MISP software. 2022-02-02T05:00:03.873695+00:00 https://www.misp-project.org/events/ 2022-02-02T05:00:03.877932+00:00 MISP Events Want to join us at an event, discuss opportunities or projects around the MISP project, share your experience about threat intelligence or discuss how MISP could be improved to support security professionals? 2022-02-02T05:00:03.877932+00:00 https://www.misp-project.org/events-webinar/ 2022-02-02T05:00:03.882208+00:00 CRAWL, WALK, RUN series – Farsight Security / MISP webinars In this three-parts webinar series Farsight Security and CIRCL will provide an overview of Farsight’s Passive DNS data, how historical Passive DNS objective observations can be used to uncover malicious activities going back in time. 2022-02-02T05:00:03.882208+00:00 https://www.misp-project.org/support/ 2022-02-02T05:00:03.899911+00:00 Help, Support, and Forums Help and support for MISP is available from the documentation, GitHub issues, and Gitter rooms which are explained below. 2022-02-02T05:00:03.899911+00:00 https://www.misp-project.org/compliance/NISD/ 2022-02-02T05:00:03.904213+00:00 How MISP enables stakeholders identified by the NISD to perform key activities Network and Information Security (NIS) means ‘the ability of a network or an information system to resist accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of data and the related services’ . 2022-02-02T05:00:03.904213+00:00 https://www.misp-project.org/compliance/GDPR/ 2022-02-02T05:00:03.908402+00:00 Information sharing and cooperation enabled by GDPR Version: 1.1 - Tuesday, 30 January 2018 Introduction The General Data Protection Regulation (GDPR) aims to reduce legal uncertainty and limit the interpretations by setting out clear rules and conditions for the processing and sharing of personal data as well as the protection of natural persons with regard to the processing of personal data. 2022-02-02T05:00:03.908402+00:00 https://www.misp-project.org/compliance/ISO-IEC-27010/ 2022-02-02T05:00:03.912924+00:00 MISP as supporting platform for sharing information, following ISO/IEC 27010:2015 Malicious cyber actors are becoming more organised, growing smarter and becoming more sophisticated, which is rendering traditional defence methods and tools significantly less effective in dealing with the constantly new threats appearing on the horizon. 2022-02-02T05:00:03.912924+00:00 https://www.misp-project.org/communities/ 2022-02-02T05:00:03.917196+00:00 MISP Communities MISP is an open source software and it is also a large community of MISP users creating, maintaining and operating communities of users or organizations sharing information about threats or cyber security indicators worldwide. 2022-02-02T05:00:03.917196+00:00 https://www.misp-project.org/contributors/ 2022-02-02T05:00:03.921541+00:00 Contributors Top contributors per commit MISP The repository MISP is part of the MISP project and has the following top contributors 2022-02-02T05:00:03.921541+00:00 https://www.misp-project.org/datamodels/ 2022-02-02T05:00:03.926124+00:00 MISP is not only a software but also a series of data models created by the MISP community. MISP includes a simple and practical information sharing format expressed in JSON that can be used with MISP software or by any other software. 2022-02-02T05:00:03.926124+00:00 https://www.misp-project.org/feeds/ 2022-02-02T05:00:03.930510+00:00 MISP includes a set of public OSINT feeds in its default configuration. The feeds can be used as a source of correlations for all of your events and attributes without the need to import them directly into your system. 2022-02-02T05:00:03.930510+00:00 https://www.misp-project.org/documentation/ 2022-02-02T05:00:03.934867+00:00 MISP Documentation The MISP documentation is maintained in the misp-book project. The documentation is in git book format and we welcome contribution. 2022-02-02T05:00:03.934867+00:00 https://www.misp-project.org/features/ 2022-02-02T05:00:03.939443+00:00 Features of MISP, the open source threat sharing platform. A threat intelligence platform for sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counter-terrorism information. 2022-02-02T05:00:03.939443+00:00 https://www.misp-project.org/governance/ 2022-02-02T05:00:03.943766+00:00 MISP Model of Governance MISP project is a large open source project with the goal to make viable tools and format to improve information sharing at large. 2022-02-02T05:00:03.943766+00:00 https://www.misp-project.org/openapi/ 2022-02-02T05:00:03.948076+00:00 2022-02-02T05:00:03.948076+00:00 https://www.misp-project.org/professional-services/ 2022-02-02T05:00:03.952628+00:00 MISP Professional Services (MPS) is a program handled by the lead developers of MISP Project, in order to offer highly skilled services around MISP and to support the sustainability of the MISP project. 2022-02-02T05:00:03.952628+00:00 https://www.misp-project.org/license/ 2022-02-02T05:00:03.957044+00:00 MISP, Overview of the licenses used in the MISP Project (software, libraries and knowledge base) The MISP project is a large open source project, aiming to support and improve information sharing and threat intelligence analysis at large. 2022-02-02T05:00:03.957044+00:00 https://www.misp-project.org/press/ 2022-02-02T05:00:03.961379+00:00 Announcements and press releases The general purpose announcements that we publish are available on the news page. Write us an email at info@misp-project. 2022-02-02T05:00:03.961379+00:00 https://www.misp-project.org/research-projects/ 2022-02-02T05:00:03.969911+00:00 Project (1) Pauline Bourmeau - The Social Perspective in the Intelligence Activity among Information Sharing Communities - CNAM Paris (Supervisor Philippe Baumard). 2022-02-02T05:00:03.969911+00:00 https://www.misp-project.org/hackathon/ 2022-02-02T05:00:03.974142+00:00 Open Source Security hackathon - Monday 25th October 2021 and Tuesday 26th October 2021 CIRCL in collaboration with the MISP Project is organising the 5th Open Source Security Software Hackathon, which will take place over two days, on Monday 25th October 2021 and Tuesday 26th October 2021. 2022-02-02T05:00:03.974142+00:00 https://www.misp-project.org/security/ 2022-02-02T05:00:03.978495+00:00 Reporting security vulnerabilities for MISP or related MISP project repositories Reporting security vulnerabilities is of great importance for us, as MISP is used in multiple critical infrastructures. 2022-02-02T05:00:03.978495+00:00 https://www.misp-project.org/tools/ 2022-02-02T05:00:03.982985+00:00 Software and Tools Many open source and proprietary tools integrate MISP support (MISP format or API) in order to extend their tools or MISP itself. 2022-02-02T05:00:03.982985+00:00 https://www.misp-project.org/misp-summit/ 2022-02-02T05:00:03.987122+00:00 Virtual MISP Summit 0x06 - Thursday 21st October 2021 On Thursday 21st October 2021, the 6th MISP summit will take place online. 2022-02-02T05:00:03.987122+00:00 https://www.misp-project.org/who/ 2022-02-02T05:00:03.991277+00:00 Who is behind the MISP project? The core team behind the MISP project is composed of motivated people who think that information sharing can be improved and supported by creating practical open source tools, open format and practises. 2022-02-02T05:00:03.991277+00:00 https://www.misp-project.org/2022/02/04/MISP.2.4.153.released.html/ 2022-02-04T00:00:00+00:00 MISP 2.4.153 released MISP UI translation in Thai added. Improved the debugging of the synchronisation, including more meaningful messages in debug logs. 2022-02-04T00:00:00+00:00 https://www.misp-project.org/commercial-support/ 2022-02-08T05:00:03.423943+00:00 MISP Commercial Support is an overview of trusted commercial partners providing support for MISP. MISP project also provides MISP Professional Services (MSP) if you want to directly support the MISP project and ensure its sustainability. 2022-02-08T05:00:03.423943+00:00 https://www.misp-project.org/2022/03/02/MISP.2.4.154.released.html/ 2022-03-02T00:00:00+00:00 MISP 2.4.154 released with a host of new features and fixes, including some new tools that help us navigate the current geo-political landscape when sharing information. 2022-03-02T00:00:00+00:00 https://www.misp-project.org/2022/03/03/MISP.2.4.155.released.html/ 2022-03-03T00:00:00+00:00 This release is a rapid follow up to v2.4.154, addressing several rather annoying issues Bugfixes Various bugfixes to the sharing group blueprint system (especially to it being more restrictive than intended) Updating the DB schema to avoid the diagnostics complaining Fixed an issue with organisation meta fields defaulting to null rather than &rsquo;&rsquo; (causing the blueprint issue mentioned above) Rework of the DB schema dumper Fixes to the Kali Linux installer Acknowledgement We would like to thank all the contributors, reporters and users who have helped us in the past months to improve MISP and information sharing at large. 2022-03-03T00:00:00+00:00 https://www.misp-project.org/2022/03/18/MISP.2.4.156.released.html/ 2022-03-18T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.156 - a release bringing several new features and fixes two critical vulnerabilities. 2022-03-18T00:00:00+00:00 https://www.misp-project.org/2022/03/25/MISP.2.4.157.released.html/ 2022-03-25T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.157, following a series of bug fixes as a quick follow up to 2. 2022-03-25T00:00:00+00:00 https://www.misp-project.org/2022/04/20/MISP.2.4.158.released.html/ 2022-04-20T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.158. This release includes a series of security fixes and as such we highly encourage everyone to update to this version as soon as possible. 2022-04-20T01:00:00+00:00 https://www.misp-project.org/2022/05/30/MISP.2.4.159.released.html/ 2022-05-30T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.159. This releases includes many improvements, bug fixes and improvements concerning performance on large datasets. 2022-05-30T01:00:00+00:00 tag:www.monarc.lu,2022-06-22:/news/2022/06/22/monarc-2121-released/ 2022-06-21T23:00:00+00:00 <p>Release 2.12.1 of <span class="caps">MONARC</span></p> 2022-06-21T23:00:00+00:00 tag:www.monarc.lu,2022-06-29:/news/2022/06/29/monarc-2122-released/ 2022-06-28T23:00:00+00:00 <p>Release 2.12.2 of <span class="caps">MONARC</span></p> 2022-06-28T23:00:00+00:00 https://www.misp-project.org/sizing-your-misp-instance/ 2022-07-01T04:00:05.063063+00:00 Sizing your MISP instance Sizing a MISP instance highly depends on how the instance will be used. The number of users, data ingested, data points used, number of events, number of correlations and API usage are all parameters which should be considered while sizing your instance. 2022-07-01T04:00:05.063063+00:00 https://www.misp-project.org/past-events/ 2022-08-04T04:00:05.402935+00:00 Past conferences Past conferences featuring MISP core members talking about MISP and/or threat intelligence. Some links include video recordings. 2021 Video: MISP Fundamentals 2022-08-04T04:00:05.402935+00:00 https://www.misp-project.org/2022/08/08/MISP-scraper.html/ 2022-08-08T01:00:00+00:00 MISP web scraper There are a lot of websites that regularly publish reports on new threats, campaigns or actors with useful indicators, references and context information. 2022-08-08T01:00:00+00:00 https://www.misp-project.org/2022/08/08/MISP.2.4.160.released.html/ 2022-08-08T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.160. With the August summer-holiday season kicking into high gear, we have a very special release for you all, containing a long list of major new features, improvements and general quality of life improvements. 2022-08-08T01:00:00+00:00 https://www.misp-project.org/2022/08/11/MISP.2.4.161.released.html/ 2022-08-11T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.161. Small improvements A new option added to log the last API request of an API key. 2022-08-11T01:00:00+00:00 https://www.misp-project.org/2022/09/12/2022-09-12_periodic_notifications.html/ 2022-09-12T01:00:00+00:00 Periodic summaries - Visualize summaries of MISP data As of version 2.4.162, MISP includes a periodic summary feature allowing users to consult a summary based on a requested time-frame for data the user has access to. 2022-09-12T01:00:00+00:00 https://www.misp-project.org/2022/09/13/MISP.2.4.162.released.html/ 2022-09-13T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.162 with a new periodic notification system, workflow updates and many improvements. 2022-09-13T01:00:00+00:00 https://www.misp-project.org/2022/09/13/misp-guard.html/ 2022-09-13T01:00:00+00:00 Let&rsquo;s say that by no means should an attribute of type passport-number leave your MISP instance. Aside from the analyst following best practices when encoding the data, MISP does not have a built-in mechanism to prevent these leaks to happen, but now you can achieve this by using a third-party tool called misp-guard. 2022-09-13T01:00:00+00:00 https://www.misp-project.org/2022/09/26/MISP.2.4.163.released.html/ 2022-09-26T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.163 with an updated periodic notification system and many improvements. 2022-09-26T01:00:00+00:00 tag:www.monarc.lu,2022-10-10:/news/2022/10/10/monarc-2123-released/ 2022-10-09T23:00:00+00:00 <p>Release 2.12.3 of <span class="caps">MONARC</span></p> 2022-10-09T23:00:00+00:00 https://www.misp-project.org/2022/10/10/MISP.2.4.164.released.html/ 2022-10-10T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.164 with a new tag relationship features, many improvements and a security fix. 2022-10-10T01:00:00+00:00 https://www.misp-project.org/2022/10/27/SACTI_Secure_aggregation_of_cyber_threat_intelligence.html/ 2022-10-27T01:00:00+00:00 SACTI: Secure aggregation of cyber threat intelligence Overview Communities can share cyber threat intelligence on platforms, such as MISP. In the H2020 project Prometheus TNO has developed a way to securely aggregate cyber threat intelligence and publish the result on MISP. 2022-10-27T01:00:00+00:00 tag:www.monarc.lu,2022-11-14:/news/2022/11/14/monarc-2124-released/ 2022-11-13T23:00:00+00:00 <p>Release 2.12.4 of <span class="caps">MONARC</span></p> 2022-11-13T23:00:00+00:00 https://www.misp-project.org/2022/11/14/curation-with-org-confidence-level.html/ 2022-11-14T00:00:00+00:00 Quality of threat intelligence When you receive threat intelligence from different sources you quickly realise there is a big difference in the quality of the received information. 2022-11-14T00:00:00+00:00 https://www.misp-project.org/2022/11/21/MISP.2.4.165.released.html/ 2022-11-21T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.165 with many improvements in workflows but also performance improvements. 2022-11-21T00:00:00+00:00 https://www.misp-project.org/2022/11/30/MISP.2.4.166.released.html/ 2022-11-30T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.166 with new features and fixes, including two critical security fixes. 2022-11-30T00:00:00+00:00 https://www.misp-project.org/2022/12/15/Video_MISP_Best_practices_for_encoding_threat_intelligence.html/ 2022-12-15T00:00:00+00:00 MISP Training Video December Edition - Best Practices for Encoding Threat Intelligence and Leveraging the information in MISP to Make Threat Landscape Report Content of Training Session MISP data model introduction Best practices - from evidences to actionable evidences Leveraging the information in MISP to Make Threat Landscape Report Jupyter notebook used during the training session. 2022-12-15T00:00:00+00:00 https://www.misp-project.org/2022/12/15/Video_MISP_Workflow.html/ 2022-12-15T00:00:00+00:00 MISP Training Video December Edition - Workflow MISP has been a widely used open source CTI platform for the past decade, with a long list of tools that allow users to customise the data models and contextualisation of the platform, yet true customisation of the actual workflows and processes had to be done externally using custom scripts. 2022-12-15T00:00:00+00:00 tag:www.monarc.lu,2022-12-21:/news/2022/12/21/monarc-2125-released/ 2022-12-20T23:00:00+00:00 <p>Release 2.12.5 of <span class="caps">MONARC</span></p> 2022-12-20T23:00:00+00:00 https://www.misp-project.org/2022/12/26/MISP.2.4.167.released.html/ 2022-12-26T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.167 with new features and fixes, bugs fixed and a security fix. 2022-12-26T00:00:00+00:00 https://www.misp-project.org/2023/02/16/MISP.2.4.168.released.html/ 2023-02-16T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.168 with bugs fixed and various security fixes. It includes a rather substantial release of misp-stix, the core Python library for importing and exporting STIX (1, 2. 2023-02-16T00:00:00+00:00 https://www.misp-project.org/2023/02/20/Critical_SQL_Injection_Vulnerabilities_Fixed.html/ 2023-02-20T00:00:00+00:00 Critical SQL injection vulnerabilities in MISP (fixed in v2.4.166 and v2.4.167) Introduction As of the past 2 months, we&rsquo;ve received two separate reports of two unrelated SQLi vector vulnerabilities in MISP that can lead to any authenticated user being able to execute arbitrary SQL queries in MISP. 2023-02-20T00:00:00+00:00 https://www.misp-project.org/2023/02/23/MISP-fail2ban-integration.html/ 2023-02-23T00:00:00+00:00 fail2ban - MISP fail2ban is known to do a great job at giving attackers a hard time when they try to &ldquo;test&rdquo; passwords or enumerate users of a service. 2023-02-23T00:00:00+00:00 https://www.misp-project.org/2023/03/14/MISP.2.4.169.released.html/ 2023-03-14T00:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.169 with various improvements and bug fixes. It includes many improvement release of misp-stix, the core Python library for importing and exporting STIX (1, 2. 2023-03-14T00:00:00+00:00 https://www.misp-project.org/2023/04/03/MISP-Sentinel.html/ 2023-04-03T01:00:00+00:00 MISP to Azure Sentinel integration Introduction The MISP to Azure / Sentinel integration allows you to upload indicators from MISP to Microsoft Sentinel. 2023-04-03T01:00:00+00:00 https://www.misp-project.org/2023/04/13/MISP.2.4.170.released.html/ 2023-04-13T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.170 with new features, workflow improvements and bugs fixed. It includes many improvement release of misp-stix, the core Python library for importing and exporting STIX (1, 2. 2023-04-13T01:00:00+00:00 https://www.misp-project.org/thanks/ 2023-04-15T04:00:05.230896+00:00 Thank you! The MISP project owes its existence and continuous improvement to the invaluable support of numerous organizations and individuals. We are deeply grateful to the following organizations, whose ongoing contributions have helped us enhance the project and ensure its long-term sustainability. 2023-04-15T04:00:05.230896+00:00 tag:www.monarc.lu,2023-04-25:/news/2023/04/25/monarc-2126-released/ 2023-04-24T23:00:00+00:00 <p>Release 2.12.6 of <span class="caps">MONARC</span></p> 2023-04-24T23:00:00+00:00 https://www.misp-project.org/2023/04/29/MISP.how.to.push.to.a.taxii.server.html/ 2023-04-29T01:00:00+00:00 If you want to push data from your MISP instance to a TAXII server, there are a few steps you need to follow. 2023-04-29T01:00:00+00:00 https://www.misp-project.org/2023/05/18/MISP.2.4.171.released.html/ 2023-05-18T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.171 with a long list of fixes, major STIX 2 improvements and an overhaul over the dashboard widget toolkit. 2023-05-18T01:00:00+00:00 https://www.misp-project.org/2023/06/13/MISP.2.4.172.released.html/ 2023-06-13T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.172 with new TOTP/HTOP authentication, many improvements and bugs fixed. 2023-06-13T01:00:00+00:00 https://www.misp-project.org/2023/07/11/MISP.2.4.173.released.html/ 2023-07-11T01:00:00+00:00 We are pleased to announce the immediate availability of MISP v2.4.173 with a new password reset feature, along with a host of quality of life improvements and fixes. 2023-07-11T01:00:00+00:00 https://www.misp-project.org/2023/07/31/MISP.2.4.174.released.html/ 2023-07-31T01:00:00+00:00 We are thrilled to announce the immediate availability of MISP v2.4.174 with significant workflow improvements, accompanied by a host of quality-of-life enhancements and bug fixes. 2023-07-31T01:00:00+00:00 https://www.cedricbonhomme.org/2023/08/04/pyhids-0-6-1/ 2023-08-04T10:00:00+00:00 <p>The new version of <a href="https://github.com/cedricbonhomme/pyHIDS">pyHIDS</a> features the integration of <a href="https://github.com/hashlookup">Hashlookup</a> and <a href="https://github.com/pandora-analysis">Pandora</a>.</p> <p>You can install it from <a href="https://pypi.org/project/pyhids">Pypi</a>, for example with pipx:</p> <div class="highlight"><pre class="chroma" tabindex="0"><code class="language-bash"><span class="line"><span class="cl">$ pipx install pyHIDS </span></span><span class="line"><span class="cl">$ <span class="nb">export</span> <span class="nv">PYHIDS_CONFIG</span><span class="o">=</span>~/.pyHIDS/conf.cfg </span></span></code></pre></div><p>Example of usage:</p> <div class="highlight"><pre class="chroma" tabindex="0"><code class="language-bash"><span class="line"><span class="cl">$ pyhids gen-keys --size <span class="m">2048</span> </span></span><span class="line"><span class="cl">Generating <span class="m">2048</span> bits RSA keys ... </span></span><span class="line"><span class="cl">Dumping Keys </span></span><span class="line"><span class="cl">Done. </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">$ pyhids gen-base --sign </span></span><span class="line"><span class="cl">Generating database... </span></span><span class="line"><span class="cl"><span class="m">2427</span> files in the database. </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">$ pyhids run --check-signature </span></span><span class="line"><span class="cl">Verifying the integrity of the base of hashes... </span></span><span class="line"><span class="cl">Database integrity verified. </span></span><span class="line"><span class="cl">Verifying the integrity of the files... </span></span></code></pre></div><p>If you want to check the database of hashes against Hashlookup and Pandora for known malicious files:</p> <div class="highlight"><pre class="chroma" tabindex="0"><code class="language-bash"><span class="line"><span class="cl">$ pyhids hashlookup </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">$ pyhids pandora </span></span></code></pre></div> 2023-08-04T10:00:00+00:00 https://www.misp-project.org/2023/08/23/MISP_now_supports_Signal_Metadata_Format_Specification_SigMF.html/ 2023-08-23T01:00:00+00:00 As one of the outcomes of GeekWeek8, MISP now supports a new set of features useful for handling radio frequency information in the Signal Metadata Format Specification) (SigMF), commonly used in Software Defined Radio (SDR), digital signal processing and data analysis applications. 2023-08-23T01:00:00+00:00 https://www.misp-project.org/2023/08/24/MISP.2.4.175.released.html/ 2023-08-24T01:00:00+00:00 MISP 2.4.175 released with various bugs fixed, improvements and security fixes. Improvements Added support of start_date and end_date options in the MISP dashboard widgets. 2023-08-24T01:00:00+00:00 https://www.misp-project.org/2023/08/26/MISP-Sentinel-UploadIndicatorsAPI.html/ 2023-08-26T01:00:00+00:00 MISP to Microsoft Sentinel integration Introduction The MISP to Microsoft Sentinel integration allows you to upload indicators from MISP to Microsoft Sentinel. 2023-08-26T01:00:00+00:00 https://www.misp-project.org/2023/09/15/MISP.2.4.176.html/ 2023-09-15T01:00:00+00:00 MISP 2.4.176 released with various improvements and bugs fixed. This version also includes major improvements in the misp-stix library especially on the storing relationships and the description of relationships in the MISP standard format. 2023-09-15T01:00:00+00:00 https://www.misp-project.org/2023/09/27/MISP.2.4.177.released.html/ 2023-09-27T01:00:00+00:00 MISP 2.4.177 released with various bugs fixed and improvements. Improvements [dev] added a shell script to generate the restsearch parameters. [CLI] add command to expire active AuthKeys that do not have an IP allowlist set. 2023-09-27T01:00:00+00:00 https://www.cedricbonhomme.org/2023/10/06/pyhids-0-8-0/ 2023-10-06T11:50:45+00:00 <p>The new version of <a href="https://github.com/cedricbonhomme/pyHIDS">pyHIDS</a> offers the integration of <a href="https://github.com/MISP">MISP</a> and of <a href="https://github.com/virustotal/yara">YARA</a>.</p> <p>A MISP server can be queried in order to find potentially malicious files from the checksums in the database of pyHIDS.<br /> The YARA module allows you to provide a set of YARA rules to apply to the monitoried files.</p> <p>As a reminder, <a href="https://www.cedricbonhomme.org/2023/08/04/pyhids-0-6-1/">a recent previous version</a> of pyHIDS introduced the integration of <a href="https://github.com/hashlookup">Hashlookup</a> and of <a href="https://github.com/pandora-analysis">Pandora</a>.</p> <p>To be honest, I&rsquo;m pretty happy with this new version.</p> <p>Of course, you are invited <a href="https://github.com/cedricbonhomme/pyHIDS/issues">to submit</a> your ideas of new features!</p> 2023-10-06T11:50:45+00:00 https://www.misp-project.org/research-topics/ 2023-10-14T20:58:02.060969+00:00 MISP Research topics Exploring New Horizons in Cyber security and threat intelligence with MISP: Research Opportunities Welcome to the MISP Research Initiative! 2023-10-14T20:58:02.060969+00:00