Deploying MISP: IOC Sharing and Event Management
MISP is the de facto open-source platform for collecting, sharing, and managing IOCs. Source install, baseline config, org and user admin, event/IOC import-export, and Suricata/Wazuh integration—hardened for production.
Scope
MISP deployment fits these cases: security teams need unified IOC management (IPs, domains, hashes, URLs) from multiple sources; branches or orgs need to share threat intel; intel must feed existing detection (Suricata, Wazuh, firewalls) for auto-block; SOC needs event management and attribution. MISP is the de facto open-source threat intel platform. This guide follows the official recommended path for a full deploy and harden.
Prerequisites
- One Ubuntu 22.04 LTS server (4C8G minimum recommended, disk ≥ 40GB)
- Domain resolving to the server (MISP depends heavily on SSL; production requires a valid certificate)
- root or sudo, outbound access to download packages
Mechanism
MISP (Malware Information Sharing Platform) is built on Events and Attributes: an Event describes an attack or threat activity; Attributes are the IOCs under that event (C2 IPs, malware hashes, phishing domains). Organisations and sharing rules control intel distribution. Feeds subscribe to external sources. Export dumps IOCs as Suricata rules, STIX, and other formats. Hardening focus: force TLS, separate admin and machine accounts, disable dangerous features, restrict sync scope, back up the database regularly.
Steps
1. Install MISP from source
`# Install base dependencies
sudo apt update && sudo apt install -y curl git python3-pip python3-dev redis-server mariadb-server libxml2-dev libxslt1-dev zlib1g-dev libjpeg-dev libfuzzy-dev nginx php8.1-fpm php8.1-{mysql,curl,gd,mbstring,xml,zip,intl,redis,bcmath,opcache} composer
# Clone MISP source (official supported branch)
sudo mkdir -p /var/www/MISP
sudo chown $USER /var/www/MISP
git clone https://github.com/MISP/MISP.git /var/www/MISP
cd /var/www/MISP
git checkout $(git describe --tags `git rev-list --tags --max-count=1`) # checkout latest stable`2. Configure the database
`# Create MISP database and dedicated user
sudo mysql -e "CREATE DATABASE misp;"
sudo mysql -e "CREATE USER 'misp'@'localhost' IDENTIFIED BY 'STRONG_PASSWORD';"
sudo mysql -e "GRANT ALL PRIVILEGES ON misp.* TO 'misp'@'localhost';"
sudo mysql -e "FLUSH PRIVILEGES;"
# Import base schema
sudo mysql misp < /var/www/MISP/INSTALL/MYSQL.sql
# Configure CakePHP database connection
sudo cp /var/www/MISP/app/Config/database.default.php /var/www/MISP/app/Config/database.php
# Edit database.php; fill in the misp account password`3. Configure PHP and the web server
`# Tune PHP settings
sudo sed -i 's/^memory_limit.*/memory_limit = 2048M/' /etc/php/8.1/fpm/php.ini
sudo sed -i 's/^upload_max_filesize.*/upload_max_filesize = 50M/' /etc/php/8.1/fpm/php.ini
sudo sed -i 's/^post_max_size.*/post_max_size = 50M/' /etc/php/8.1/fpm/php.ini
sudo systemctl restart php8.1-fpm
# Copy Nginx config (official template already includes TLS)
sudo cp /var/www/MISP/INSTALL/misp.nginx /etc/nginx/sites-available/misp
sudo sed -i 's/server_name misp.example.com;/server_name your-domain;/' /etc/nginx/sites-available/misp
sudo ln -s /etc/nginx/sites-available/misp /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx`4. Initialize and create the admin account
`# Run official init script (prompts for admin account)
sudo /var/www/MISP/app/Console/cake Admin setSetting "MISP.baseurl" "https://your-domain"
sudo /var/www/MISP/app/Console/cake Admin setSetting "Security.force_ssl" true
sudo /var/www/MISP/app/Console/cake Admin setSetting "Security.require_password_confirmation" true
# Create admin account
sudo /var/www/MISP/app/Console/cake User init`5. Harden the configuration
`# 1) Force TLS: disable cleartext access
sudo /var/www/MISP/app/Console/cake Admin setSetting "Security.force_ssl" true
sudo /var/www/MISP/app/Console/cake Admin setSetting "Security.encryption_key" "RANDOM_LONG_SECRET"
# 2) Disable registration so outsiders cannot self-register
sudo /var/www/MISP/app/Console/cake Admin setSetting "Security.auth" true
sudo /var/www/MISP/app/Console/cake Admin setSetting "MISP.self_registration_message" "Registration is closed, please contact the administrator"
# 3) Restrict Feed and sync scope (toggle in admin UI as needed)
# Administration → Server Settings → MISP modules; disable unused export formats
# 4) Tighten file permissions
sudo chown -R www-data:www-data /var/www/MISP/app/tmp
sudo chmod -R 750 /var/www/MISP/app/tmp`6. Create events and import IOCs
`# Create an event from CLI (or use the Web UI)
sudo /var/www/MISP/app/Console/cake Event add 2 << EOF
Event title: APT group targeting the financial sector
Threat level: High
Distribution: Organisation only
EOF
# Bulk-import IOCs (CSV: type,value)
# ip-src,1.2.3.4
# hostname,evil.example.com
# md5,xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Start background job queue (exports, sync, other async work)
sudo /var/www/MISP/app/Console/cake Job start`7. Integrate with Suricata for auto-block
`# Export MISP events as Suricata rules
# Web UI → Events → List Events → select event → Export → Suricata
# Copy generated rules into the Suricata rules directory
sudo cp /tmp/misp-suricata.rules /etc/suricata/rules/
echo 'include /etc/suricata/rules/misp-suricata.rules' | sudo tee -a /etc/suricata/suricata.yaml
sudo systemctl reload suricata
# Verify rules loaded
sudo suricata -T -c /etc/suricata/suricata.yaml`Verification
`# 1. Open https://your-domain; confirm the Web UI logs in with no certificate warnings
# 2. Verify IOC search
curl -k -H "Authorization: YOUR_API_KEY" "https://your-domain/attributes/restSearch?value=1.2.3.4"
# 3. Verify Suricata rules loaded
sudo suricata -T -c /etc/suricata/suricata.yaml | grep -i misp
# 4. Verify database backup is restorable
sudo mysqldump misp > /tmp/misp_backup_$(date +%F).sql`FAQ
Q1: How do I call the MISP API? Does everything go through the Web UI?
MISP ships a full REST API. Automations (Wazuh, firewall feeds) should use the API: generate an API key for a machine account under Administration → User Management; authenticate with `Authorization: <APIKey>`. The API covers CRUD on events, attributes, and feeds. Give detection systems a read-only key so they cannot delete events.
Q2: How do I subscribe to external threat intel feeds? What to watch?
Enable official Feeds (CIRCL, Botvrij.eu, etc.) under Administration → Feeds. Pull interval 1–6 hours. Three notes: some Feeds are full historical dumps—first pull is large and disk-heavy; enable the Feed, then check stats after the pull. External Feed IOCs have a high false-positive rate; score trust before import, or isolate them under a dedicated external-source Organisation. Check Feed pull logs regularly so source-side changes do not fail silently.
Q3: What day-to-day ops does MISP need after deploy?
Three must-dos: periodic DB backup (mysqldump full + binlog incremental), restore drill quarterly; software updates—track MISP GitHub Releases, backup the DB and read CHANGELOG before upgrade; Feed and sync checks—confirm external intel is flowing and partner sync is up; on sync failure, check certs and network.
Takeaway
MISP turns scattered IOCs into shareable, integrable, auditable intel. At deploy: TLS, DB isolation, tight account perms. In ops: keep Feeds current, back up regularly, wire Suricata/Wazuh. That closes the intel consumption loop. For smaller orgs: start with intra-org sharing + 1–2 trusted Feeds + Suricata, then add sync partners.