MISP EcoSystem - Threat Intelligence, VMRay, MISP

Editor's Notes

1. Expression of intent to do harm Contains tactics, techniques and procedures
2. Intelligence is the information that adds the context
3. Combining threat and intelligence allows you to evaluate if a certain threat is a problem for your environment
4. Why do you need threat intelligence? To evaluate if a certain new attack pattern is a threat to your environment Change your defenses for this new threat And get ahead of the game, instead of allowing an attacker to get a strong foothold in your organisation detect the attack in the early stages of the intrusion
5. Threat intelligence often used in combination with SIEMs SIEM : connection to an IP, no context Threat : IP is marked as possibly malicious ; investigate other actions done by the host that started the connection
6. IoCs are how we most often consume threat intelligence The most visible part; but there's more
7. Notes about with whom you share information You don't want to share with the whole world, otherwise attackers get informed that their actions have been discovered Color scheme to describe with whom and how you share ; from RED restricted to WHITE open
8. Started in 2012 by Belgian Ministry of Defense as a malware information sharing platform evolved to threat sharing platform since a couple of years taken over by CIRCL, the LU private CERT
9. Distributed sharing model Everyone can contribute or consume Everyone adds their own bits & pieces found to the threat data, they then describe with whom and how it can be shared -> through the distributed nature of MISP
10. Correlation Attributes added to an event If they already exist MISP will connect them together Proposal If you don't agree with an attribute you can propose a "change" Or add your own attribute The owner of the threat event can then decided to accept the proposal Exchange of proposals happens the same way as distribution of threat event data in MISP
11. When adding events or attributes you'll have to deal with false positives ; as always "context" is important Looking at an attribute without the context you can not decide if something is false positive or not Add the context; the logic (different attributes) to evaluate if something is really a problem Example : connection to evil.com ; malware gets downloaded and installed and then does network connectivity test
12. Protect your own assets from ending up in signatures
13. Are a classification scheme to describe what a threat is about Provided by for example enisa, veris, nato, etc. Human : visually to know what the threat is about Machine : used for distribution and import/export security devices
14. Sightings allow you to vouch that an attribute is "valuable"