Using MISP threat intelligence

with ArcSight ESM

v2
Malware Information Sharing Platform
https://www.misp-project.org/

 Threat Sharing Platform

 Free, Open Source
 MITRE ATT&CK Compatible
 More than 6,000 organizations worldwide are using MISP
How does ArcSight ESM use MISP?

 MISP Instance
 MISP Community Instance https://www.misp-project.org/communities/
or
 MISP Local Instance https://www.misp-project.org/download/
 Deployment
 Threat Intelligence Platform https://marketplace.microfocus.com/arcsight/content/esm-default-content
 Model Import Connector for MISP
Threat Intelligence Platform
https://marketplace.microfocus.com/arcsight/content/esm-default-content

 Included with ESM 7.2

 With a fresh install, you will be prompted to install the package
 With an upgrade, the package is imported but is not installed
 Download from Marketplace for…
 ESM 7.0
 ESM 6.11.0
 ESM 6.9.1
 ESM 6.8
Threat Intelligence Platform
Content used in this guide

 Active Lists (Indicators of Compromise)

 Suspicious Addresses
 Suspicious Domains
 Suspicious Hashes
 Suspicious URLs
 Suspicious Emails
 Dashboard
 Reputation Data Overview
 Integration Command
 VirusTotal Hash Lookup
Model Import Connector for MISP
https://community.microfocus.com/t5/ESM-and-ESM-Express/Model-Import-Connector-for-MISP-
Malware-Information-Sharing/ta-p/2752381
 Micro Focus Security ArcSight SmartConnectors Framework 7.14.0
 ArcSight-7.14.0.8248.0-MispModelConnector-Linux64.bin
ArcSight-7.14.0.8248.0-MispModelConnector-Win64.exe
MISP Instance (Community or
Local Instance)
 MISP Community Instance
https://www.circl.lu/services/misp-malware-information-sharing-platform/#how-to-request-
access

8
 MISP Local Instance
https://www.misp-project.org/download/

 Platforms

9
Setting up a MISP Local Instance
(Virtual Image)
 Download the MISP Virtual Image
https://www.circl.lu/misp-images/

https://www.misp-project.org/download/#virtual-images

11
MISP.baseurl
https://github.com/MISP/MISP/issues/4687

 MISP.baseurl needs to be set in the Virtual Image

 If this is not changed, you will see navigation errors
 Login
 misp / Password1234
 Run
 sudo /var/www/MISP/app/Console/cake Baseurl ""
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Setting up the Threat Intelligence
Platform content
How does ArcSight ESM use MISP?

 The Threat Intelligence Platform Package must be Imported and Installed

 The Threat Intelligence Platform Group must be linked to Real-time Rules
Setting up the Model Import
Connector for MISP
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
27
28
Testing the Threat Intelligence
Platform content