Set of Maltego transforms to inferface with a MISP Threat Sharing instance, and also to explore the whole MITRE ATT&CK dataset.

maltego misp mitre

Go to file

Christophe Vandeplas 42b0ba94c1 fix: clarify PyMISP version		2019-05-07 20:26:01 +02:00
doc	new: [doc] added ATT&CK screenshot	2019-05-02 21:36:07 +02:00
src/MISP_maltego	new: [galaxy] reverse relationships	2019-05-02 21:20:28 +02:00
.canari	redevelopment from scratch using canari3	2018-11-12 13:25:53 +01:00
.gitignore	cleanup noise	2018-11-20 11:35:18 +02:00
.mrbob.ini	redevelopment from scratch using canari3	2018-11-12 13:25:53 +01:00
LICENSE	redevelopment from scratch using canari3	2018-11-12 13:25:53 +01:00
MANIFEST.in	redevelopment from scratch using canari3	2018-11-12 13:25:53 +01:00
README.md	fix: [doc] added links	2019-03-16 21:23:17 +01:00
setup.py	fix: clarify PyMISP version	2019-05-07 20:26:01 +02:00

README.md

Quick start guide

This is a Maltego MISP integration tool allowing you to view (read-only) data from a MISP instance.

It also allows browsing through the MITRE ATT&CK entities.

Currently supported MISP elements are : Event, Attribute, Object (incl relations), Tag, Taxonomy, Galaxy (incl relations).

Once installed you can start by creating a MISPEvent entity, then load the Machine EventToAll or the transform EventToAttributes.

Alternatively initiate a transform on an existing Maltego entity. The currently supported entities are: AS, DNSName, Domain, EmailAddress, File, Hash, IPv4Address, NSRecord, Person, PhoneNumber, URL, Website

Installation and User Guide:

Installation is fairly easy, just read the steps in the documentation.

The User Guide gives some example use-cases.

Screenshot

License

This software is licensed under GNU Affero General Public License version 3

Note: Before being rewritten from scratch this project was maintained by Emmanuel Bouillon. The code is available in the v1 branch.

The icons in the intelligence-icons folder are from intelligence-icons licensed CC-BY-SA - Françoise Penninckx, Brett Jordan