MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity
Page: CortexIntegration
Pages
3rd party modules AddNewAttributes AuthenticationProject Categories & Types changes CheckList CommitMessageBestPractices Contributing to MISP Project CortexIntegration Critical aspects or features DeploymentTools EnhancedSighting Frequently Asked Questions Hackathon Hardening Home Max and min value for first_seen last_seen NewAttributes Notes: MISP STIX2 Planned features and functionalities Presentations about MISP or mentioning MISP Project dependencies Proxy RedisAllocation ReleaseCheckList Rename default branches master to main STIX2.0 to STIX2.1 changes Sharing guidelines TaxonomiesResearch Use cases UserInterface
1 CortexIntegration
Alexandre Dulaunoy edited this page 2017-05-02 17:08:49 +02:00
Table of Contents

Integrating and Supporting Cortex within MISP

During the hackathon, we had a discussion about the steps of integrating Cortex in MISP and allow the use of it:

  • (1) first step is to create an attribute type called cortex to include the JSON object returned by Cortex in MISP
  • (1) A new MISP Cortex module will be created to expose Cortex services into MISP

This is the first stage of integrating Cortex. In this case, the MISP module will do the async request to Cortex and response back to MISP to allow the proposal of attributes.

Second step will be to support the async interface in MISP directly. Where Cortex exposes a misp-module like interface then MISP will need to support a full async.