diff --git a/quick-start/README.md b/quick-start/README.md old mode 100644 new mode 100755 index 4aea9b9..e810b41 --- a/quick-start/README.md +++ b/quick-start/README.md @@ -1,20 +1,95 @@ -Quick Start ------------ + + +# Quick Start + The Malware Information Sharing Platform (MISP) is the tool which will be used to facilitate the exchange of Indicator of Compromise (IOC) about targeted malware and attacks within your community of trusted members. It is a distributed Indicator of Compromise (IOC) database with technical and non-technical information. Exchanging this information should result in faster detection of targeted attacks and improve the detection ratio, while also reducing the number of false positives. -Create an Event -=============== +## Create an Event -![Create an Event in MISP](figures/quick_create.jpg) +![Create an Event in MISP](figures/AddEvent.jpg) -Browsing Events -==================== +You have only few infos to put in to register your Event. Details will be specified after adding your Event. -![Browsing Events](figures/quick_browse.jpg) +## Describe Event -Export Events for Log Search -============================ -![Quick Export](figures/quick_export.jpg) +Red is fully normal. No worries. +![Describe Event](figures/AddEventOK.jpg) + + +You can now specify the information for your Event. (You must scroll the window). + +### Free-Text Import Tool + +![Use Freetext import](figures/AddEventDescription.jpg) + +If you have a list of indicators that you would like to quickly generate attributes out of then the **Free-text import tool** is +just what you need. Simply paste a list of indicators (separated by line-breaks into this tool). + +![FreeText Import result](figures/FreeTextImportResult.jpg) + +The Tool will help you to find similarities and other issues already registered in MISP. + +![FreeText Suggest](figures/FreeTextSuggest.jpg) + +For example, you can see the number of related events and informations. + +### Tags and Taglist + +#### Using existing Data + +An other easy way to add information, is to use Tags, because you will find some Taglist. You can see the result of adding existing Tags (circl:incident-classification=XSS ans circl:incident-classification="information-leak). + +![Add Tag](figures/SelectTag.jpg) + +By clicking the bottom, you can add other tag from existing Taglist. + +![Taglist](figures/AddEventTagsList.jpg) + +Especially, the Taglist "Taxonomy Library: circl" is very complete, as you can see: + +![Select Tag from Taglis](figures/AddEventSelectTag.jpg) + +#### Make your own Taglist + +If you want make your own Taglist, you should select Add Tag + +![Select Add New Tag](figures/SelectAddNewTag.jpg) + +you will then see the following window: + +![Define Tag](figures/AddTag.jpg) + + +Then when you want to add the new tag , it will appear among the Custom Taglist. + +### Suggestions + +The following attribute types should be added for each event: +- ip-src: source IP of attacker +- email-src: email used to send malware +- md5/sha1/sha256: checksum +- Hostname: full host/dnsname of attacker +- Domain: domain name used in malware + +## Browsing Events +To see your Event, select List Events from the menu Events Action and choice List Events. You can click any row and select filter. + +![Browsing Events](figures/ListEvents.png) + +If you click to your event's number, you can see all informations related to your Event. + +![See Event](figures/SeeEvent.jpg) + +## Export Events for Log Search + +Export functionality is designed to automatically generate signatures for intrusion detection systems. To enable signature generation for a given attribute, Signature field of this attribute must be set to Yes. Note that not all attribute types are applicable for signature generation, currently we only support NIDS signature generation for IP, domains, host names, user agents etc., and hash list generation for MD5/SHA1 values of file artifacts. Support for more attribute types is planned. + +![Quick Export](figures/Export.jpg) + +Simply click on any of the following buttons to download the appropriate data and download for log correlation. + +![Select Format](figures/Select Export.jpg) diff --git a/quick-start/figures/.DS_Store b/quick-start/figures/.DS_Store new file mode 100644 index 0000000..5008ddf Binary files /dev/null and b/quick-start/figures/.DS_Store differ diff --git a/quick-start/figures/AddEvent.jpg b/quick-start/figures/AddEvent.jpg new file mode 100644 index 0000000..0ad2c17 Binary files /dev/null and b/quick-start/figures/AddEvent.jpg differ diff --git a/quick-start/figures/AddEventDescription.jpg b/quick-start/figures/AddEventDescription.jpg new file mode 100644 index 0000000..eb1d33e Binary files /dev/null and b/quick-start/figures/AddEventDescription.jpg differ diff --git a/quick-start/figures/AddEventOK.jpg b/quick-start/figures/AddEventOK.jpg new file mode 100644 index 0000000..ad7b6d6 Binary files /dev/null and b/quick-start/figures/AddEventOK.jpg differ diff --git a/quick-start/figures/AddEventSelectTag.jpg b/quick-start/figures/AddEventSelectTag.jpg new file mode 100644 index 0000000..8b4e2d4 Binary files /dev/null and b/quick-start/figures/AddEventSelectTag.jpg differ diff --git a/quick-start/figures/AddEventTagsList.jpg b/quick-start/figures/AddEventTagsList.jpg new file mode 100644 index 0000000..7cf5925 Binary files /dev/null and b/quick-start/figures/AddEventTagsList.jpg differ diff --git a/quick-start/figures/AddTag.jpg b/quick-start/figures/AddTag.jpg new file mode 100644 index 0000000..ed8d5d9 Binary files /dev/null and b/quick-start/figures/AddTag.jpg differ diff --git a/quick-start/figures/AddUser.jpg b/quick-start/figures/AddUser.jpg new file mode 100644 index 0000000..f3af1fa Binary files /dev/null and b/quick-start/figures/AddUser.jpg differ diff --git a/quick-start/figures/Export.jpg b/quick-start/figures/Export.jpg new file mode 100644 index 0000000..bc3da69 Binary files /dev/null and b/quick-start/figures/Export.jpg differ diff --git a/quick-start/figures/FreeTextImportResult.jpg b/quick-start/figures/FreeTextImportResult.jpg new file mode 100644 index 0000000..506ddc0 Binary files /dev/null and b/quick-start/figures/FreeTextImportResult.jpg differ diff --git a/quick-start/figures/FreeTextSuggest.jpg b/quick-start/figures/FreeTextSuggest.jpg new file mode 100644 index 0000000..1b8a13c Binary files /dev/null and b/quick-start/figures/FreeTextSuggest.jpg differ diff --git a/quick-start/figures/FreeTextSuggest.png b/quick-start/figures/FreeTextSuggest.png new file mode 100644 index 0000000..a0b5a1c Binary files /dev/null and b/quick-start/figures/FreeTextSuggest.png differ diff --git a/quick-start/figures/FreeTextSuggestion.jpg b/quick-start/figures/FreeTextSuggestion.jpg new file mode 100644 index 0000000..75bb11d Binary files /dev/null and b/quick-start/figures/FreeTextSuggestion.jpg differ diff --git a/quick-start/figures/ListEvents.png b/quick-start/figures/ListEvents.png new file mode 100644 index 0000000..64c3aa7 Binary files /dev/null and b/quick-start/figures/ListEvents.png differ diff --git a/quick-start/figures/SeeEvent.jpg b/quick-start/figures/SeeEvent.jpg new file mode 100644 index 0000000..21c8691 Binary files /dev/null and b/quick-start/figures/SeeEvent.jpg differ diff --git a/quick-start/figures/Select Export.jpg b/quick-start/figures/Select Export.jpg new file mode 100644 index 0000000..0eaa644 Binary files /dev/null and b/quick-start/figures/Select Export.jpg differ diff --git a/quick-start/figures/SelectAddNewTag.jpg b/quick-start/figures/SelectAddNewTag.jpg new file mode 100644 index 0000000..7761b41 Binary files /dev/null and b/quick-start/figures/SelectAddNewTag.jpg differ diff --git a/quick-start/figures/SelectTag.jpg b/quick-start/figures/SelectTag.jpg new file mode 100644 index 0000000..df86696 Binary files /dev/null and b/quick-start/figures/SelectTag.jpg differ diff --git a/quick-start/figures/quick_browse.jpg b/quick-start/figures/quick_browse.jpg deleted file mode 100644 index 3acbca0..0000000 Binary files a/quick-start/figures/quick_browse.jpg and /dev/null differ diff --git a/quick-start/figures/quick_create.jpg b/quick-start/figures/quick_create.jpg deleted file mode 100644 index 576c5ea..0000000 Binary files a/quick-start/figures/quick_create.jpg and /dev/null differ diff --git a/quick-start/figures/quick_export.jpg b/quick-start/figures/quick_export.jpg deleted file mode 100644 index e5c1a05..0000000 Binary files a/quick-start/figures/quick_export.jpg and /dev/null differ