diff --git a/GLOSSARY.md b/GLOSSARY.md index 35d1905..cb41e59 100644 --- a/GLOSSARY.md +++ b/GLOSSARY.md @@ -92,6 +92,9 @@ For more details on taxonomies and classification [the documentation](https://ww There is a Python module available to work with Taxonomies in a Pythonic way called [PyTaxonomies](https://github.com/MISP/PyTaxonomies). [MISP taxonomies GitHub Repo](https://github.com/MISP/misp-taxonomies) +## Local tags +You can create tags locally if you are a member of the given MISP instance’s host organisation, enabling “in-place” tagging for synchronisation and export filtering. MISP events are not modified while using the local tags and are in turn always stripped before being synchronised with other MISP instances and sharing communities. Local tags allow users to avoid violating the ownership model of MISP, but still be able to tag any event or attribute for further dissemination and data contextualisation. Local tagging works for tags, tag collections, galaxies and matrix-like galaxies such as ATT&CK. + ## MISP warninglists MISP warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes. There is a Python module available to work with warninglists in a Pythonic way called [PyMISPWarningLists](https://github.com/MISP/PyMISPWarningLists). diff --git a/quick-start/README.md b/quick-start/README.md index 2ac7509..b92e064 100644 --- a/quick-start/README.md +++ b/quick-start/README.md @@ -3,7 +3,7 @@ And Justice for All! --> # Quick Start -MISP (Open Source Threat Intelligence and Sharing Platform) software facilitates the exchange and sharing of threat intelligence, Indicators of Compromise (IOCs) about targeted malware and attacks, financial fraud or any intelligence within your community of trusted members. MISP sharing is a distributed model containing technical and non-technical information which can be shared within closed, semi-private or open communities. Exchanging such information should result in faster detection of targeted attacks and improve the detection ratio, whilst also reducing the number of false positives. +MISP (Open Source Threat Intelligence and Sharing Platform) software facilitates the exchange and sharing of threat intelligence, Indicators of Compromise (IoCs) about targeted malware and attacks, financial fraud or any intelligence within your community of trusted members. MISP sharing is a distributed model containing technical and non-technical information which can be shared within closed, semi-private or open communities. Exchanging such information should result in faster detection of targeted attacks and improve the detection ratio, whilst also reducing the number of false positives. With the focus on automation and standards, MISP provides you with a powerful ReST API, extensibility (via misp-modules) or additional libraries such as PyMISP, jump ahead to these chapters to get started. @@ -21,12 +21,21 @@ MISP default credentials: +## I forgot my admin password :( + +You can quickly reset it via the command line. You need to know the Admins E-Mail address. +Replace www-data with whoever runs the webserver. + +``` +sudo -u www-data /var/www/MISP/app/Console/cake Password admin@admin.test Password1234 +``` + ## Tasks to do after first Start -1. [Change site admin password](https://misp.gitbooks.io/misp-book/content/quick-start/#password-policy) +1. [Change site admin password](https://www.circl.lu/doc/misp/quick-start/#password-policy) 2. [Activate Feeds](https://www.circl.lu/doc/misp/managing-feeds/) -3. [Setup your User](https://misp.gitbooks.io/misp-book/content/user-management/#first-run-of-the-system) +3. [Setup your User](https://www.circl.lu/doc/misp/user-management/#first-run-of-the-system) 3.1 Designate a Site Admin and an Org Admin 3.2 Add some contributing users and assign the corresponding Roles 4. [MISP Administration](https://www.circl.lu/doc/misp/administration/) @@ -69,42 +78,70 @@ You only have to add a few pieces of information to register your Event. Further ## Describe Event -Red is totally normal. No worries. (In future releases this will change to a more harmonious color) - -![Describe Event](figures/AddEventOK.jpg) +![Describe Event](figures/AddEventOK.png) Now you can specify the information for your Event (you will need to scroll the window). ### Free-Text Import Tool -![Use Freetext import](figures/AddEventDescription.jpg) +![Use Freetext import](figures/AddEventDescription.png) + +The following will pop-up. If you have a list of indicators from which you would like to quickly generate attributes then the **Free-text import tool** is just what you need. Simply paste your list of indicators (separated by line-breaks) into this tool. +![Freetext import pop-up](figures/freetextImportPopUp.png) + ![FreeText Import result](figures/FreeTextImportResult.jpg) The tool will help you to find similarities between your import and other issues already registered in MISP. -![FreeText Suggest](figures/FreeTextSuggest.jpg) +![FreeText Suggest](figures/FreeTextSuggest.png) For example, you can see the ID of all related Events and view their information. +##### Alternative to import + +An alternative route to reach the Freetext import tool is shown below. + +![Import From](figures/populateFrom.png) + +![Import From pop-up](figures/populateFromPopUp.png) + ### Tags and Taglist #### Using existing Data Another easy way to add information is to use Tags. You can see the result of adding existing Tags (circl:incident-classification=XSS ans circl:incident-classification="information-leak). -![Add Tag](figures/SelectTag.jpg) +![Add Tag](figures/SelectTag.png) By clicking the button, you can add more tags from an existing Taglist. -![Taglist](figures/AddEventTagsList.jpg) +![Taglist](figures/AddEventTagsList.png) -In particular the "Taxonomy Library: circl" Taglist is very complete, as you can see: +In particular the "Taxonomy Library: circl" Taglist is very complete. -![Select Tag from Taglis](figures/AddEventSelectTag.jpg) +Once you added the tag(s) it will show in you main event window and in the list event view. + +![Tag Added](figures/tagAdded.png) + +### Local tags + +Local tags can be added in a similar fashion. + +![Add Local Tag](figures/addLocalTag.png) + +They will be identified by a corresponding icon. + +![Local Tags Mix](figures/localTagsOverview.png) + +#### No tags in list + +In case you get the below. You need to either enable an existing Taxonomy or add some custom tags. + +![No tags](figures/addTagEmpty.png) #### Make your own Taglist @@ -134,7 +171,7 @@ To see your Event, select List Events from the menu Events Action. You can click If you click on your Event's number, you can see all the information related to your Event. -![See Event](figures/SeeEvent.jpg) +![See Event](figures/SeeEvent.png) ## Export Events for Log Search @@ -145,3 +182,7 @@ Export functionality is designed to automatically generate signatures for intrus Simply click on any of the following buttons to download the appropriate data for log correlation. ![Select Format](figures/SelectExport.jpg) + +## Enable a Taxonomy + +## Enable and fetch a feeds diff --git a/quick-start/figures/AddEventDescription.jpg b/quick-start/figures/AddEventDescription.jpg deleted file mode 100644 index eb1d33e..0000000 Binary files a/quick-start/figures/AddEventDescription.jpg and /dev/null differ diff --git a/quick-start/figures/AddEventDescription.png b/quick-start/figures/AddEventDescription.png new file mode 100644 index 0000000..3f13e69 Binary files /dev/null and b/quick-start/figures/AddEventDescription.png differ diff --git a/quick-start/figures/AddEventOK.jpg b/quick-start/figures/AddEventOK.jpg deleted file mode 100644 index ad7b6d6..0000000 Binary files a/quick-start/figures/AddEventOK.jpg and /dev/null differ diff --git a/quick-start/figures/AddEventOK.png b/quick-start/figures/AddEventOK.png new file mode 100644 index 0000000..5972620 Binary files /dev/null and b/quick-start/figures/AddEventOK.png differ diff --git a/quick-start/figures/AddEventSelectTag.jpg b/quick-start/figures/AddEventSelectTag.jpg deleted file mode 100644 index 8b4e2d4..0000000 Binary files a/quick-start/figures/AddEventSelectTag.jpg and /dev/null differ diff --git a/quick-start/figures/AddEventTagsList.jpg b/quick-start/figures/AddEventTagsList.jpg deleted file mode 100644 index 7cf5925..0000000 Binary files a/quick-start/figures/AddEventTagsList.jpg and /dev/null differ diff --git a/quick-start/figures/AddEventTagsList.png b/quick-start/figures/AddEventTagsList.png new file mode 100644 index 0000000..6b43a6c Binary files /dev/null and b/quick-start/figures/AddEventTagsList.png differ diff --git a/quick-start/figures/FreeTextSuggest.jpg b/quick-start/figures/FreeTextSuggest.jpg deleted file mode 100644 index 1b8a13c..0000000 Binary files a/quick-start/figures/FreeTextSuggest.jpg and /dev/null differ diff --git a/quick-start/figures/SeeEvent.jpg b/quick-start/figures/SeeEvent.jpg deleted file mode 100644 index 21c8691..0000000 Binary files a/quick-start/figures/SeeEvent.jpg and /dev/null differ diff --git a/quick-start/figures/SeeEvent.png b/quick-start/figures/SeeEvent.png new file mode 100644 index 0000000..e793c99 Binary files /dev/null and b/quick-start/figures/SeeEvent.png differ diff --git a/quick-start/figures/SelectTag.jpg b/quick-start/figures/SelectTag.jpg deleted file mode 100644 index df86696..0000000 Binary files a/quick-start/figures/SelectTag.jpg and /dev/null differ diff --git a/quick-start/figures/SelectTag.png b/quick-start/figures/SelectTag.png new file mode 100644 index 0000000..f3bd6d7 Binary files /dev/null and b/quick-start/figures/SelectTag.png differ diff --git a/quick-start/figures/addLocalTag.png b/quick-start/figures/addLocalTag.png new file mode 100644 index 0000000..1710259 Binary files /dev/null and b/quick-start/figures/addLocalTag.png differ diff --git a/quick-start/figures/addTagEmpty.png b/quick-start/figures/addTagEmpty.png new file mode 100644 index 0000000..0397f22 Binary files /dev/null and b/quick-start/figures/addTagEmpty.png differ diff --git a/quick-start/figures/freetextImportPopUp.png b/quick-start/figures/freetextImportPopUp.png new file mode 100644 index 0000000..91a87a5 Binary files /dev/null and b/quick-start/figures/freetextImportPopUp.png differ diff --git a/quick-start/figures/localTagsOverview.png b/quick-start/figures/localTagsOverview.png new file mode 100644 index 0000000..f427e91 Binary files /dev/null and b/quick-start/figures/localTagsOverview.png differ diff --git a/quick-start/figures/populateFrom.png b/quick-start/figures/populateFrom.png new file mode 100644 index 0000000..f8fff06 Binary files /dev/null and b/quick-start/figures/populateFrom.png differ diff --git a/quick-start/figures/populateFromPopUp.png b/quick-start/figures/populateFromPopUp.png new file mode 100644 index 0000000..ba924f7 Binary files /dev/null and b/quick-start/figures/populateFromPopUp.png differ diff --git a/quick-start/figures/tagAdded.png b/quick-start/figures/tagAdded.png new file mode 100644 index 0000000..89e6bfb Binary files /dev/null and b/quick-start/figures/tagAdded.png differ