A dashboard for a real-time overview of threat intelligence from MISP instances

Go to file

Sami Mokaddem 5779eb53c4 Merge branch 'users' into trendings		2017-11-16 15:11:04 +01:00
config	Draft support of trophies in ZMQ	2017-11-14 14:05:54 +01:00
screenshots	Added screenshots geo and live	2017-11-10 16:16:38 +01:00
static	Merge branch 'users' into trendings	2017-11-16 15:11:04 +01:00
templates	Added linked pie plot with server	2017-11-16 15:08:14 +01:00
LICENSE	add: LICENSE added	2017-10-28 10:33:24 +02:00
README.md	Update README.md	2017-11-10 16:45:47 +01:00
contributor_helper.py	Fixed keyError new categ	2017-11-14 17:02:51 +01:00
give_honors_to_org.py	Draft support of trophies in ZMQ	2017-11-14 14:05:54 +01:00
install_dependencies.sh	Merged upstream	2017-11-10 13:57:00 +01:00
retreive_map_pic.py	Started support of MISP ZMQ	2017-10-13 15:03:09 +02:00
server.py	Added linked pie plot with server	2017-11-16 15:08:14 +01:00
start.sh	…
users_helper.py	Replaced loginOccurence by contribution/login	2017-11-15 15:40:28 +01:00
util.py	Added login overtime + users_helper script	2017-11-15 09:36:44 +01:00
zmq_subscriber.py	Added linked pie plot with server	2017-11-16 15:08:14 +01:00

README.md

MISP-Dashboard

An experimental dashboard showing live data and statistics from the ZMQ of one or more MISP instances.

Live Dashboard

Possibility to subscribe to multiple ZMQ feeds
Shows direct contribution made by organisations
Shows live resolvable posted locations

Geolocalisation Dashboard

Provides historical geolocalised information to support security teams, CSIRTs or SOC finding threats in their constituency
Possibility to get geospatial information from specific regions

Contributors Dashboard

Shows:

The monthly rank of all organisation
The last organisation that contributed (dynamic updates)
The contribution level of all organisation
Each category of contribution per organisation
The current ranking of the selected organisation (dynamic updates)

Includes:

Gamification of the platform:
- Two different levels of ranking with unique icons
- Exclusive obtainable badges for source code contributors and donator

Installation

Launch ./install_dependencies.sh from the MISP-Dashboard directory
Update the configuration file config.cfg so that it matches your system
- Fields that you may change:
  - RedisGlobal -> host
  - RedisGlobal -> port
  - RedisGlobal -> zmq_url
  - RedisGlobal -> misp_web_url

Starting the System

Activate your virtualenv . ./DASHENV/bin/activate
Listen to the MISP feed by starting the zmq_subscriber ./zmq_subscriber.py
Start the Flask server ./server.py
Access the interface at http://localhost:8001/

zmq_subscriber options


A zmq subscriber. It subscribe to a ZMQ then redispatch it to the MISP-dashboard

optional arguments:
  -h, --help            show this help message and exit
  -n ZMQNAME, --name ZMQNAME
                        The ZMQ feed name
  -u ZMQURL, --url ZMQURL
                        The URL to connect to

License

Images and logos are handmade for:

rankingMISPOrg/
rankingMISPMonthly/
MISPHonorableIcons/

Note that:

Part of MISPHonorableIcons/1.svg comes from octicons.github.com (CC0 - No Rights Reserved)
Part of MISPHonorableIcons/2.svg comes from Zeptozephyr (CC0 - No Rights Reserved)

Copyright (C) 2017 CIRCL - Computer Incident Response Center Luxembourg (c/o smile, security made in Lëtzebuerg, Groupement d'Intérêt Economique)
Copyright (c) 2017 Sami Mokaddem


This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.