StamusNetworks / surimisp

Check IOC provided by a MISP instance on Suricata events

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Surimisp

Introduction

Surimisp is an indicator of compromise checker for Suricata and MISP. It fetches IOC list from MISP and check them against Suricata events.

Installation

You can install dependcies via

pip install -r requirements.txt

Then you can install via

python setup.py install

Usage

First edit surimisp.conf to add your MISP API key and adjust address of your MISP instance.

You may also need to setup define one instance.

Then you can start surimisp via

surimisp -c surimisp.conf

About

Check IOC provided by a MISP instance on Suricata events

License:GNU General Public License v3.0


Languages

Language:Python 100.0%