Lion Cipher Lab
Set up a MISP threat-sharing instance
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Extracting a clean list of indicators is only half the job; the other half is storing that intelligence so it can be searched, correlated with everything else you know, and shared with the people entitled to receive it. MISP (Malware Information Sharing Platform) is the open-source tool the security community actually uses for that, from national CERTs to private-sector sharing groups. Running your own instance teaches the workflow that sits at the centre of modern threat intelligence: turn a report into a structured event, tag it so its handling rules travel with it, let the platform reveal…
What you'll learn
- what a threat intelligence platform (TIP) is and why one exists
- running MISP locally with the official Docker image and Docker Compose
- the MISP data model: events, attributes (IOCs), objects
- creating an event and adding attributes to it
- tagging with TLP and galaxies, and what each conveys
- how MISP correlates indicators across events automatically
- sharing groups, sharing communities, and how TLP governs who may receive intel
- exporting intelligence to STIX, CSV, and as a feed
Steps in this lab
- What MISP is, and what a threat intelligence platform does
- Stand up MISP with the official Docker image
- Log in and secure the instance
- Create your first event
- Add attributes: the indicators that live inside the event
- Tag it: TLP and galaxies
- Correlation and sharing: how MISP connects and distributes intel
- Export: STIX, CSV, and feeds
- The honest ceiling: a platform amplifies whatever you feed it