MISP Feed Generator

This project aims to be a MISP multi-tool for generating feeds from MISP

Usage

usage: generate.py [-h] [--debug] [-a | -f FEEDS] config

positional arguments:
config The configuration file to run

optional arguments:
-h, --help show this help message and exit
--debug Debug output
-a, --all Process all feeds
-f FEEDS, --feeds FEEDS  Comma list of case sensitive feeds

Existing Modules

Output Formats

• MISP Format
• CSV
• Screen

Modifiers

• Anonymize

Post-Hooks

• Shell

Dotty Notation

Some paramaters (where documented) use dotty notation. This makes deeply nested fields accesable in as a text variable.

You can find out more in the dotty notation wiki page.

Docker Image

A docker image is provided for use.

The docker image includes

• cron
• ssh
• rsync
• /entrypoint_cron.sh which launches crond

You can load cron.d tab files by volumemounting them into /etc/cron.d/feedgen

See the example docker-compoase.yml file