MISP

This room explores the MISP (Malware & Threat Sharing Platform) through its core objective to foster the sharing of structured threat information among security analysts, malware researchers, and IT professionals. In this room, you will pivot from a single hash into a full campaign picture using a pre-populated MISP instance, and learn how to integrate MISP into your SOC processes.

Learning Objectives

• Learn the purpose of MISP for small and large security teams
• Extract attributes, objects, tags, and galaxies from MISP events
• Investigate a threat based on a high-severity MISP event

Room Prerequisites

• Threat Analysis Tools module
• General familiarity with security concepts

Lab Access

For this lab, we will be using a live MISP instance with pre-ingested events.
Click Start Machine, wait a few minutes, and open MISP in your browser by following this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine