skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

building-threat-feed-aggregation-with-misp

Deploy MISP to aggregate, correlate, and export threat intelligence feeds to SIEM platforms.

954|172|Updated Mar 13, 2026
Search Tags:#docker#threat intelligence#ioc#misp#pymisp#feed aggregation#siem integration
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill building-threat-feed-aggregation-with-misp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: building-threat-feed-aggregation-with-misp
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/building-threat-feed-aggregation-with-misp
Command: npx skills add https://github.com/xalgord/xalgorix --skill building-threat-feed-aggregation-with-misp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pymisp, requests.

What problem does it solve?

Security teams struggle to collect and correlate indicators of compromise scattered across dozens of OSINT and commercial threat feeds, leaving SIEMs and blocklists without centralized, deduplicated IOC data.

Core Features & Use Cases

  • Docker-based MISP deployment: Spin up a full MISP stack with MySQL and Redis using a ready Docker Compose configuration.
  • Feed management via PyMISP: Enable default OSINT feeds (abuse.ch URLhaus, Feodo Tracker, CIRCL) and add custom CSV, freetext, or MISP-format feeds programmatically.
  • IOC search, correlation, and export: Search indicators with warninglist enforcement, correlate across events, and export to Splunk HEC or flat blocklists for firewalls and proxies.
  • Use Case: A SOC analyst deploys MISP, enables abuse.ch feeds, fetches indicators daily, and exports the last 7 days of ip-dst IOCs as a blocklist for the perimeter firewall.

Quick Start

Ask the AI to deploy MISP with Docker Compose and configure the default abuse.ch and CIRCL OSINT feeds using the PyMISP API.

Frequently Asked Questions about building-threat-feed-aggregation-with-misp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy MISP with Docker?▼

Deploy MISP with Docker Compose using the coolacid/misp-docker image alongside MySQL 8.0 and Redis 7 containers. Set environment variables for the database credentials, admin email, and base URL, then expose ports 80 and 443.

How do I add custom threat feeds to MISP with PyMISP?▼

Use the PyMISP MISPFeed object to define the feed name, URL, provider, and source_format (csv, freetext, or misp), then call add_feed. Match source_format to the actual feed format, since pointing a CSV feed at the misp parser silently ingests zero attributes.

Can MISP export IOCs to Splunk?▼

Yes, MISP indicators can be exported to Splunk via the HTTP Event Collector by searching attributes with PyMISP and posting each IOC as a JSON event to the HEC endpoint. You can also export flat IOC lists for firewall and proxy blocklists.

Why is my MISP feed not importing any indicators?▼

The most common cause is a mismatched source_format, such as pointing a CSV feed at the misp parser. Also check that the feed is enabled, the URL is reachable, and verify attribute counts increased after running fetch_feed.

How do I reduce false positive correlations in MISP?▼

Enable warninglists with enforceWarninglist=True and include known-CDN and RFC1918 lists so benign values do not auto-correlate across events. Large CIDR feeds and CDN IPs are the main sources of correlation noise.

Related Skills

Explore More Software Engineering Skills→
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced