MISP / MISP/misp-modules

Looking for help (Cuckoo MISP integration)

Open
#155 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

Hi

I have tried to integrate Cuckoo within MISP. My Cuckoo is deployed in an isolate network, so we need to import IOCs into MISP from a Cukoo's generated JSON file.

I activated the Cuckooimport module to populate attributes form Cuckoo in a previous created MISP event.

I analized a malware file with Cuckoo and exported the report analysis to a file.

I have tried to import all generated .json files (report.json and also file.json and task.json) to MISP but all of files I tried to import failed.

I would like to know what is wrong. (We have looked for documentation...).

Would you provide us a feasible cuckoo .json file in order to compare your .json file with ours .json files?

Thank you in advance.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue mentions the Cuckooimport module and report.json, file.json, and task.json; begin by reproducing the failed import into an existing MISP event and comparing those inputs. Done means identifying why the JSON is rejected and documenting or correcting the import path, but the issue does not identify a source file or expected schema.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.