Looking for help (Cuckoo MISP integration)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 377
- Forks
- 280
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 10
Description
Hi
I have tried to integrate Cuckoo within MISP. My Cuckoo is deployed in an isolate network, so we need to import IOCs into MISP from a Cukoo's generated JSON file.
I activated the Cuckooimport module to populate attributes form Cuckoo in a previous created MISP event.
I analized a malware file with Cuckoo and exported the report analysis to a file.
I have tried to import all generated .json files (report.json and also file.json and task.json) to MISP but all of files I tried to import failed.
I would like to know what is wrong. (We have looked for documentation...).
Would you provide us a feasible cuckoo .json file in order to compare your .json file with ours .json files?
Thank you in advance.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue mentions the Cuckooimport module and report.json, file.json, and task.json; begin by reproducing the failed import into an existing MISP event and comparing those inputs. Done means identifying why the JSON is rejected and documenting or correcting the import path, but the issue does not identify a source file or expected schema.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100