Ingesting IOCs in to CS from MISP

• MISP-tools

  2 32 6.0 Python

  Import CrowdStrike Threat Intelligence into your instance of MISP

  

I'd start with intel_client.py (most CS interactions happen here) and indicators.py (the logic for the handling of indicators, a lot of this is PyMISP-specific but it will help you identify data elements you want to bring over).

• PyMISP

  3 422 9.2 Python

  Python library using the MISP Rest API

  

If you're in Python, you can use PyMISP to login and get the new indicators, and then FalconPy to import them into your CrowdStrike tenant. (Basically the reverse of what the MISP-tools example is doing. You could start here and alter the logic.)

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• falconpy

  30 306 9.5 Python

  The CrowdStrike Falcon SDK for Python

  

If you're in Python, you can use PyMISP to login and get the new indicators, and then FalconPy to import them into your CrowdStrike tenant. (Basically the reverse of what the MISP-tools example is doing. You could start here and alter the logic.)

Suggest a related project