MISP Question

[taejun]

Hi guys, I have q question while setup chronicle.

When checking ioc matehes log, I can check the feed information "MISP"

 Is chronicle already integrated with MISP?

If i want to write a rule with MISP data, do i not need to do any additional MISP integration work?

[DanHansen]

To the best of my knowledge it is not. While some things show up in Chronicle as values they're not all fully integrated. There's a really detailed guide on medium on integrating it into Chronicle yourself though. https://medium.com/@thatsiemguy/how-to-integrate-misp-and-chronicle-siem-9e5fe5fde97c 

[jstoner]

While there are a number of threat intel feeds incorporated into Google SecOps, particularly with the updates we are making to Applied Threat Intelligence, a general MISP instance is not one of them. There may be MISP instances used as aggregation tools that are being used to ingest indicators but if you want to use your own MISP instance and ingest data into it, the guidance in the above link is a good start. I've done a very basic csv read in of exported MISP data as well via a storage bucket as well but I suspect Chris's method is probably more what you have in mind.