docker-misp - Automated Docker MISP container - Malware Informat

项目说明

Docker MISP Container
=====================

Latest Update: 4-14-2020

Following the Official MISP Ubuntu 18.04 LTS build instructions.

Latest Upstream Change Included: a62bca4e169c919413bba4e6ce978e30aae9183e

Github repo + build script here:

(note: after a git pull, update with your own passwords/FQDN, and then build the image)

What is this?

This is an easy and highly customizable Docker container with MISP -
Malware Information Sharing Platform & Threat Sharing ()

Our goal was to provide a way to setup + run MISP in less than a minute!

We follow the official MISP installation steps e possible,
while adding automation around tedious manual steps and configurations.

We have done this without sacrificing options and the ability to
customize MISP for your unique en! Some examples include:
auto changing the salt hash, auto initializing the database, auto generating GPG
keys, auto generating working + secure configs, and adding custom
passwords/domain names/email addresses/ssl certificates.

The misp-modules extensions functionality has been included and can be
accessed from ]:6666/modules.
(thanks to Conrad)

Build Docker container Dockerhub binary?

We always recommend building your own Docker MISP image using our "build.sh" script.
This allows you to change all the passwords and customize a few config options.

That said, you can pull down the Dockerhub binary image, but this is
_not_ supported or recommended. It's there purely for con, and so that you can "get
a feel" for MISP without building it. It will by default contain "LOCALHOST" as all configured host e, and this will only work on the same system or if you proxy/port forward.

Building your own MISP Docker image is incredibly simple:

This will produce an image called:

How to run it in 3 steps:

About - If you are running Docker on a Mac, there are some mount directory restrictions by default (see: ). Your needs to be either one of the supported defaults ("Users", "", "private", or "tmp"), otherwise, you must go to "Preferences" -> "File Sharing" and add your chosen $docker-root to the list.

We would suggest using for your , and if using a Mac, adding that to the File Sharing list.

Once you have your DB directory created (), follow the 3 steps:

1. Initialize Database

2. Start the container

3. Access Web URL

And change the password! :)

What can you customize/pass during build?

You can customize the script to pass custom:

* MYSQL_MISP_PASSWORD
* POSTFIX_RELAY_HOST
* MISP_FQDN
* MISP_EMAIL
* MISP_GPG_PASSWORD

See build.sh for an example on how to customize and build your own image with custom defaults.

How to use custom SSL Certificates:

During run-time, o

And in your dir, create private/public certs with file names:

* misp.key
* misp.crt

Security note in regards to key generation:

We ha "rng-tools" in order to help with entropy generation,
since users ha that during the pgp generation, some
systems have a hard time creating enough "randomness". This in turn
uses a pseudo-random generator, which is not 100% secure. If this is a
concern for a production en, you can either 1.) take out the
"rng-tools" part from the Dockerfile and re-build the container, or
2.) replace the keys with your own! For most users, this should not
ever be an issue. The "rng-tools" is removed as part of the build
process after it has been used.

Using a reverse proxy/SSL offloading (Traefik, Caddy, HAProxy, Nginx, etc)

You will need to removing the SSL block (see: /etc/apache2/sites-a/default-ssl.conf)

And replace the HTTP block (see: /etc/apache2/sites-a/000-default.conf with:

If you don't want to build a new image with this, you can simply add to your run-time:
(note again: $docker-root is the place holder for your docker container and configs path)

Contributions:

Conrad Crampton: - RNG Tools and MISP Modules

Jeremy Barlow: -mcafee - Cleanup, configs, con, python 2 vs 3 compatibility

Matt Saunders: -saunders - Fixed all install warnings and errors

Matija Čoklica: - Discovered problem where GPG key was empty, lots of python/misp modules debugging (thanks!)

Help/Questions/Comments:

For help or more info, feel free to contact Ventz

项目信息

开发语言：Dockerfile

Star 数：174

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automated Docker MISP container - Malware Information Sharing Platform and Threat Sharing展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。