topic Re: XSOAR MISP - sync in Cortex XSOAR Discussions

XSOAR MISP - sync

tlmarques — Tue, 24 Sep 2024 15:02:16 GMT

Hi,
Does anyone have a #Cortex XSOAR sync with a MISP server (bidirectional sync)?

I have two objectives:

I have several indicators on my XSOAR, and my goal is to upload these indicators to MISP (including adding the "XSOAR" tag).
XSOAR should query MISP and update local indicators based on matches found in MISP.

Does anyone know if this is possible?
Is a playbook necessary for updates and synchronization?

Re: XSOAR MISP - sync

Ivetto — Wed, 25 Sep 2024 17:20:57 GMT

Hello,

Sadly I do not see we support mirroring for this integration so this will have to be through a job that runs every time the feed is updated or time based (#2) .

Then you could run the commands needed to update MISP with the information found on XSOAR. The MISP v3 integration has several commands that can add objects, events and attributes to MISP so that should assist in #1.

This would definitely have to be a custom playbook as we do not have any OOTB.