From bf1d501e98807709707909ed714de00cd0a58288 Mon Sep 17 00:00:00 2001 From: Gael Muller Date: Thu, 12 Sep 2024 10:36:53 +0200 Subject: [PATCH] Update misp.md --- .../intelligence_center/integrations/misp.md | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/_shared_content/intelligence_center/integrations/misp.md b/_shared_content/intelligence_center/integrations/misp.md index eefd2b0f93..ac1075d1c7 100644 --- a/_shared_content/intelligence_center/integrations/misp.md +++ b/_shared_content/intelligence_center/integrations/misp.md @@ -9,7 +9,7 @@ To fetch Sekoia.io’s MISP feed, you’ll have to generate an API key with the The following field values are required for the feed to work properly: - Input Source: Network -- URL: `https://api.sekoia.io/api/v2/inthreat/misp` +- URL: `https://api.sekoia.io/v1/misp-gateway/misp` - Source Format: MISP Feed - Headers: `Authorization: Bearer ` (please replace `` with the secret API key) - Enabled: `True` @@ -20,16 +20,8 @@ You then need to make sure you have a scheduled task in place to regularly fetch !!! note - MISP adds automatically the suffix `/manifest.json` to the feed URL. If you want to try the connection to the feed outside MISP or make a custom script, you need to use the following URL: `https://api.sekoia.io/api/v2/inthreat/misp/manifest.json` - -## Beta Version of Sekoia.io’s MISP Feed - -!!! warning - - This feed is still considered as beta and should be used carefuly. If you find any regression or issue with this new feed, please contact your support. + MISP adds automatically the suffix `/manifest.json` to the feed URL. If you want to try the connection to the feed outside MISP or make a custom script, you need to use the following URL: `https://api.sekoia.io/v1/misp-gateway/misp/manifest.json` The new MISP feed contains all non-expired Sekoia.io intelligence material and is constantly kept in sync with SEKOIA.IO’s intelligence feed. This way, when an indicator is updated in SEKOIA.IO, that latter will be also updated in the MISP feed. This will ensure that the indicator is not duplicated each time an indicator is updated. The MISP feed is organized by data “source” per creation date of the indicator. Hence, if an indicator has several sources, it will be included in several MISP events. - -You can configure your MISP instance to read Sekoia.io’s MISP feed by using this URL: `https://api.sekoia.io/v1/misp-gateway/misp`.