The Malware Information Sharing Platform (MISP) can receive events and indicators
from the Trend Threat Intelligence feed.
Prerequisites:
-
MISP version 2.4 or later
-
-
Perm site admin
-
Perm auth
-
Galaxy editor
-
Write access at the operating system level
-
Add the feed in MISP 
Access the Trend Threat Intelligence Feed through the built-in feeds functionality
in MISP.
Procedure
- In the MISP web interface, select .
- Click Add Feed to display the configuration page.
- Select Enabled.
- Enter the Name and Provider for the feed.
- Enter the regional feed URL from the table below.
Feed URLs
RegionMISP feed URLAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States - Enter the API token as follows:
Authorization: Bearer <your_token> - Click Submit to save the configuration.
Add custom galaxies
After adding the Trend Threat Intelligence Feed in MISP, you can add or update Trend Micro galaxies using the Python script available here.
Alternatively, you can manually add custom galaxies by following the steps below.
Procedure
- Download the relevant galaxy JavaScript Object Notation (JSON) files from the URL
for your region shown in the table below.Available Trend Micro galaxy types:
-
trendmicro-campaign-galaxy
-
trendmicro-intrusion-set-galaxy
-
trendmicro-malware-galaxy
-
trendmicro-tool-galaxy
-
trendmicro-vulnerability-galaxy
Galaxy URLs
RegionGalaxy URL templateAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States -
- Copy the files to the galaxies folder (location may vary):
/var/www/MISP/app/files/misp-galaxy/galaxies/ - Click Force Update Galaxies to save changes.
Add custom clusters
After adding the Trend Threat Intelligence Feed in MISP, you can add or update Trend Micro clusters using the Python script available here.
Alternatively, you can manually add custom galaxies by following the steps below.
Procedure
- Download the relevant cluster JSON files from the URL for your region shown in the
table below.
Cluster URLs
RegionCluster URL templateAustraliaEuropean UnionIndiaJapanSingaporeUnited Arab EmiratesUnited States - Copy the files to the clusters folder (location may vary):
/var/www/MISP/app/files/misp-galaxy/clusters/ - Click Force Update Galaxies to save changes.