apiosintDS MISP Module
apiosintDS is included as enrichment module in the official MISP-Modules repository. This guide assume you have your MISP instance up and running with MISP Modules correctly initializated.
The module has been specially designed for people and organizations don’t want to subscribe the DigitalSide Threat-Intel MISP Feed and prefer to query it as an on demand service.
Warning
If DigitalSide Threat-Intel MISP Feed is enabled and regulary fetched by your MISP instance, don’t use this plugin. All information retrivable by the plugin are just included in your MISP events dataset. The MISP correlation engine should be used instead.
Input / Output
- Module type
MISP module type.
- Module-type:
['hover', 'expansion']
- Input
The module runs against the following MISP attributes type.
- Input-attributes:
["domain", "domain|ip", "hostname", "ip-dst", "ip-src", "ip-dst|port", "ip-src|port"]
["url", "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256"]
- Output
The module returns the following MISP attributes type.
- Output-attributes:
["domain", "ip-dst", "url", "comment", "md5", "sha1", "sha256", "link", "text"]
Configuration
Go to your MISP web interface and login with a user account able to edit plugins configuration. Once logged in go to Administration >> Server Settings & Maintenance >> Plugin
and select the Enrichment
tab. Put in the search input filter apiosintds
in order to show only the needed configuration settings.

- Plugin.Enrichment_apiosintds_enabled
MISP internal configuration to enable or disable the module.
- Type:
boolean
- Default:
false
Note
To enable the plugint configure the valute to
true
.
- Plugin.Enrichment_apiosintds_restrict
Restrict the plugin use to a single organization.
- Type:
enum
- Default:
No organization selected
- Allowed:
ORG in the given MISP instance
- Plugin.Enrichment_apiosintds_STIX2_details
Dowload and parse additional information from online STIX report.
- Type:
enum
- Default:
no
- Allowed:
[yes|no]
Note
STIX2 reports may be not available due to data retention policy.
Parse and include in the results related items.
- Type:
enum
- Default:
no
- Allowed:
[yes|no]
Note
Is strongly reccommended to configure it to
yes
to obtain best results.
- Plugin.Enrichment_apiosintds_cache
Enable cache mode. Downloaded lists will be stored and won’t be downloaded untile the cache timeout is reached.
- Type:
enum
- Default:
no
- Allowed:
[yes|no]
- Plugin.Enrichment_apiosintds_cache_directory
The cache directory where the script check for cached list files and where them will be stored on cache cache creation or update.
- Type:
string
- Default:
None
- Example:
/path/to/cachedir
Note
Read and write permissions are required for the system user running the MISP instance (depends on your installation configuration, should be one between
www-data
,misp
,apache
, others…)
- Plugin.Enrichment_apiosintds_cache_timeout_h
Define the cache timeout in hours.
- Type:
integer
- Default:
4
Note
0
is allowed but means no timeout. Default value is4
hours. This option needs to be used in combination withapiosintds_cache
option configured to True.
- Plugin.Enrichment_apiosintds_local_directory
Absolute path to the ‘Threat-Intel’ directory related to a local project clone. Searches are performed against local data.
- Type:
string
- Default:
Empty
- Example:
/path/to/git/clone/Threat-Intel/
Note
Before using this option, clone the GitHub project in a file system where the library has read permissions. Don’t forget to use –depth=1 and –branch=master options if you don’t want to download all project commits.
Make sure the system user running the MISP instance has read permissions on the directory.
$ cd /path/to/git/clone/ $ git clone --depth=1 --branch=master https://github.com/davidonzo/Threat-Intel.git $ chown -R $MISP_SYSTEM_USER:$MISP_SYSTEM_GROUP Threat-Intel
When this option is in use, all cache related options are ignored. To update data in your local repository destroy the existing data and clone it again.
$ cd /path/to/git/clone/ $ rm -rf Threat-Intel/ $ git clone --depth=1 --branch=master https://github.com/davidonzo/Threat-Intel.git $ chown -R $MISP_SYSTEM_USER:$MISP_SYSTEM_GROUP Threat-Intel
Usage: hover
Using the module as hover
plugin retrived data will be displayed as follow.

Usage: enrichment
Using the module as enrichment
plugin retrived data will be imported as follow.
