MISP to Pandora SIEM
1.0
Miscelaneus » pandorafms.misp_to_pandoraLast update: 2026-03-06 13:56:34
Description
This plugin automates the ingestion of threat intelligence from your MISP (Malware Information Sharing Platform) instance directly into the Pandora FMS SIEM. It proactively fortifies your monitoring environment by downloading the latest Indicators of Compromise (IoCs) and turning them into actionable detection rules.
Additional information
Key Features:
- Automated Threat Ingestion: Securely connects to your MISP instance to retrieve the most recent and active malicious IP addresses reported by the community or your organization.
- Dynamic SIEM Rule Creation: Automatically constructs and updates a Mega-Regex rule within Pandora FMS to detect any network traffic involving these known malicious actors.
- Seamless API Integration: Utilizes the Pandora FMS API v2 to inject the threat intelligence and update the SIEM engine without any manual intervention.
- Instant Hot-Reload: Automatically triggers a hot-reload of the SIEM engine upon successful rule creation, ensuring that your environment is protected immediately.
- Ready for Automation: Designed to be easily scheduled via cron for continuous, daily synchronization, keeping your defenses updated against the latest threats.
Tags
Categories
Newest from same author
Newest in same categories
Newest with same tags
