Malware Information Sharing Platform

introduction this guide tells you how to authenticate the misp (malware information sharing platform) connector in swimlane using api key authentication you will generate a misp authentication key, collect the required connection details, and configure the connector in swimlane the connector authenticates using an api key passed in the authorization header the connector details referenced below are from the uploaded swimlane connector documentation prerequisites misp access requirements you must have permissions to log in to your misp instance create or manage authentication keys access the misp rest api view or manage events and attributes, depending on the connector actions you plan to use required credentials during setup, you will collect misp server url misp api key misp setup take the following steps to generate an api key log in to your misp instance from the left navigation menu, click administration select list auth keys click + add authentication key enter a descriptive comment for the key (optional) restrict the key to specific ip addresses (optional) set an expiration date click submit copy the generated authentication key store the key securely, as it will be required when configuring the swimlane connector take the following steps to obtain the misp url open your misp instance in a web browser copy the base url example https //misp company com do not include any api endpoints such as /attributes or /events connector configuration in swimlane log in to turbine from the left hand navigation pane, click orchestration and click assets asset homepage opens click the plus icon to open the configure your connector asset window select misp from the asset type list fill in the asset settings and asset input as shown field description required/optional url base url of your misp instance (for example, https //misp company com) required authorization misp api key required verify ssl enable/disable ssl verification optional http proxy optional proxy configuration optional fields with marks are required click create troubleshooting authentication failed (401 unauthorized) verify that the api key is correct the api key has not expired the api key has not been revoked forbidden (403) verify that your misp user has permission to access the api your account has permission to perform the connector actions your api key is allowed to access the requested resources unable to connect verify that the misp url is correct the misp server is reachable from the swimlane instance any required firewall rules allow https traffic ssl certificate errors if ssl verification fails verify that the misp server is using a trusted certificate import the ca certificate if your organization uses an internal ca disable verify ssl only for testing if permitted by your organization's security policy result you have successfully authenticated the misp connector in swimlane sources misp automation documentation https //www circl lu/doc/misp/automation/ https //www circl lu/doc/misp/automation/ misp openapi documentation https //www misp project org/openapi/ https //www misp project org/openapi/ misp project documentation https //www misp project org/documentation/ https //www misp project org/documentation/