Implementation of information from MISP through the eCrimeLabs API and into SecurityOnion
- Security Onion (installed,configured)
- eCrimeLabs Broker API access and API Key
- Download and Configure (on Master or Standalone)
Clone the repo:
git clone https://github.com/eCrimeLabs/securityonion-ecrimelabs
Run the setup script:
sudo bash securityonion-ecrimelabs/setup-ecrimelabs
Update rules (if desired):
/usr/sbin/download-ecrimelabs sudo rule-update
Confirm rules in place:
cat /etc/nsm/rules/alert.ecrimelabs.rules cat /etc/nsm/rules/incident.ecrimelabs.rules
Confirm Bro Intel in place:
A cron job will run every 2 hours to download new NIDS rules and Intel.
Remember to modify ecrimelabscfg
The setup will allways pull the incident feed, and here from it is up to the individual implementation on what other feeds will be extracted.