{"id":19648239,"url":"https://github.com/bestpractical/rtir-extension-misp","last_synced_at":"2025-07-09T19:37:47.148Z","repository":{"id":66697640,"uuid":"395775390","full_name":"bestpractical/rtir-extension-misp","owner":"bestpractical","description":null,"archived":false,"fork":false,"pushed_at":"2021-11-03T14:42:06.000Z","size":68,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-30T16:37:20.012Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://metacpan.org/release/rtir-extension-misp","language":"Perl","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bestpractical.png","metadata":{"files":{"readme":"README","changelog":"Changes","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-08-13T19:43:50.000Z","updated_at":"2024-09-18T11:11:46.000Z","dependencies_parsed_at":"2023-06-04T04:00:35.038Z","dependency_job_id":null,"html_url":"https://github.com/bestpractical/rtir-extension-misp","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/bestpractical/rtir-extension-misp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bestpractical%2Frtir-extension-misp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bestpractical%2Frtir-extension-misp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bestpractical%2Frtir-extension-misp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bestpractical%2Frtir-extension-misp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bestpractical","download_url":"https://codeload.github.com/bestpractical/rtir-extension-misp/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bestpractical%2Frtir-extension-misp/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264502491,"owners_count":23618619,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T14:47:33.616Z","updated_at":"2025-07-09T19:37:47.079Z","avatar_url":"https://github.com/bestpractical.png","language":"Perl","funding_links":[],"categories":[],"sub_categories":[],"readme":"NAME\n    RTIR-Extension-MISP - Integrate RTIR with MISP\n\nDESCRIPTION\n    MISP \u003chttps://www.misp-project.org/\u003e is a platform for sharing threat\n    intelligence among security teams, and this extension provides\n    integration from RTIR \u003chttps://bestpractical.com/rtir\u003e.\n\nRTIR VERSION\n    Works with RTIR 5.0\n\nINSTALLATION\n    perl Makefile.PL\n    make\n    make install\n        May need root permissions\n\n    Patch RTIR for versions prior to 5.0.2\n            patch -p1 -d /opt/rt5/local/plugins/RT-IR \u003c patches/Add-callbacks-to-the-feed-listing-and-display-pages.patch\n\n    Edit your /opt/rt4/etc/RT_SiteConfig.pm\n        Add this line:\n\n            Plugin('RTIR::Extension::MISP');\n\n    make initdb\n        Only run this the first time you install this module.\n\n        If you run this twice, you will end up with duplicate data in your\n        database.\n\n        If you are upgrading this module, check for upgrading instructions\n        in case changes need to be made to your database.\n\n    Clear your mason cache\n            rm -rf /opt/rt4/var/mason_data/obj\n\n    Restart your webserver\n\nCONFIGURATION\n  Base MISP Configuration\n    Set the following in your RT_SiteConfig.pm with details for the MISP\n    instance you want RTIR to integrate with.\n\n        Set(%ExternalFeeds,\n            'MISP' =\u003e [\n                {   Name        =\u003e 'MISP',\n                    URI         =\u003e 'https://mymisp.example.com',  # Change to your MISP\n                    Description =\u003e 'My MISP Feed',\n                    DaysToFetch =\u003e 5,  # For the feed page, how many days back to fetch\n                    ApiKeyAuth  =\u003e 'API SECRET KEY',  # Change to your real key\n                },\n            ],\n        );\n\n  MISP Custom Fields\n    If you want to display the MISP ID custom fields in a separate portlet\n    on the incident page, you can customize your custom field portlets with\n    something like this:\n\n        Set(%CustomFieldGroupings,\n            'RTIR::Ticket' =\u003e [\n                'Networking'     =\u003e ['IP', 'Domain'],\n                'Details' =\u003e ['How Reported','Reporter Type','Customer',\n                              'Description', 'Resolution', 'Function', 'Classification',\n                              'Customer',\n                              'Netmask','Port','Where Blocked'],\n                'MISP IDs'     =\u003e ['MISP Event ID', 'MISP Event UUID'],  # Add/remove CFs as needed\n            ],\n        );\n\nDETAILS\n    This integration adds several different ways to work between the MISP\n    and RTIR systems as described below.\n\n  Consume Feed from MISP\n    After adding the MISP configuration described above, the Feeds page in\n    RTIR at RTIR \u003e Tools \u003e External Feeds will have a new MISP option\n    listed. This feed pulls in events for the past X number of days based on\n    the DaysToFetch configuration. From the feed display page, you can click\n    the \"Create new ticket\" button to create a ticket with information from\n    the MISP event.\n\n  MISP Portlet on Incident Display\n    On the Incident Display page, if the custom field MISP Event ID has a\n    value, a portlet MISP Event Details will be displayed, showing details\n    pulled in from the event via the MISP REST API.\n\n  Update MISP Event\n    On an incident with a MISP Event ID, the Actions menu will have an\n    option \"Update MISP Event\". If you select this action, RTIR will update\n    the existing MISP event with an RTIR object, including data from the\n    incident ticket.\n\n  Create MISP Event\n    If MISP Event ID has no value, the Actions menu on incidents shows an\n    option to \"Create MISP Event\". Select this to create an event in MISP\n    with details from the incident ticket.\n\n  \nAUTHOR\n    Best Practical Solutions, LLC \u003cmodules@bestpractical.com\u003e\n\n    All bugs should be reported via email to\n        bug-RTIR-Extension-MISP@rt.cpan.org\n    or via the web at\n        http://rt.cpan.org/Public/Dist/Display.html?Name=RTIR-Extension-MISP\nLICENSE AND COPYRIGHT\n    This software is Copyright (c) 2021 by Best Practical Solutions, LLC\n\n    This is free software, licensed under:\n\n      The GNU General Public License, Version 2, June 1991\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbestpractical%2Frtir-extension-misp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbestpractical%2Frtir-extension-misp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbestpractical%2Frtir-extension-misp/lists"}