Implementation of information from MISP through the eCrimeLabs API and into SecurityOnion
Prerequisites:
- Security Onion (installed,configured)
- eCrimeLabs Broker API access and API Key
- Download and Configure (on Master or Standalone)
Clone the repo:
git clone https://github.com/eCrimeLabs/securityonion-ecrimelabs
Run the setup script:
sudo bash securityonion-ecrimelabs/setup-ecrimelabs
Update rules (if desired):
/usr/sbin/download-ecrimelabs
sudo rule-update
Confirm rules in place:
cat /etc/nsm/rules/alert.ecrimelabs.rules
cat /etc/nsm/rules/incident.ecrimelabs.rules
Confirm Bro Intel in place:
cat /opt/bro/share/bro/intel/ecrimelabs-intel.dat
A cron job will run every 2 hours to download new NIDS rules and Intel.
Remember to modify ecrimelabscfg
The setup will allways pull the incident feed, and here from it is up to the individual implementation on what other feeds will be extracted.