Integrate with MISP
This tutorial will show you how to connect a team folder or board to your MISP instance, so that all the IoCs from this source will be pulled by your MISP instance regularly.
1. In Feedly, go to the team folder or board that you want to export from
The MISP feed is only accessible from a Team Folder or Team Board. It is not available for individual Web Alerts.(Please note: You will need admin permissions to access this feature.)
2. Click on ... > Sharing
3. Click on Activate MISP Feed
4. Copy the URL
5. In your MISP instance, go to Sync Actions > List Feeds
6. In the leftnav, click on Add Feed
7. Enter the relevant information
8. Manually trigger the fetch
9. Verify that the events are successfully imported
- It should show all the articles from the past 24h in this board/feed that contain IoCs.
That’s it, your MISP instance should now automatically pull the feed at regular intervals.
The MISP feed is updated every hour. If you added articles to a board after creating the MISP feed, you will need to wait for them to show
Troubleshooting
- I added articles to a board but they didn’t appear in MISP
- You need to wait for up to 1 hour for the articles to show in your MISP instance.