Skip to content

Import Modules

ANYRUN Sandbox Import

A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event. [source code]

  • features:

    Fetches detailed JSON reports using the ANY.RUN API; parses key elements like verdict, extracted IOCs (hashes, IPs, URLs), malware tags; maps data to MISP attributes and galaxies (e.g., malware family or MITRE ATT&CK Techniques).

  • config:

    • api_key
    • proxy_host
    • proxy_port
    • proxy_username
    • proxy_password

  • input:

    ANY.RUN Sandbox analysis UUID.

  • output:

    Analysis external references, verdict, IOCs (hashes, IPs, URLs), malware tags, MITRE ATT&CK Techniques

  • references:

    https://any.run

  • requirements:

    • anyrun-sdk: ANY.RUN API python3 library
    • ANY.RUN Sandbox API-KEY

PDNS COF Importer

Passive DNS Common Output Format (COF) MISP importer [source code]

CSV Import

Module to import MISP attributes from a csv file. [source code]

  • features:

    In order to parse data from a csv file, a header is required to let the module know which column is matching with known attribute fields / MISP types.

    This header either comes from the csv file itself or is part of the configuration of the module and should be filled out in MISP plugin settings, each field separated by COMMAS. Fields that do not match with any type known in MISP or are not MISP attribute fields should be ignored in import, using a space or simply nothing between two separators (example: 'ip-src, , comment, ').

    If the csv file already contains a header that does not start by a '#', you should tick the checkbox 'has_header' to avoid importing it and have potential issues. You can also redefine the header even if it is already contained in the file, by following the rules for headers explained earlier. One reason why you would redefine a header is for instance when you want to skip some fields, or some fields are not valid types.

  • input:

    CSV format file.

  • output:

    MISP Event attributes

  • references:

  • requirements:

    PyMISP

Cuckoo Sandbox Import

Module to import Cuckoo JSON. [source code]

Darkmoon Import

Module to import the JSON findings of the Darkmoon autonomous AI penetration testing platform. [source code]

  • features:

    Takes the JSON findings file written by the Darkmoon open source CLI (either a list of findings or an object with a findings list) and creates one vulnerability object per finding, with the CVE, the CVSS score and vector, the description, the remediation and the evidence that proves it. The endpoint of the finding is added as a url object that the vulnerability affects. The severity, the exploitation status (exploited, confirmed or unconfirmed) and the MITRE ATT&CK technique are added as tags.

  • input:

    Darkmoon JSON findings file

  • output:

    MISP vulnerability and url objects

  • references:

    https://github.com/ASCIT31/Dark-Moon

  • requirements:

    PyMISP

DMARC Import

Import DMARC aggregate XML reports, including gzip and ZIP files. [source code]

  • features:

    Upload an aggregate XML report (.xml, .xml.gz, or a ZIP containing exactly one XML file), or paste XML. Creates an annotation object with report metadata, published policy and the original XML attachment. Each aggregate record becomes a linked domain-ip object with its source IP (ip-src), header-from domain, reporting interval and a JSON text attribute preserving counts, disposition, SPF/DKIM results, identifiers and extension fields. Additional identifier and authentication domains are included for correlation. All attributes have to_ids disabled: DMARC observations do not by themselves identify malicious senders. No API key or network access is needed. Input and decompressed XML are limited to 20 MiB each, with at most 10,000 records and 32 XML nesting levels. DTDs, encrypted or multi-file ZIPs, nested archives and forensic/failure reports (RUF/ARF) are not supported. Invalid records reject the entire import.

  • input:

    DMARC aggregate XML, optionally gzip- or ZIP-compressed

  • output:

    MISP annotation and domain-ip objects with report context and authentication results

  • references:

  • requirements:

    PyMISP

Email Import

Email import module for MISP [source code]

  • features:

    This module can be used to import e-mail text as well as attachments and urls. Configuration parameters are used to unzip attachments, guess zip attachment passwords, extract urls, remove common subject markers, and extract partial inline forwarded emails (extract_forwarded_emails, disabled by default): set each one of them to True or False to process or not the respective corresponding actions. Forward extraction supports English From/To/Cc/Bcc/Reply-To/Sent/Date/Subject header blocks in plain text and HTML, including Outlook. Folded header values are supported. Each block needs a sender address, a subject, and a recipient or date. At most 20 partial email objects are linked to the carrier with includes references. Plain text is preferred; HTML is used if no forwards are found in plain text. Reconstructed attributes have to_ids disabled; the original email is retained as evidence. Local or unparseable timestamps are preserved as text in the reconstructed headers. Existing extract_urls and remove_subject_markers settings also apply to forwards. URL objects are shared between the carrier and forwards that contain the same URL.

  • config:

    • unzip_attachments
    • guess_zip_attachment_passwords
    • extract_urls
    • remove_subject_markers
    • extract_forwarded_emails

  • input:

    E-mail file

  • output:

    MISP Event attributes

  • references:

    https://github.com/MISP/mail_to_misp

GoAML Import

Module to import MISP objects about financial transactions from GoAML files. [source code]

  • features:

    Unlike the GoAML export module, there is here no special feature to import data from GoAML external files, since the module will import MISP Objects with their References on its own, as it is required for the export module to rebuild a valid GoAML document.

  • input:

    GoAML format file, describing financial transactions, with their origin and target (bank accounts, persons or entities).

  • output:

    MISP objects (transaction, bank-account, person, legal-entity, geolocation), with references, describing financial transactions and their origin and target.

  • references:

    http://goaml.unodc.org/

  • requirements:

    PyMISP

Import Blueprint

Generic blueprint to be copy-pasted to quickly boostrap creation of import module. [source code]

  • features:

Joe Sandbox Import

A module to import data from a Joe Sandbox analysis json report. [source code]

  • features:

    Module using the new format of modules able to return attributes and objects.

    The module returns the same results as the expansion module joesandbox_query using the submission link of the analysis to get the json report.

  • input:

    Json report of a Joe Sandbox analysis.

  • output:

    MISP attributes & objects parsed from the analysis report.

  • references:

Lastline Import

Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.

Module to import and parse reports from Lastline analysis links. [source code]

  • features:

    The module requires a Lastline Portal username and password. The module uses the new format and it is able to return MISP attributes and objects. The module returns the same results as the lastline_query expansion module.

  • config:

    • username
    • password
    • verify_ssl

  • input:

    Link to a Lastline analysis.

  • output:

    MISP attributes and objects parsed from the analysis report.

  • references:

    https://www.lastline.com

MISP JSON Import

Module to import MISP JSON format for merging MISP events. [source code]

  • features:

    The module simply imports MISP Attributes from an other MISP Event in order to merge events together. There is thus no special feature to make it work.

  • input:

    MISP Event

  • output:

    MISP Event attributes

OCR Import

Optical Character Recognition (OCR) module for MISP. [source code]

  • features:

    The module tries to recognize some text from an image and import the result as a freetext attribute, there is then no special feature asked to users to make it work.

  • input:

    Image

  • output:

    freetext MISP attribute

OpenIOC Import

Import legacy OpenIOC 1.0 and 1.1 files into MISP. [source code]

  • features:

    A backup import path for legacy .ioc files after removal of the core OpenIOC importer in MISP 3.0. Upload an OpenIOC 1.0 (ioc/definition) or 1.1 (OpenIOC/criteria) XML file through Import from modules, using openiocimport. Common file, network, email, registry, mutex and service fields become MISP attributes; unmapped fields are retained as other attributes. The original XML is attached by default; the existing not save ioc and default tag options are supported. XML DTDs and custom entities are rejected. This extracts observables, rather than evaluating OpenIOC rules: conditions, negation, case sensitivity, item IDs and the AND/OR group path are recorded in attribute comments. All attributes have to_ids=false for review. Correlation is disabled for grouped AND terms, non-exact or negated conditions and unmapped fields, so these are not treated as independent exact indicators. Keep the attachment for the full rule.

  • input:

    OpenIOC 1.0 or 1.1 XML (.ioc or .xml), including namespace-free legacy files

  • output:

    MISP Event attributes and the optional original IOC attachment

  • references:

    https://github.com/mandiant/ioc_writer

  • requirements:

    PyMISP

PCAP Import

Import a PCAP or PCAPNG capture, including reassembled files, emails and network indicators. [source code]

  • features:

    Parses captures offline with TShark, without capture privileges or network lookups. Extracts IPv4/IPv6 endpoints, DNS names and answers, HTTP URLs, hosts and user agents, and TLS SNI hostnames. Reassembles HTTP files and SMTP messages; reuses email_import for email objects, attachments and body URLs. Requires complete, unencrypted application traffic for payload extraction; HTTPS yields visible TLS metadata only. Other file-transfer protocols and TLS decryption are not supported. Observed network attributes have to_ids disabled for analyst review. Captures are limited to 50 MiB, exported data and JSON metadata to 100 MiB each. timeout is a positive number of seconds, at most 300 (default 60). Output sizes, including diagnostics, are checked every 50 ms while TShark runs; exceeding a limit kills the process. Bursts can overshoot between checks; these checks are not filesystem quotas.

  • config:

    timeout

  • input:

    Base64-encoded PCAP or PCAPNG file

  • output:

    MISP network attributes, file and email objects, including attachments and hashes

  • references:

  • requirements:

    • TShark >= 4.0 on the service user's PATH (Debian/Ubuntu: apt install tshark)
    • PyMISP with email and fileobjects extras (included in misp-modules[all])

SOCRadar TAXII Feed Import

Import threat indicators from SOCRadar TAXII 2.1 feed with MITRE ATT&CK, malware family, confidence, and geo tagging. Leave collection_id empty and type 'list' to discover available collections. [source code]

  • features:

    Connect to SOCRadar TAXII 2.1 server and import enriched threat indicators into MISP. Indicators are automatically tagged with MITRE ATT&CK techniques, malware families, confidence levels, feed sources, and country information. Supports collection auto-discovery — leave collection_id empty and type 'list' to see all available collections.

  • config:

    • socradar_taxii_url
    • socradar_api_root
    • socradar_username
    • socradar_password

  • input:

    SOCRadar TAXII 2.1 collection endpoint.

  • output:

    MISP attributes with rich tagging.

  • references:

  • requirements:

    requests

TAXII 2.1 Import

Import content from a TAXII 2.1 server [source code]

  • features:

  • config:

    stix_object_limit

  • requirements:

    • misp-lib-stix2
    • misp-stix

CSV Test Import

Simple CSV import tool with mapable columns [source code]

  • features:

ThreadAnalyzer Sandbox Import

Module to import ThreatAnalyzer archive.zip / analysis.json files. [source code]

  • features:

    The module imports MISP Attributes from a ThreatAnalyzer format file. This file can be either ZIP, or JSON format. There is by the way no special feature for users to make the module work.

  • input:

    ThreatAnalyzer format file

  • output:

    MISP Event attributes

  • references:

    https://www.threattrack.com/malware-analysis.aspx

URL Import

Simple URL import tool with Faup [source code]

  • features:

VMRay API Import

Module to import VMRay (VTI) results. [source code]

  • features:

    The module imports MISP Attributes from VMRay format, using the VMRay api. Users should then provide as the module configuration the API Key as well as the server url in order to fetch their data to import.

  • config:

    • apikey
    • url
    • disable_tags
    • disable_misp_objects
    • ignore_analysis_finished

  • input:

    VMRay format

  • output:

    MISP Event attributes

  • references:

    https://www.vmray.com/

  • requirements:

    vmray_rest_api

VMRay Summary JSON Import

Import a VMRay Summary JSON report. [source code]

  • features:

  • config:

    disable_tags