MISP and VT Collections

At VirusTotal we are actively working on expanding integrations with the most popular tools used by the infosec community. 

Today we are thrilled to announce tighter integration with MISP through our most recent feature to track threat campaigns and malware toolkits, VT Collections. We have created two new workflows: 

• The ability to export VT Collections to STIX 2, a well-known threat intel exchange format.  
• Functionality to create a collection from IoCs contained in a MISP Event. 

This will allow the exchange of IoCs bidirectionally between MISP and VirusTotal.

VT Collection to MISP

You can export all IOCs contained in a collection using the top-right corner export icon, click on it and select Download all IoCs as STIX:

This will generate a json file that can be imported into MISP using the left menu option, Import from…

MISP Event to VT Collection

To tackle this part of the workflow we have developed a new MISP Module called VirusTotal Collections. This module uses the event exporting option to send IoCs to VirusTotal and create the collection.

To create a collection from a MISP Event you can use the Download as…  button while inspecting an Event, choose VirusTotal Collections as an export format option.

After a few seconds you will get a text file confirming the export process has finished. In the text file you can find the url of the new collection.

And that’s it. If you are a MISP user, ping your MISP instance admin to activate the export module and tell us what you think about this integration in this form (2 minutes).

Stay tuned for more MISP contributions.

Happy Hunting!