Views:

TrendAI Vision One™ enables transfer of suspicious object data and retrieval of threat intelligence data from the MISP threat sharing platform through a Service Gateway.

Important
Important
The MISP API does not return unpublished events for version 2.4.717 or later. Publish events on the MISP server to ensure that threat intelligence data can be sent to TrendAI Vision One™.
To send MISP attributes as suspicious objects to TrendAI Vision One™, add the Intrusion Detection System flag. This determines if the attribute can be automated.
For more information about MISP instance sizing, see Sizing your MISP instance.

Procedure

  1. In the TrendAI Vision One™ console, go to Workflow and Automation → Third-Party Integration.
  2. Locate and click the MISP card.
  3. On the Service Gateway Connection tab, turn on the toggle to enable the MISP connection.
  4. Select Send data to MISP.
  5. Configure settings to allow TrendAI Vision One™ to send suspicious object data to MISP.
  6. Select Retrieve data from MISP.
  7. Configure settings to allow TrendAI Vision One™ to retrieve threat intelligence data from MISP.
    You can only add indicator type STIX objects that are not revoked and do not have the anomalous activity, anonymization, benign, compromised, or unknown labels to the Suspicious Object List.
    Auto sweeping is only supported for report type STIX objects.
  8. Under Service Gateway Connection, configure the connection between the Service Gateway and the integration.
    The Service Gateway Connection panel appears.
  9. Select a Service Gateway from the list.
    If there are no Service Gateways available, go to Workflow and Automation → Third-Party Integration → Service Gateway Management to manage your virtual appliances.
  10. Click Connect.
  11. Click Save.