Views:

TrendAI Vision One™ enables transfer of suspicious object data and retrieval of threat intelligence data directly with the MISP threat sharing platform.

Important
Important
  • The MISP API does not return unpublished events for version 2.4.717 or later. Publish events on the MISP server to ensure that threat intelligence data can be sent to TrendAI Vision One™.
  • To send MISP attributes as suspicious objects to TrendAI Vision One™, add the Intrusion Detection System flag. This determines if the attribute can be automated.
  • For more information about MISP instance sizing, see Sizing your MISP instance.

Procedure

  1. On the TrendAI Vision One™ console, go to Workflow and Automation → Third-Party Integration.
  2. Locate and click the MISP card.
  3. On the Direct Connection tab, click Add Connection.
  4. Turn on the toggle to enable the MISP connection.
  5. Select Send data to MISP.
  6. Configure settings to allow TrendAI Vision One™ to send suspicious object data to MISP.
  7. Select Retrieve data from MISP.
  8. Configure settings to allow TrendAI Vision One™ to retrieve threat intelligence data from MISP.
    • You can only add indicator type STIX objects that are not revoked and do not have the anomalous activity, anonymization, benign, compromised, or unknown labels to the Suspicious Object List.
    • Auto sweeping is only supported for report type STIX objects.
  9. Click Save.