rstcloud-misp

RST Cloud → MISP connector suite. Imports RST Cloud threat intelligence into MISP as events, attributes, galaxy clusters, and enrichment modules.

The default way to run the connectors is the pre-built Docker image rstcloud/misp-connector alongside the official MISP/misp-docker stack.

Products covered

RST Cloud product	Connector	What it creates in MISP
Threat Library	`rstmisp library`	4 MISP galaxies (intrusion sets, malware, tools, campaigns) with stable cluster UUIDs and relationship edges
Threat Feed	`rstmisp feed`	MISP events grouped by threat, with scored attributes, decaying-model tags, and policy-driven `to_ids`
Report Hub	`rstmisp reports`	MISP events from PDF reports — STIX parse, PDF attachment, galaxy attribution, relationship graph
Enrichment API	misp-modules (8 modules)	On-demand: IOC score, noise control, WHOIS, SSL cert, screenshot, HTML body, CS beacon, favicon

The suite ships as one Docker image with five CLI subcommands: library, feed, reports, setup (one-time MISP scoring activation), and schedule (long-running in-container cron). Run only the products you are entitled to.

Quick start (recommended)

Use the official MISP Docker stack and extend it with the published connector image — no local build required.

1. Deploy MISP

Follow the misp-docker getting started guide:

git clone https://github.com/MISP/misp-docker
cd misp-docker
cp template.env .env          # edit as needed
docker compose pull
docker compose up -d

Log in to MISP and create an API auth key (Administration → Auth Keys).

2. Add the connector

Clone this repository alongside misp-docker and include the add-on compose file in misp-docker/docker-compose.yml:

git clone https://github.com/rstcloud/rstcloud_misp ../rstcloud-misp

Add to misp-docker/docker-compose.yml:

include:
  - path: ../rstcloud-misp/docker-compose.rstmisp.yml

Configure connector credentials:

cp ../rstcloud-misp/.env.rstmisp.example ../rstcloud-misp/.env.rstmisp
$EDITOR ../rstcloud-misp/.env.rstmisp    # set RST_API_KEY and MISP_KEY
$EDITOR ../rstcloud-misp/rstmisp-config/policy.yml   # optional tuning

Pull the connector image and run ( Threat Library first — feed and reports can reference its galaxy clusters):

docker compose pull
docker compose --profile rstmisp run --rm rstmisp-library
docker compose --profile rstmisp run --rm rstmisp-reports
docker compose --profile rstmisp run --rm rstmisp-feed

The image is pulled from Docker Hub: rstcloud/misp-connector (latest or pin a version tag, e.g. 0.1.0, via RSTMISP_TAG in .env.rstmisp).

3. Enable scoring (recommended for feed)

Copy the RST taxonomy and decaying models into MISP's app/files bind mount (./files/ in misp-docker), then activate via the API:

cp -r ../rstcloud-misp/misp-content/taxonomies/rstcloud \
      files/taxonomies/
cp    ../rstcloud-misp/misp-content/decaying-models/rstcloud-feed-network-model.json \
      ../rstcloud-misp/misp-content/decaying-models/rstcloud-feed-web-model.json \
      files/misp-decaying-models/models/
# Add {"name":"rstcloud",...} to files/taxonomies/MANIFEST.json if not present

docker compose --profile rstmisp run --rm rstmisp-feed setup

4. Schedule (optional)

Enable the built-in scheduler alongside MISP — no host cron needed:

# add to misp-docker .env:
# COMPOSE_PROFILES=scheduler
docker compose up -d

Schedules are defined in rstmisp-config/policy.yml under the schedule: key.

Other installation options

Build your own image

If you need to patch the connector or run air-gapped, build locally instead of pulling from Docker Hub:

docker build -t rstcloud/misp-connector:latest .
# or, from this repo:
docker compose -f docker-compose.rstmisp.yml build

Set RSTMISP_TAG=latest (or your tag) in .env.rstmisp and use the same include / docker compose run workflow above.

Docker run (standalone, no compose)

For an existing MISP instance outside misp-docker:

docker pull rstcloud/misp-connector:latest
docker run --rm \
  -e RST_API_KEY=<your-key> -e MISP_KEY=<your-key> \
  -e MISP_URL=https://your-misp -e MISP_VERIFYCERT=false \
  -v "$PWD/rstmisp-config:/config:ro" \
  rstcloud/misp-connector:latest library --filter recent

Local Python install

For development or non-container deployments:

pip install .
rstmisp library --help
python -m rstmisp feed --policy rstmisp-config/policy.yml

Requires Python 3.9+. Dependencies are pinned in pyproject.toml.

Full dev stack in this repo

The docker-compose.yml here bundles misp-docker plus connectors for local development. For production, prefer the official misp-docker compose extended with docker-compose.rstmisp.yml as shown above.

Configuration reference

Credentials and connection (`.env.rstmisp`)

Variable	Description
`RST_API_KEY`	RST Cloud API key
`RST_API_URL`	RST Cloud API base URL (default: `https://api.rstcloud.net/v1`)
`MISP_KEY`	MISP auth key (Administration → Auth Keys)
`MISP_URL`	MISP base URL (default: `https://misp-core` on the compose network)
`MISP_VERIFYCERT`	TLS verification; set `false` for self-signed MISP cert
`RSTMISP_TAG`	Connector image tag (default: `latest`; e.g. `0.1.0`)
`MISP_DISTRIBUTION`	Default event distribution level (0–3)
`MISP_PUBLISH`	Auto-publish events (`true` / `false`)
`RST_MITRE_AUTOREFRESH`	Auto-refresh ATT&CK STIX bundle (default: `true`; set `false` for air-gapped)
`RST_MITRE_DATA_DIR`	Persistent dir for ATT&CK STIX data (e.g. `/config/mitre_data`)
`RSTMISP_MISP_URL`	Compose override for connector `MISP_URL`
`RSTMISP_ATTACK_STIX`	Path to ATT&CK STIX bundle inside the container

Copy .env.rstmisp.example → .env.rstmisp and fill in values. Never commit the filled-in file.

Optional MITRE data for report relationship edges lives in rstmisp-config/ (see rstmisp-config/README.md).

Import policy (`rstmisp-config/policy.yml`)

See rstmisp-config/policy.example.yml for the full reference. Key sections:

feed:
  date: latest              # latest | 1h_latest | 4h_latest | 12h_latest | YYYY-MM-DD
  window: recent            # all | recent | only_new
  types: [ip, domain, url, hash]
  import_score: { ip: 20, domain: 20, url: 20, hash: 20 }
  to_ids_score: { ip: 45, domain: 45, url: 45, hash: 45 }
  event_grouping: threat_by_month  # threat_by_day | month | year | threat
  suppress_benign: false           # true = skip FP-flagged IOCs
  galaxy_attribution: both         # builtin | rst | both
  score_tags: true                 # false = emit only score-total
  score_update: bumps              # bumps | all | off

reports:
  attach_pdf: true
  update_events: true
  create_relations: true
  remap_galaxies: true
  galaxy_attribution: both

library:
  delivery: push                   # push | dump | repo
  merge_duplicates: off            # off | dry-run | apply

schedule:                          # used by rstmisp-scheduler
  - { product: library, args: ["--filter","recent"], cron: "0 1 * * 0" }

CLI flags override policy values (e.g. feed --date 1h_latest --window all).

Enrichment modules

RST Cloud enrichment modules deploy into the misp-modules container separately (see modules/README.md). Enable them under Administration → Server Settings → Plugin after install.

Scoring and decaying models

The feed tags each IOC with MISP-native scoring from RST Cloud's score object:

RST score field	MISP tag	Notes
`total` (0–100)	`rstcloud:score-total="<n>"`	Decaying-model base score
`src` (~0–100)	`admiralty-scale:source-reliability="a..f"`	Standard reliability taxonomy
`tags` (0–1)	`rstcloud:context-confidence="<band>"`	Banded (very-low … high)
`frequency` (0–1)	`rstcloud:relevance="<band>"`	Active-threat likelihood triage

Two per-type decaying models ship in misp-content/decaying-models/.

Re-ingest deduplicates IOCs within bucket events and updates scores in place (controlled by score_update / score_update_min_delta in policy). See DEPLOYMENT.md for details.

Repository layout

rstmisp/                    Python package — shared core + three connectors + CLI
rstmisp-config/             policy.yml, policy.example.yml, optional MITRE data
misp-content/               Custom rstcloud taxonomy + decaying model JSON
modules/                    misp-modules enrichment suite (8 RST Cloud modules)
docker-compose.rstmisp.yml  Add-on compose (pull rstcloud/misp-connector)
Dockerfile                  Optional local image build
DEPLOYMENT.md               Deployment, scheduling, and scoring deep-dive

Package-level notes: rstmisp/README.md.

Entitlement

Each subcommand is independently licensed — run only the products covered by the RST Cloud subscription. Unentitled endpoints return 401/403 and the connector stops immediately with a clear message.

Requirements

Docker 25+ and Docker Compose 2.17+ (for misp-docker)
RST Cloud API key
MISP 2.4.x or later
RST Cloud API access (see rstcloud.com)

License

GNU General Public License v3.0 — see LICENSE.

Navigation Menu

Uh oh!

Repository files navigation

rstcloud-misp

Products covered

Quick start (recommended)

1. Deploy MISP

2. Add the connector

3. Enable scoring (recommended for feed)

4. Schedule (optional)

Other installation options

Build your own image

Docker run (standalone, no compose)

Local Python install

Full dev stack in this repo

Configuration reference

Credentials and connection (`.env.rstmisp`)

Import policy (`rstmisp-config/policy.yml`)

Enrichment modules

Scoring and decaying models

Repository layout

Entitlement

Requirements

License

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
Latest commit History 1 Commit
misp-content		misp-content
modules		modules
rstmisp-config		rstmisp-config
rstmisp		rstmisp
scripts		scripts
tests		tests
.dockerignore		.dockerignore
.env.rstmisp.example		.env.rstmisp.example
.gitignore		.gitignore
DEPLOYMENT.md		DEPLOYMENT.md
Dockerfile		Dockerfile
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
SECURITY.md		SECURITY.md
docker-compose.rstmisp.yml		docker-compose.rstmisp.yml
docker-compose.yml		docker-compose.yml
pyproject.toml		pyproject.toml
requirements.txt		requirements.txt

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

rstcloud-misp

Products covered

Quick start (recommended)

1. Deploy MISP

2. Add the connector

3. Enable scoring (recommended for feed)

4. Schedule (optional)

Other installation options

Build your own image

Docker run (standalone, no compose)

Local Python install

Full dev stack in this repo

Configuration reference

Credentials and connection (.env.rstmisp)

Import policy (rstmisp-config/policy.yml)

Enrichment modules

Scoring and decaying models

Repository layout

Entitlement

Requirements

License

About

Resources

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

Credentials and connection (`.env.rstmisp`)

Import policy (`rstmisp-config/policy.yml`)