{"action":"created","issue":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/304","labels_url":"https://api.github.com/repos/log2timeline/plaso/issues/304/labels{/name}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/304/comments","events_url":"https://api.github.com/repos/log2timeline/plaso/issues/304/events","html_url":"https://github.com/log2timeline/plaso/issues/304","id":101693887,"number":304,"title":"Add MISP (Malware Information Sharing Platform) analysis plugin","user":{"login":"elhoim","id":178521,"avatar_url":"https://avatars.githubusercontent.com/u/178521?v=3","gravatar_id":"","url":"https://api.github.com/users/elhoim","html_url":"https://github.com/elhoim","followers_url":"https://api.github.com/users/elhoim/followers","following_url":"https://api.github.com/users/elhoim/following{/other_user}","gists_url":"https://api.github.com/users/elhoim/gists{/gist_id}","starred_url":"https://api.github.com/users/elhoim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elhoim/subscriptions","organizations_url":"https://api.github.com/users/elhoim/orgs","repos_url":"https://api.github.com/users/elhoim/repos","events_url":"https://api.github.com/users/elhoim/events{/privacy}","received_events_url":"https://api.github.com/users/elhoim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-18T16:22:14Z","updated_at":"2015-08-19T08:52:17Z","closed_at":null,"body":"[MISP](https://github.com/MISP/MISP) is a platform to exchange IOCs.\r\nIt would be great to have integration with it, more specifically to lookup hashes (MD5/SHA1/SHA256) in MISP. Or implement it the other way around, download the hashes from MISP, and then compare those to the ones from the image being analyzed.\r\n\r\nMISP has a key-authenticated REST API available.\r\n\r\nExisting MISP data types that might be of interest to be used inside plaso analysis plugins: yara rules, ip, hostname, url, filename, mutex. [New data types](https://github.com/MISP/MISP/issues/460) to be implemented in the future: URI-regexp, filename-regexp, ssdeep, imphash, pehash, authentihash, pipe, mailslot, mutex, SSL certificates attributes, windows service name.\r\n\r\nI can arrange access to a MISP instance hosting IOCs if you need it for testing."},"comment":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/comments/132497983","html_url":"https://github.com/log2timeline/plaso/issues/304#issuecomment-132497983","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/304","id":132497983,"user":{"login":"elhoim","id":178521,"avatar_url":"https://avatars.githubusercontent.com/u/178521?v=3","gravatar_id":"","url":"https://api.github.com/users/elhoim","html_url":"https://github.com/elhoim","followers_url":"https://api.github.com/users/elhoim/followers","following_url":"https://api.github.com/users/elhoim/following{/other_user}","gists_url":"https://api.github.com/users/elhoim/gists{/gist_id}","starred_url":"https://api.github.com/users/elhoim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elhoim/subscriptions","organizations_url":"https://api.github.com/users/elhoim/orgs","repos_url":"https://api.github.com/users/elhoim/repos","events_url":"https://api.github.com/users/elhoim/events{/privacy}","received_events_url":"https://api.github.com/users/elhoim/received_events","type":"User","site_admin":false},"created_at":"2015-08-19T08:52:17Z","updated_at":"2015-08-19T08:52:17Z","body":"@joachimmetz & @berggren do you want access to a MISP instance for testing integration?"}}