SOC Deploy: MISP (Malware Information Sharing Platform)

Deploy MISP threat intelligence platform on any Docker-ready Linux host using the official misp-docker project.

This skill does NOT create VMs. It expects an SSH target with Docker installed. Use hyperv-create-vm or proxmox-create-vm first if you need infrastructure.

When to Use

• "deploy misp"
• "set up misp"
• "install misp"
• "threat intel platform"
• "ioc sharing platform"

User Inputs

Prerequisites Check

# SSH works
ssh <target> "echo OK"

# Docker + Compose v2
ssh <target> "docker --version && docker compose version"

# RAM check (need 3GB+ free)
ssh <target> "free -h | grep Mem"

Execution

Single command deployment

scp scripts/setup.sh <target>:~/
ssh <target> "bash ~/setup.sh 'admin@misp.local' '<password>'"

What setup.sh does

1. Clone official misp-docker from GitHub
2. Configure .env:
   • MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE
   • Generate random MySQL passwords
   • Set INNODB_BUFFER_POOL_SIZE based on host RAM (CRITICAL)
3. docker compose up -d
4. Poll for MISP readiness (5-10 min on first boot for DB migrations)
5. Generate API key via cake CLI:

   docker compose exec -T misp /var/www/MISP/app/Console/cake user change_authkey <email>
   

6. Verify API with /servers/getVersion
7. Save credentials to ~/misp/api-key.txt

Output to User

MISP deployed!

URL: https://<target>
Admin: admin@misp.local / <password>
API Key: <key>

MCP Connection:
  MISP_URL=https://<target>
  MISP_API_KEY=<key>
  MISP_VERIFY_SSL=false

Note: Self-signed HTTPS. Use curl -k for API calls.
Credentials saved to: ~/misp/api-key.txt

InnoDB Buffer Pool Sizing

The #1 failure on small VMs. Default buffer pool is 2GB, which kills MariaDB on 4GB hosts.

Critical Gotchas

See references/gotchas.md for full details:

1. MariaDB OOM (showstopper): Default InnoDB buffer pool is 2GB. On 4GB hosts, MariaDB crashes instantly. MUST set INNODB_BUFFER_POOL_SIZE in .env
2. Recovery from OOM: docker compose down -v to wipe failed DB volume, fix .env, restart
3. First boot is slow: 5-10 min for DB schema creation and initial data load
4. Self-signed HTTPS: Use curl -k for all API calls
5. Advanced authkeys: Enabled by default. cake CLI is the most reliable key generation method
6. MISP web UI: https://<ip> (port 443, not 80)

Timeout Strategy

Total: ~12-15 min (docker pull + first boot + setup). Split:

• Turn 1: Clone, configure, docker compose up -d (~3 min + pull time)
• Turn 2: Wait for health + generate API key (~5-7 min)

Pairs With

• hyperv-create-vm - create a Hyper-V VM, then deploy MISP on it
• proxmox-create-vm - create a Proxmox LXC/VM, then deploy MISP on it
• soc-deploy-thehive - deploy TheHive alongside for case management