Cruising Ocean Threat With TheHive, Cortex & MISP Without Sinking
summary
Free, open-source stack combining TheHive, Cortex and MISP for CTI and DFIR, demonstrated as a working production system used by 50+ organizations. Cortex runs about 101 analyzers (started with 16) to enrich batches of observables and trigger automated responders to block IPs and open tickets. Feeders like Synapse and connectors for Digital Shadows / ZeroFOX push alerts into cases; cases import MISP events, enrich, and export selective IOCs back. The stack is stable, scalable for bulk analysis, and shipped as a ready VM for testing.
AI-written summary · about
chapters (12)
- 0:00Introduction to the talk
- 1:54Why TheHive and Cortex were created
- 8:05TheHive platform overview
- 10:56Cortex analysis engine details
- 13:06MISP as cyber threat intelligence standard
- 18:10TheHive workflow and case management
- 21:49Integration triangle: TheHive, Cortex, MISP
- 25:25Case creation from MISP events
- 27:55Real-time collaboration features
- 31:54Sharing back threat intelligence
- 34:23Managing MISP and Cortex connections
- 36:16Upcoming features and roadmap
related talks
03h 43mMISP Fundamentals
28mCommunity Management and Tool Orchestration the Open source Way via Cerebrate
27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...
04h 02mOpen-source Tools for CSIRTs
33mFree SOC? — how open source tools can come to our aid
39mCloud Native Threat Intelligence for...