Integrating NetWitness with MISP

[Anonymous]

Has anyone gone about integrating MISP with NetWitness?

I'm thinking about doing it and would be curious about other people's experiences and workflows.

I see a two way integration:
1) Going Hunting and finding meta that you would store as an event in MISP

2) Indicators stored in MISP being used as Feeds to enrich Meta within NetWitness.

Cheers.

[EricPartington]

On my todo list once I have some free cycles

[RenatoGoncalves]

Hello,

Does anyone already tried the integration?

[EricPartington]

https://community.rsa.com/community/products/netwitness/blog/2019/04/05/threat-intel-integration-with-misp-and-minemeld