Appendix A — Appendices
Appendix A: External Authentication
The external authentication mechanism described
The external authentication allows a user or an external tool to authenticate with MISP using an arbitrary value passed along in a custom header. This authentication method overrides the regular authentication mechanisms and is customisable by a site-admin.
It is possible to create a mixed mode MISP setup where certain users can go through the normal authentication mechanism and other users are required to use the external authentication method.
Setting up the external authentication mechanism
To change the authentication settings, navigate to Administration - Server settings - Plugin settings
The settings associated with the external authentication can be found by pressing the CustomAuth button as depicted below:
To change a setting simply double click on the value to edit the field. Use the guidance provided by the setting tool to configure the external authentication. The accessible settings are as follows:
enable: Enable or disable external authentication (off by default)
header: The header which MISP will use to identify users
required: Enabling this setting will force all users to use the external authentication. Leave this disabled allows administrators to assign external authentication or regular authentication users.
only_allow_source: Setting a url / IP address here will only allow requests that originated from the given address
name: The name to be used for the authentication mechanism. This is reflected in the user creation / edit views, the logs and the error messages on failed logins.
disable_logout: Disable the default logout button. Using an external authentication mechanism that authenticates via the header with each requests makes the logout button obsolete.
custom_password_reset: If your authentication system has a url that a user can access to reset his/her password, please specify the full url for it here. This will then be reused in the UI.
custom_password_logout: If your authentication system has a url that a user can access to logout, please specify the full url for it here. This will then be reused in the UI.
User management
Using a new setting, user self management can be disabled for all users that are not administrators via the MISP.disableUserSelfManagement setting, found in the MISP settings tab. Enabling this setting removes the ability of users to change their user settings and reset their authentication keys. All other functionality remains unchanged.
To create an external authenticated user, simply tick the External authentication user checkbox, after which an external auth key field will appear. This will be used to identify the users via the passed along header.
Logging
For a description of the logging facilities provided by this plugin, please refer to the “Logging of failed authentication attempts” section of the Administration section.
Appendix B: ACL descriptors
Querying the ACL system
MISP allows site admins to query the ACL system for various types of data. This can be interesting when tuning for example WAF access to MISP. All applicable queries can be requested via /servers/queryACL
Getting a list of URLs accessible to a role
https://<misp url>/servers/queryACL/printRoleAccess/<role id>The above URL will return a JSON with all accessible URLs for the given role ID. If no Role ID is provided, a JSON containing all roles and their access lists will be returned.
Example:
{
"3": {
"name": "User",
"urls": [
"/*/restSearch",
"/attributes/add",
"/attributes/add_attachment",
"/attributes/add_threatconnect",
"/attributes/addTag",
"/attributes/attributeReplace",
"/attributes/attributeStatistics",
"/attributes/bro",
"/attributes/delete",
"/attributes/deleteSelected",
"/attributes/describeTypes",
"/attributes/download",
"/attributes/downloadAttachment",
"/attributes/downloadSample",
"/attributes/edit",
"/attributes/editField",
"/attributes/editSelected",
"/attributes/exportSearch",
"/attributes/fetchEditForm",
"/attributes/fetchViewValue",
"/attributes/getMassEditForm",
"/attributes/hoverEnrichment",
"/attributes/index",
"/attributes/removeTag",
"/attributes/restore",
"/attributes/restSearch",
"/attributes/returnAttributes",
"/attributes/rpz",
"/attributes/search",
"/attributes/searchAlternate",
"/attributes/toggleCorrelation",
"/attributes/text",
"/attributes/toggleToIDS",
"/attributes/updateAttributeValues",
"/attributes/view",
"/attributes/viewPicture",
"/authKeys/add",
"/authKeys/delete",
"/authKeys/edit",
"/authKeys/index",
"/authKeys/view",
"/auth_keys/add",
"/auth_keys/delete",
"/auth_keys/edit",
"/auth_keys/index",
"/auth_keys/view",
"/dashboards/getForm",
"/dashboards/index",
"/dashboards/updateSettings",
"/dashboards/getEmptyWidget",
"/dashboards/renderWidget",
"/dashboards/listTemplates",
"/dashboards/saveTemplate",
"/dashboards/export",
"/dashboards/import",
"/dashboards/deleteTemplate",
"/decayingModel/export",
"/decayingModel/import",
"/decayingModel/view",
"/decayingModel/index",
"/decayingModel/add",
"/decayingModel/edit",
"/decayingModel/delete",
"/decayingModel/enable",
"/decayingModel/disable",
"/decayingModel/decayingTool",
"/decayingModel/getAllDecayingModels",
"/decayingModel/decayingToolBasescore",
"/decayingModel/decayingToolSimulation",
"/decayingModel/decayingToolRestSearch",
"/decayingModel/decayingToolComputeSimulation",
"/decaying_model/export",
"/decaying_model/import",
"/decaying_model/view",
"/decaying_model/index",
"/decaying_model/add",
"/decaying_model/edit",
"/decaying_model/delete",
"/decaying_model/enable",
"/decaying_model/disable",
"/decaying_model/decayingTool",
"/decaying_model/getAllDecayingModels",
"/decaying_model/decayingToolBasescore",
"/decaying_model/decayingToolSimulation",
"/decaying_model/decayingToolRestSearch",
"/decaying_model/decayingToolComputeSimulation",
"/decayingModelMapping/viewAssociatedTypes",
"/decayingModelMapping/linkAttributeTypeToModel",
"/decaying_model_mapping/viewAssociatedTypes",
"/decaying_model_mapping/linkAttributeTypeToModel",
"/eventBlocklists/add",
"/eventBlocklists/delete",
"/eventBlocklists/edit",
"/eventBlocklists/index",
"/eventBlocklists/massDelete",
"/event_blocklists/add",
"/event_blocklists/delete",
"/event_blocklists/edit",
"/event_blocklists/index",
"/event_blocklists/massDelete",
"/eventReports/add",
"/eventReports/view",
"/eventReports/viewSummary",
"/eventReports/edit",
"/eventReports/delete",
"/eventReports/reportFromEvent",
"/eventReports/restore",
"/eventReports/index",
"/eventReports/getProxyMISPElements",
"/eventReports/extractAllFromReport",
"/eventReports/extractFromReport",
"/eventReports/replaceSuggestionInReport",
"/eventReports/importReportFromUrl",
"/event_reports/add",
"/event_reports/view",
"/event_reports/viewSummary",
"/event_reports/edit",
"/event_reports/delete",
"/event_reports/reportFromEvent",
"/event_reports/restore",
"/event_reports/index",
"/event_reports/getProxyMISPElements",
"/event_reports/extractAllFromReport",
"/event_reports/extractFromReport",
"/event_reports/replaceSuggestionInReport",
"/event_reports/importReportFromUrl",
"/events/add",
"/events/addIOC",
"/events/addTag",
"/events/add_misp_export",
"/events/automation",
"/events/checkLocks",
"/events/checkPublishedStatus",
"/events/contact",
"/events/csv",
"/events/delegation_index",
"/events/delete",
"/events/deleteNode",
"/events/downloadExport",
"/events/downloadOpenIOCEvent",
"/events/edit",
"/events/enrichEvent",
"/events/export",
"/events/exportChoice",
"/events/exportModule",
"/events/filterEventIndex",
"/events/freeTextImport",
"/events/getEditStrategy",
"/events/getEventInfoById",
"/events/getEventGraphReferences",
"/events/getEventGraphTags",
"/events/getEventGraphGeneric",
"/events/getEventTimeline",
"/events/genDistributionGraph",
"/events/getDistributionGraph",
"/events/getReferenceData",
"/events/getReferences",
"/events/getObjectTemplate",
"/events/handleModuleResults",
"/events/hids",
"/events/index",
"/events/importChoice",
"/events/importModule",
"/events/merge",
"/events/nids",
"/events/proposalEventIndex",
"/events/publishSightings",
"/events/queryEnrichment",
"/events/removePivot",
"/events/removeTag",
"/events/restSearch",
"/events/runTaxonomyExclusivityCheck",
"/events/saveFreeText",
"/events/stix",
"/events/stix2",
"/events/toggleCorrelation",
"/events/unpublish",
"/events/updateGraph",
"/events/upload_analysis_file",
"/events/upload_sample",
"/events/upload_stix",
"/events/view",
"/events/viewClusterRelations",
"/events/viewEventAttributes",
"/events/viewGraph",
"/events/viewGalaxyMatrix",
"/events/xml",
"/favouriteTags/toggle",
"/favouriteTags/getToggleField",
"/favourite_tags/toggle",
"/favourite_tags/getToggleField",
"/feeds/compareFeeds",
"/feeds/feedCoverage",
"/feeds/index",
"/feeds/previewEvent",
"/feeds/previewIndex",
"/feeds/searchCaches",
"/feeds/view",
"/galaxies/attachCluster",
"/galaxies/attachMultipleClusters",
"/galaxies/export",
"/galaxies/forkTree",
"/galaxies/index",
"/galaxies/relationsGraph",
"/galaxies/selectGalaxy",
"/galaxies/selectGalaxyNamespace",
"/galaxies/selectCluster",
"/galaxies/showGalaxies",
"/galaxies/view",
"/galaxies/viewGraph",
"/galaxyClusters/attachToEvent",
"/galaxyClusters/detach",
"/galaxyClusters/index",
"/galaxyClusters/restSearch",
"/galaxyClusters/view",
"/galaxyClusters/viewGalaxyMatrix",
"/galaxyClusters/viewRelations",
"/galaxyClusters/viewRelationTree",
"/galaxy_clusters/attachToEvent",
"/galaxy_clusters/detach",
"/galaxy_clusters/index",
"/galaxy_clusters/restSearch",
"/galaxy_clusters/view",
"/galaxy_clusters/viewGalaxyMatrix",
"/galaxy_clusters/viewRelations",
"/galaxy_clusters/viewRelationTree",
"/galaxyClusterRelations/index",
"/galaxyClusterRelations/view",
"/galaxy_cluster_relations/index",
"/galaxy_cluster_relations/view",
"/galaxyElements/index",
"/galaxy_elements/index",
"/jobs/cache",
"/jobs/getGenerateCorrelationProgress",
"/jobs/getProgress",
"/logs/event_index",
"/logs/returnDates",
"/modules/index",
"/modules/queryEnrichment",
"/news/index",
"/noticelists/index",
"/noticelists/view",
"/objects/add",
"/objects/addValueField",
"/objects/delete",
"/objects/edit",
"/objects/get_row",
"/objects/editField",
"/objects/fetchEditForm",
"/objects/fetchViewValue",
"/objects/quickAddAttributeForm",
"/objects/quickFetchTemplateWithValidObjectAttributes",
"/objects/restSearch",
"/objects/proposeObjectsFromAttributes",
"/objects/groupAttributesIntoObject",
"/objects/revise_object",
"/objects/view",
"/objectReferences/add",
"/objectReferences/delete",
"/objectReferences/view",
"/object_references/add",
"/object_references/delete",
"/object_references/view",
"/objectTemplates/objectChoice",
"/objectTemplates/objectMetaChoice",
"/objectTemplates/view",
"/objectTemplates/viewElements",
"/objectTemplates/index",
"/object_templates/objectChoice",
"/object_templates/objectMetaChoice",
"/object_templates/view",
"/object_templates/viewElements",
"/object_templates/index",
"/objectTemplateElements/viewElements",
"/object_template_elements/viewElements",
"/organisations/fetchSGOrgRow",
"/organisations/index",
"/organisations/view",
"/pages/display",
"/posts/add",
"/posts/delete",
"/posts/edit",
"/regexp/index",
"/restClientHistory/delete",
"/restClientHistory/index",
"/rest_client_history/delete",
"/rest_client_history/index",
"/roles/index",
"/roles/view",
"/servers/getApiInfo",
"/servers/getPyMISPVersion",
"/servers/getVersion",
"/servers/idTranslator",
"/servers/postTest",
"/servers/rest",
"/shadowAttributes/accept",
"/shadowAttributes/acceptSelected",
"/shadowAttributes/add",
"/shadowAttributes/add_attachment",
"/shadowAttributes/delete",
"/shadowAttributes/discard",
"/shadowAttributes/discardSelected",
"/shadowAttributes/download",
"/shadowAttributes/edit",
"/shadowAttributes/index",
"/shadowAttributes/view",
"/shadowAttributes/viewPicture",
"/shadow_attributes/accept",
"/shadow_attributes/acceptSelected",
"/shadow_attributes/add",
"/shadow_attributes/add_attachment",
"/shadow_attributes/delete",
"/shadow_attributes/discard",
"/shadow_attributes/discardSelected",
"/shadow_attributes/download",
"/shadow_attributes/edit",
"/shadow_attributes/index",
"/shadow_attributes/view",
"/shadow_attributes/viewPicture",
"/sharingGroups/index",
"/sharingGroups/view",
"/sharing_groups/index",
"/sharing_groups/view",
"/sightings/add",
"/sightings/restSearch",
"/sightings/advanced",
"/sightings/delete",
"/sightings/index",
"/sightings/listSightings",
"/sightings/quickDelete",
"/sightings/viewSightings",
"/sightings/bulkSaveSightings",
"/sightings/quickAdd",
"/tagCollections/index",
"/tagCollections/view",
"/tag_collections/index",
"/tag_collections/view",
"/tags/attachTagToObject",
"/tags/index",
"/tags/removeTagFromObject",
"/tags/search",
"/tags/selectTag",
"/tags/selectTaxonomy",
"/tags/showEventTag",
"/tags/showAttributeTag",
"/tags/showTagControllerTag",
"/tags/tagStatistics",
"/tags/view",
"/tags/viewGraph",
"/tags/viewTag",
"/taxonomies/index",
"/taxonomies/taxonomyMassConfirmation",
"/taxonomies/taxonomyMassHide",
"/taxonomies/taxonomyMassUnhide",
"/taxonomies/view",
"/taxonomies/unhideTag",
"/taxonomies/hideTag",
"/templateElements/index",
"/template_elements/index",
"/templates/deleteTemporaryFile",
"/templates/index",
"/templates/populateEventFromTemplate",
"/templates/submitEventPopulation",
"/templates/templateChoices",
"/templates/uploadFile",
"/templates/view",
"/threads/index",
"/threads/view",
"/threads/viewEvent",
"/users/attributehistogram",
"/users/change_pw",
"/users/checkIfLoggedIn",
"/users/dashboard",
"/users/downloadTerms",
"/users/edit",
"/users/email_otp",
"/users/searchGpgKey",
"/users/fetchGpgKey",
"/users/histogram",
"/users/login",
"/users/logout",
"/users/register",
"/users/resetauthkey",
"/users/request_API",
"/users/routeafterlogin",
"/users/statistics",
"/users/tagStatisticsGraph",
"/users/terms",
"/users/updateLoginTime",
"/users/view",
"/users/getGpgPublicKey",
"/userSettings/index",
"/userSettings/view",
"/userSettings/setSetting",
"/userSettings/getSetting",
"/userSettings/delete",
"/userSettings/setHomePage",
"/user_settings/index",
"/user_settings/view",
"/user_settings/setSetting",
"/user_settings/getSetting",
"/user_settings/delete",
"/user_settings/setHomePage",
"/warninglists/checkValue",
"/warninglists/index",
"/warninglists/view",
"/allowedlists/index",
"/eventGraph/view",
"/eventGraph/add",
"/eventGraph/delete",
"/event_graph/view",
"/event_graph/add",
"/event_graph/delete"
]
}
}Getting a list of all accessible controllers and actions in MISP
https://<misp url>/servers/queryACL/printAllFunctionNamesThis URL will return a JSON with all controller and all mapped functions within them.
Viewing a list of yet unmapped functions
https://<misp url>/servers/queryACL/findMissingFunctionNamesFunctions that have not been tied into the new ACL yet show up here. These functions will (until added to the ACL) only be accessible to site admins.
Appendix C: Official MISP developments
This section lists the projects that can be found on the main MISP GitHub page e know of but not officially support and rely on their respective maintainers to keep up to date to the MISP 2.5 developments.
| Project | Description | Status |
|---|---|---|
| misp-objects | Definition, description and relationship types of MISP objects | Core to MISP, frequently updated and tested |
| Best Practices in ThreatIntel | Best practices in threat intelligence | Book available here: https://www.misp-project.org/best-practices-in-threat-intelligence.html |
Appendix D: Third-party development
This section lists some projects we know of but not officially support and rely on their respective maintainers to keep up to date to the MISP 2.5 developments.
| Project | Description | Status |
|---|---|---|
| MISP-STIX-ESM | Exports MISP events to STIX and ingest into McAfee ESM | Not tested by MISP core team |
| Docker MISP | Automated Docker MISP container | Not tested by MISP core team |
| misp42splunk | A Splunk app to use MISP in background and combine with TheHive | Not tested by MISP core team |
| getmispioc | getiocmisp is a Splunk custom search command that helps to extract IOCs from a MISP instance. | Not tested by MISP core team |
| OTX MISP | Imports Alienvault OTX pulses to a MISP instance | Not tested by MISP core team |
| BTG | BTG’s purpose is to make fast and efficient search on IOC | Not tested by MISP core team |
| MISP OSINT Collection | Collection of best practices to add OSINT into MISP and/or MISP communities | Not tested by MISP core team |
| IBM XFE module | Various IBM X-Force Exchange modules | Not tested by MISP core team |
| MISP dockerized | MISP dockerized is a project designed to provide an easy-to-use and easy-to-install’out of the box’ MISP instance that includes everything you need to run MISP with minimal host-side requirements. | Not tested by MISP core team |
| MISP dockerized modules | MISP-modules for MISP dockerized | Not tested by MISP core team |
| FireMISP | FireEye Alert json files to MISP Malware information sharing plattform (Alpha) | Not tested by MISP core team |
| MISP Chrome Plugin | MISP Chrome plugin for adding and looking up indicators | Not tested by MISP core team |
| PySight2MISP | PySight2MISP is a project that can be run to be used as glue between iSight intel API and MISP API | Not tested by MISP core team |
| tie2misp | Import DCSO TIE IOCs as MISP events | Not tested by MISP core team |
| security onion MISP | Grab NIDS rules and Bro Intel generated from a MISP instance and use them in Security Onion | Not tested by MISP core team |
| virustream | A script to track malware IOCs with OSINT on Twitter. | Not tested by MISP core team |
| LAC CSV Import | Register MISP events based on information described in files such as CSV and TSV. | Not tested by MISP core team |
| The Hive | TheHive: a Scalable, Open Source and Free Security Incident Response Platform | Strong links between core team members, tested and known working |
| puppet-misp | This module installs and configures MISP - puppet forge site | Not tested by MISP core team |
| Ansible MISP | Ansible playbook to install Malware Information Sharing Platform (MISP) | unmaintained |
| ansible MISP | ansible role to setup MISP | Not tested by MISP core team |
| OpenDXL ATD MISP | Automated threat intelligence collection with McAfee ATD, OpenDXL and MISP | Not tested by MISP core team |
| IMAP Proxy | Modular IMAP proxy (including PyCIRCLeanMail and MISP forward modules) | Not tested by MISP core team |
| AutoMISP | automate your MISP installs - This shell script is designed to automatically install MISP and the misp-modules extension on either Ubuntu 16.04, or 18.04. | Not tested by MISP core team |
| Palo Alto Networks report_to_misp | Parse a report and import the events into MISP | Not tested by MISP core team |
| Palo Alto Networks minemeld-misp | MineMeld nodes for MISP | Not tested by MISP core team |
| golang-misp | Golang Library to interact with your MISP instance | Not tested by MISP core team |
| go-misp | Golang MISP API Client | Not tested by MISP core team |
| MISP MAR | Integration between MISP platform and McAfee Active Response | Not tested by MISP core team |
| MISP IoC Validator | Validate IOC from MISP ; Export results and iocs to SIEM and sensors using syslog and CEF format | Not tested by MISP core team |
| vt2misp | Script to fetch data from virustotal and add it to a specific event as an object | Not tested by MISP core team |
| Threat Pinch Lookup | Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension | Not tested by MISP core team |
| dovehawk | Dovehawk is a Bro module that automatically imports MISP indicators and reports Sightings | Not tested by MISP core team |
| yara-exporter | Exporting MISP event attributes to yara rules usable with Thor apt scanner | Not tested by MISP core team |
| volatility-misp | Volatility plugin to interface with MISP | Not tested by MISP core team |
| misp2bro | Python script that gets IOC from MISP and converts it into BRO intel files. | Not tested by MISP core team |
| TA-misp | Splunk integration with MISP | Not tested by MISP core team |
| Tinycheck | TinyCheck integration with MISP | Not tested by MISP core team |
| MISP QRadar | The Project can used to integrate QRadar with MISP Threat Sharing Platform | Not tested by MISP core team |
| pymisp-suricata_search | Multi-threaded suricata search module for MISP | Not tested by MISP core team |
| MISP-ThreatExchange | Script to interface MISP with Facebook ThreatExchange | Not tested by MISP core team |
| aptc | Automated Payload Test Controller | Not tested by MISP core team |
| aptmap | A map displaying threat actors from the misp-galaxy | Not tested by MISP core team |
| mispy | Another MISP module for Python | Not tested by MISP core team |
| MispSharp | C# Library for MISP | Not tested by MISP core team |
| misp_btc | get BTC addresses from MISP and fetch BTC transactions | Tested by MISP core team |
| Privacy Aware Sharing of IoCs in MISP | Master Thesis including MISP data. | Master thesis |
| sam-bot | Bot to create MISP events from data in Slack | Not tested by MISP core team |
| Polarity.io Connector | “Polarity is the memory augmentation platform that makes your team smarter” | Not tested by MISP core team |
Appendix E: Other Threat Intel Ressources
A brief list of online ressources that around #ThreatIntel
Appendix F: LDAP Authentication
MISP can authenticate users against an LDAP server through the shipped LdapAuth plugin (app/Plugin/LdapAuth). When enabled, a user logs in on the normal MISP login form with their LDAP credentials; if the account does not yet exist in MISP it is created on first login. The authoritative option reference is the plugin’s own README; the summary below covers the essentials.
Prerequisites
Install the PHP LDAP extension:
# RHEL / CentOS / Fedora
sudo dnf install php-ldap
# Debian / Ubuntu
sudo apt install php-ldapConfiguration
LDAP is configured entirely in app/Config/config.php, in two parts. Both are required — the second is the step most commonly missed, and without it LDAP is simply never used.
1. Add the LdapAuth settings block with your server details and a reader account used to search the directory:
'LdapAuth' => [
'ldapServer' => 'ldap://ldap.example.com',
'ldapDn' => 'dc=example,dc=com',
'ldapReaderUser' => 'cn=reader,dc=example,dc=com',
'ldapReaderPassword' => 'password',
'ldapSearchFilter' => '(objectClass=inetOrgPerson)',
'ldapSearchAttribute'=> 'mail',
'ldapEmailField' => ['mail'],
'ldapDefaultOrg' => 1,
'ldapDefaultRoleId' => 3,
'updateUser' => true,
],2. Enable the plugin by adding it to the Security.auth array — this is what actually turns LDAP on:
'Security' => [
// ... your existing Security settings ...
'auth' => [
0 => 'LdapAuth.Ldap',
],
],Configuring the LdapAuth block alone does not enable LDAP. You must also add 'LdapAuth.Ldap' to Security.auth. If you skip this step, LDAP login silently does nothing.
Key settings
The plugin exposes many options; the most important are:
| Setting | Purpose | Default |
|---|---|---|
ldapServer |
LDAP server URI (ldap://host:port or ldaps://…) |
— |
ldapDn |
Search-base DN containing your users | — |
ldapReaderUser / ldapReaderPassword |
Bind account used to search the directory | — |
ldapSearchFilter |
Filter used to locate the user entry | — |
ldapSearchAttribute |
Attribute matched against the login identifier | mail |
ldapEmailField |
Attribute(s) holding the user’s e-mail | ['mail'] |
ldapDefaultOrg |
Organisation ID assigned to newly created LDAP users | — |
ldapDefaultRoleId |
Default role ID, or a group→role mapping (see below) | 3 |
updateUser |
Refresh a user’s e-mail and role from LDAP on each login | true |
mixedAuth |
Allow both LDAP and local (MISP password) authentication | true |
starttls |
Use StartTLS for a secure connection | false |
ldapNetworkTimeout |
Connection timeout in seconds (-1 = none) |
-1 |
ldapProtocol |
LDAP protocol version | 3 |
Mapping LDAP groups to MISP roles
ldapDefaultRoleId can be a single role ID, or an array mapping an LDAP group to a MISP role ID, so group membership drives the assigned role:
'ldapDefaultRoleId' => [
'misp_admin' => 1,
'misp_orgadmin' => 2,
'misp_user' => 3,
'misp_publisher' => 4,
'misp_syncuser' => 5,
'misp_readonly' => 6,
],For Microsoft Active Directory, set ldapUseMemberOf => true to resolve group membership from the user’s memberOf attribute; when you do, the keys in the mapping above must be the full group DN (for example CN=MISP Admins,OU=Groups,DC=example,DC=com) rather than the short group name.
TLS / LDAPS
For encrypted connections use an ldaps:// URI or enable starttls. A set of ldapTls* options (ldapTlsRequireCert, ldapTlsCustomCaCert, ldapTlsCrlCheck, ldapTlsProtocolMin) map to the corresponding PHP LDAP_OPT_X_TLS_* constants for cases where you need a custom CA or to relax certificate checking during testing — see the plugin README for the full list.
Diagnostics
The plugin ships a standalone test script that reads your LdapAuth configuration and walks through a bind and a user search, which is the fastest way to debug a connection:
php app/Plugin/LdapAuth/Controller/Component/Auth/TestLdapAuth.phpYou can also inspect app/tmp/logs/error.log for the raw error responses from the LDAP server. A good troubleshooting order is: set debug => true, start with starttls => false, and if you hit LDAP user search failed: Operations error, set ldapAllowReferrals => 0.
Migrating existing users to LDAP
LDAP and MISP users are paired by e-mail address. When you enable LDAP and an LDAP user logs in, an existing MISP user with the same e-mail address is found and linked to the LDAP identity, so existing accounts are preserved.
Caveats
- A user disabled in LDAP (or removed from the required group) is not disabled in MISP automatically — the block takes effect the next time they try to log in.
- With
mixedAuthenabled (the default) both LDAP and local MISP authentication are accepted; set it tofalseto force LDAP only. - The
Security.require_password_confirmationsetting does not apply to LDAP authentication.
Other external authentication plugins
LdapAuth is one of several external authentication plugins shipped with MISP. Each is enabled the same way — configured in app/Config/config.php and added to Security.auth — and each has its own README under app/Plugin/:
- OidcAuth — OpenID Connect (e.g. Keycloak, generic OIDC identity providers).
- AadAuth — Microsoft Entra ID / Azure Active Directory.
- ShibbAuth — Apache Shibboleth / SAML via an Apache module.
- CertAuth — client-certificate (X.509) authentication.
- LinOTPAuth — LinOTP one-time-password authentication (do not combine with MISP’s built-in TOTP).
Choose at most one primary identity source for a given deployment, and consult the relevant plugin README for its exact option list.
Appendix G: SimpleBackgroundJobs Migration guide
Since MISP 2.5, background jobs are handled by SimpleBackgroundJobs, a simpler system that no longer relies on the unmaintained CakeResque library. SimpleBackgroundJobs is now the default (and only) background-job backend — CakeResque has been removed.
The backend requires Supervisor and some extra PHP packages. On a fresh 2.5 install these are set up for you by the installer scripts (the required packages are already declared in MISP’s composer.json); the steps below are mainly relevant when migrating an older instance.
This guide is intended for Ubuntu/Debian systems
Install requirements
Run on your MISP instance the following commands.
Install Supervisord:
sudo apt install supervisor -yInstall required PHP packages: ``` cd /var/www/MISP/app sudo -u www-data php composer.phar require –with-all-dependencies supervisorphp/supervisor:^4.0
guzzlehttp/guzzle
php-http/message
lstrojny/fxmlrpc```
Add the following settings at the bottom of the Supervisord conf file, usually located in:
/etc/supervisor/supervisord.conf[inet_http_server] port=127.0.0.1:9001 username=supervisor password=PWD_CHANGE_MEUse the following configuration as a template for the services, usually located in:
/etc/supervisor/conf.d/misp-workers.conf``` [group:misp-workers] programs=default,email,cache,prio,update[program:default] directory=/var/www/MISP command=/var/www/MISP/app/Console/cake start_worker default process_name=%(program_name)s_%(process_num)02d numprocs=5 autostart=true autorestart=true redirect_stderr=false stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log directory=/var/www/MISP user=www-data
[program:prio] directory=/var/www/MISP command=/var/www/MISP/app/Console/cake start_worker prio process_name=%(program_name)s_%(process_num)02d numprocs=5 autostart=true autorestart=true redirect_stderr=false stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log directory=/var/www/MISP user=www-data
[program:email] directory=/var/www/MISP command=/var/www/MISP/app/Console/cake start_worker email process_name=%(program_name)s_%(process_num)02d numprocs=5 autostart=true autorestart=true redirect_stderr=false stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log directory=/var/www/MISP user=www-data
[program:update] directory=/var/www/MISP command=/var/www/MISP/app/Console/cake start_worker update process_name=%(program_name)s_%(process_num)02d numprocs=1 autostart=true autorestart=true redirect_stderr=false stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log directory=/var/www/MISP user=www-data
[program:cache] directory=/var/www/MISP command=/var/www/MISP/app/Console/cake start_worker cache process_name=%(program_name)s_%(process_num)02d numprocs=5 autostart=true autorestart=true redirect_stderr=false stderr_logfile=/var/www/MISP/app/tmp/logs/misp-workers-errors.log stdout_logfile=/var/www/MISP/app/tmp/logs/misp-workers.log user=www-data ```
Restart Supervisord to load the changes:
sudo service supervisor restartCheck Supervisord workers are running:
$ sudo supervisorctl status misp-workers:cache_00 RUNNING pid 1673228, uptime 1:37:54 misp-workers:cache_01 RUNNING pid 1673225, uptime 1:37:54 misp-workers:cache_02 RUNNING pid 1673375, uptime 1:37:53 misp-workers:cache_03 RUNNING pid 1673398, uptime 1:37:52 misp-workers:cache_04 RUNNING pid 1673303, uptime 1:37:53 misp-workers:default_00 RUNNING pid 1673222, uptime 1:37:54 misp-workers:default_01 RUNNING pid 1673385, uptime 1:37:52 misp-workers:default_02 RUNNING pid 1673391, uptime 1:37:52 misp-workers:default_03 RUNNING pid 1673223, uptime 1:37:54 misp-workers:default_04 RUNNING pid 1673393, uptime 1:37:52 misp-workers:email_00 RUNNING pid 1673394, uptime 1:37:52 misp-workers:email_01 RUNNING pid 1673312, uptime 1:37:53 misp-workers:email_02 RUNNING pid 1673224, uptime 1:37:54 misp-workers:email_03 RUNNING pid 1673227, uptime 1:37:54 misp-workers:email_04 RUNNING pid 1673333, uptime 1:37:53 misp-workers:prio_00 RUNNING pid 1673279, uptime 1:37:54 misp-workers:prio_01 RUNNING pid 1673304, uptime 1:37:53 misp-workers:prio_02 RUNNING pid 1673305, uptime 1:37:53 misp-workers:prio_03 RUNNING pid 1673232, uptime 1:37:54 misp-workers:prio_04 RUNNING pid 1673319, uptime 1:37:53 misp-workers:update_00 RUNNING pid 1673327, uptime 1:37:53
MISP Config
Go to your MISP instances
Server Settings & Maintenancepage, and then to the new SimpleBackgroundJobs tab.Update the
SimpleBackgroundJobs.supervisor_passwordwith the password you set in the Install requirements section 3.Verify Redis and other settings are correct and then set
SimpleBackgroundJobs.enabledtotrue.Use MISP normally and visit Administration -> Jobs (
/jobs/indexon your instance) to check Jobs are running correctly. If there are any issues check the logs:- /var/www/MISP/app/tmp/logs/misp-workers-errors.log
- /var/www/MISP/app/tmp/logs/misp-workers.log
Once the new workers are functioning as expected, you can remove the previous workers service:
bash $ sudo systemctl stop --now misp-workers $ sudo systemctl disable --now misp-workers
Notes
Scheduled tasks (TasksController) are not supported with the new backend, however this feature is going to be deprecated, it is recommended to use cron jobs instead.