MISP integration guide.

Use feeds for investigation

This guide was reviewed against MISP 2.5.50 on 2026-10-26. Use a maintained, patched version with working Redis, background jobs and the permissions needed to manage feeds. Older 2.4 deployments have similar features but are not the validation baseline here.

For correlation, start with cached feeds. MISP can match existing event attributes against cached values without importing hundreds of thousands of new attributes as events. This is a lookup workflow, not a firewall policy or a claim that every listed address exploited a vulnerability. Standard and Critical remain separate sources with overlapping membership.

Register the two complete IPv4 feeds

Standard

112,177 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

121,738 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 26 Oct 2026, 21:31 UTC. Check live counts and SHA-256.

Open Sync Actions → Feeds → Add Feed. Create a feed named Data-Shield Standard and another named Data-Shield Critical. The MISP feed guide explains the form and the difference between caching and fetching into events.

The fields are defined in the versioned feed form. Keep normal CA and hostname verification enabled, with working DNS and system time. Check the full parsed count and actual IPv4 values before relying on the cache. Do not treat a partial preview as proof of complete import.

Refresh only these caches every two hours

Record the two numeric feed IDs and a local MISP user ID authorized to run the job. First run each cache operation once under the installation's application account. The MISP console command accepts a numeric feed ID:

/var/www/MISP/app/Console/cake Server cacheFeed MISP_USER_ID STANDARD_FEED_ID
/var/www/MISP/app/Console/cake Server cacheFeed MISP_USER_ID CRITICAL_FEED_ID

Replace all three placeholders and the installation path. These commands update the local feed caches; they do not alter Data-Shield or a firewall. For a traditional installation, use the following in the application account's crontab, after checking that an existing job does not already refresh these feeds:

7 */2 * * * /var/www/MISP/app/Console/cake Server cacheFeed MISP_USER_ID STANDARD_FEED_ID
17 */2 * * * /var/www/MISP/app/Console/cake Server cacheFeed MISP_USER_ID CRITICAL_FEED_ID

The schedule uses the host's configured timezone and staggers the two feeds. Adapt it to your supported container scheduler if needed. Prevent overlapping executions if a run can exceed the interval. Capture job output in your existing monitoring and inspect per-feed failure counts: in the reviewed command, an overall completed job can still report failed feeds. Do not replace an existing installation-wide schedule or use all just to refresh these two sources.

Verify feed hits and add contextual evidence

Use Search Feed Caches to look up an actual current member. Confirm which profile matches and the successful cache timestamp. In a private test event, add that same value as an ip-src attribute, with to_ids disabled, and leave correlation enabled. Check its Feed hits with the intended analyst account. Cache hits appear on attributes; they are not automatically relationships in the event correlation graph.

Repeat with an address present in both lists, then an absent address. Use the overlap matrix to inspect shared coverage. Two hits from Standard and Critical are overlapping policy evidence, not two independent reports of an attack.

To enrich a real case, open the address in Data-Shield CTI, review its dated source evidence and add only the supported claim to your event report or analyst note. Reference the source IP attribute and any explicitly associated vulnerability attribute, along with the original reference, evidence type and available observation dates. Keep collection time separate. A shared event, matching IP or CVE in CISA KEV does not establish an IP-to-exploit relationship by itself.

The raw feeds do not include attack labels or CVEs. The public snapshot uses a Data-Shield schema, not native MISP event JSON. This cache setup does not automatically import those associations. A future mapping must retain source provenance and uncertainty, and apply your event distribution and warninglist policies. Do not create a sighting merely because a feed refresh contains the address.

Check removals and preserve source boundaries

The reviewed feed model replaces each individual freetext cache after retrieval. It also maintains a combined lookup cache; a hit there is not proof that an address remains in one particular feed. Confirm a removed IP no longer resolves to that profile after a successful refresh, allowing for membership in the other profile. Failed retrieval can leave old data, while parser or Redis failures can undermine completeness.

Monitor each cache's timestamp, parsed value count and failures. Compare with the same publication rather than a newer website total. The native parser/cache does not perform Data-Shield's published SHA-256 validation. For audit-grade comparisons, use the shared freshness procedure.

If you later need database attributes, review that as a separate workflow. Use a dedicated fixed event per profile, Override IDS Flag enabled for contextual data, Auto Publish disabled and restricted distribution. Delta Merge can soft-delete attributes missing from a subsequent feed, so never point it at an event containing unrelated analyst evidence. Validate complete input before destructive reconciliation. The cache-only schedule above does not perform this import.

For rollback, stop only the two dedicated jobs and disable their caching and analyst visibility as appropriate. Verify they no longer appear to the intended analyst role; disabling a feed is not proof that stored caches or previously imported events were erased. Preserve unrelated feeds and historical evidence.