Using the provided MISPVM ova file, import it on VirtualBox and respond to the questionsbelow. Also,...

Question

Using the provided MISPVM ova file, import it on VirtualBox and respond to the questionsbelow. Also, add a screenshot of every step.NOTE: you mightwant to add an Internal interface and assign an IP address (edit thefile /etc/network/interfaces), sothat you can connect to the WebApp from a browser.		Why there are no events when clicking on Home?		Go to Sync Actions → List Feeds to check the list of default	feeds.		Load all default feed metadata and check how it looks like.		In Home there is still no events. What do you have to do to see, for	instance, IPs blocked by Snort? Explain step by step.		Prove that these events are available in Home.		Click on the ID to populate information about this event. What kind	of information is shown at the list at the bottom? What this	information represents?		Using ipgeolocation.io, locate one of the entries in the list.	Choose it randomly.		Go back to the list of feeds and add all related to malware (use the	search engine). If it takes a while, check in Administration →	Jobs the background tasks. Once done, prove again you got events	from all of them.		Show the details of URLhaus.		In the Galaxies menu, you can search for topics. Show the	information regarding malware stealer.		What feed would you use for phishing URLs?		And for spam?

Naveen Kumar · Accepted Answer

Using the provided MISP VM ova file, import it on VirtualBox and respond to the questions below. Also, add a screenshot of every step.
NOTE: you might want to add an Internal interface and assign an IP address (edit the file /etc/network/interfaces), so that you can connect to the WebApp from a browser.
Network settings with NATip and local ip
Local ip: 192.168.253.135/24
NAT IP:  202.173.124.142
1. Why there are no events when clicking on Home?
By default there would be no events, due to no event id or event config has been selected.
We have select the even id from list of events,
Based in the priority, the event would be high or medium or low.
Config:
Selected the data: 09/12/2022
Distribution: Select All communities, if you have any selected community then go with it, they are four other communities option are available.
Threat level: High or Medium or Low. I have chosen high for assignment.
Analysis: You can select, at what stage the analysis should start.
Event info: Information about event.
Extended event: optional.
2. Go to Sync Actions → List Feeds to check the list of default feeds.
Feed has not enabled by default, we have to enable by select appropriate options.
In this below example, I have enabled ID 1 for assignment reason.
As you can see 2 ID was not enabled.

Using the provided MISP VM ova file, import it on VirtualBox and respond to the questions below. Also, add a screenshot of every step. NOTE : you might want to add an Internal interface and assign an...

Solution

Answer To This Question Is Available To Download

Related Questions & Answers

Submit New Assignment