Skip to content
Integrations
Skip navigation
Integrations

MISP integration — overview

Enrich a MISP attribute — an IP address, domain, hostname or AS number — with the ASN, DNS, WHOIS and threat-intelligence context WhisperGraph holds, returned as MISP objects an analyst pivots on.

Published

View as Markdown
On this page (6)

MISP integration — overview Documentation

The Whisper module for MISP takes an IP address, domain, hostname or AS attribute and returns the ASN, DNS, WHOIS and threat-intelligence context WhisperGraph holds for it, as MISP objects and attributes an analyst pivots on inside the platform they already run. It is distributed inside misp-modules, the third-party enrichment library MISP itself ships — there is nothing separate to install.

Key concepts: Threat Intelligence, Indicator of Compromise, Infrastructure Intelligence.

What you get

Enriching an attribute sends its value to the Whisper API. For each attribute you enrich, the module queries WhisperGraph and returns MISP objects and attributes for whatever Whisper holds on that indicator: an asn object for the network context, a domain-ip object linking a domain to what it resolves to, and standalone ip-dst, domain, whois-registrant-email and whois-registrar attributes for the rest. The Whisper edge behind each fact rides along, either in the object's own reference relationship or in the attribute's comment, so the provenance of a fact is never lost on the way into the event.

The module's output UUIDs are derived deterministically from the indicator, so enriching the same attribute a second time dedups on import instead of piling up a second copy of the same objects.

Two module types, one settings block

The module registers as both an expansion module — the enrichment above, added to the event on request — and a hover module, which previews the same infrastructure and threat-intelligence context in place, without adding anything to the event — the lookup still queries the Whisper API, so the same TLP ceiling applies. Any threat-intelligence context the module surfaces is evidence for the analyst to weigh, never a cleared verdict:

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Both module types read one shared settings block:

SettingWhat it controls
api_urlThe Whisper graph API host to query. Defaults to the production graph host. Changing it sends both the attribute value and your API key to that host.
api_keyRequired. Without one, MISP enables the module but every enrichment returns a configuration error.
max_tlpThe most sensitive TLP marking the module may send to the Whisper API. An attribute tagged above this is refused before any value leaves MISP. Defaults to tlp:amber+strict; tlp:red disables the gate.
timeoutThe module's own enrichment budget for a single lookup.

This module always needs a key — unlike the Whisper connector for Wazuh, whose per-alert path runs keyless, there is no keyless mode here. Get one in the console.

Supported attribute types

ip-src, ip-dst, domain and hostname attributes, plus an AS attribute (an autonomous system number). Anything else is left alone.

What it does not do

It never resolves location. WhisperGraph's location layer is not part of what the module converts into MISP objects, so no country or city ever lands on an enriched event from this module — the ASN and DNS context is the ceiling of what arrives, not a full geo picture.

Where it comes from

The module ships inside misp-modules — the module page is misp.github.io/misp-modules/expansion/#whisper. Its runtime dependency, the whisper-misp package, is published on PyPI under the MIT license. No end-to-end verification against a named MISP core release exists yet; what is verified is that the module ships in misp-modules and needs a MISP instance running the modules enrichment service.

Install it