Previous

Next

MISP Dashboard Intro

MISP Geographic Intelligence

Overview

The MISP integration for Datadog enriches your security logs with threat intelligence data from MISP, providing context for faster triage. This integration connects Datadog with your MISP instance to automatically pull and analyze key indicators including IPs, hashes, and domains.

Datadog ingests the threats, enabling deeper visibility into potential risks within your environment. You can correlate this data with logs, metrics, and Cloud SIEM alerts to identify and respond to malicious activity faster.

Note: You must enable Cloud SIEM on your Datadog account to use this integration.

This integration includes:

• Threat Intelligence Feeds: Import IP, hash, and domain risk lists directly into Datadog for continuous enrichment.
• Cloud SIEM Correlation: Combine MISP intelligence with Datadog logs to detect and prioritize threats.

Setup

Overview

The MISP integration forwards threat indicators from a self-hosted MISP instance into Datadog’s Threat Intelligence catalog, where they can be matched against your logs, traces, and security signals.

A lightweight connector runs inside your environment, alongside MISP. It polls MISP’s REST API for new, updated, and deleted indicators (IPs, domains, and file hashes), transforms them into Datadog’s expected format, and pushes them to the Datadog Threat Intelligence API. No inbound network access to MISP is required.

Prerequisites

• A running MISP instance with the REST API enabled, reachable from the host that will run the connector.
• A Datadog API key and application key with permission to write to Reference Tables.
• Docker 20.10+ (or Docker Compose v2+) on the host that will run the connector.

Step 1: Get a MISP API key

The connector authenticates to MISP with an API key (also called an Authkey).

1. Log in to your MISP web UI as the user the connector should impersonate. Datadog recommends using a dedicated read-only user.
2. Go to Administration > List Auth Keys (or My Profile > Auth keys for non-admin users).
3. Click Add authentication key, choose the user, set an optional comment (for example, Datadog connector).
4. Click Submit and copy the generated key. MISP only displays it once.

Verify the key:

curl -H "Authorization: <your-misp-api-key>" \
     -H "Accept: application/json" \
     https://<your-misp-instance>/users/view/me

A 200 OK response confirms the key is valid.

Step 2: Get your Datadog keys

1. In Datadog, go to Organization Settings > API Keys and copy (or create) an API key.
2. Go to Organization Settings > Application Keys and copy (or create) an application key. The application key must belong to a user with the reference_tables_write permission.

Step 3: Run the connector

The connector is published on Docker Hub at datadog/misp-threat-intel-connector. You can run it directly with docker run, or with Docker Compose using the snippet below.

Option A: docker run

docker run -d --restart unless-stopped \
  --name misp-threat-intel-connector \
  -e MISP_URL=https://your-misp-instance \
  -e MISP_API_KEY=your-misp-api-key \
  -e DATADOG_API_URL=https://api.datadoghq.com/api/v2/security/threat-intel-feed \
  -e DATADOG_API_KEY=your-datadog-api-key \
  -e DATADOG_APP_KEY=your-datadog-app-key \
  -v checkpoint_data:/opt/connector/data \
  datadog/misp-threat-intel-connector:latest

Option B: Docker Compose

1. Create a docker-compose.yml file:

   services:
     connector-misp-threat-intel:
       image: datadog/misp-threat-intel-connector:latest
       restart: unless-stopped
       env_file: .env
       volumes:
         - checkpoint_data:/opt/connector/data
   
   volumes:
     checkpoint_data:
   

2. Create a .env file next to it with your settings:

   cat > .env <<'EOF'
   MISP_URL=https://your-misp-instance
   MISP_API_KEY=your-misp-api-key
   DATADOG_API_URL=https://api.datadoghq.com/api/v2/security/threat-intel-feed
   DATADOG_API_KEY=your-datadog-api-key
   DATADOG_APP_KEY=your-datadog-app-key
   EOF
   

3. Start the connector:

   docker compose up -d
   

The connector runs an initial sync immediately, then continues every 15 minutes. A Docker volume (checkpoint_data) persists the sync checkpoint so syncs resume after restarts.

Configuration: MISP connection

Configuration: Datadog connection

Configuration: Threat intent mapping

MISP does not expose a built-in indicator intent (benign / suspicious / malicious). The connector maps any MISP label you choose to a Datadog intent level. Each variable accepts a JSON list of exact label strings.

Example:

DATADOG_THREAT_INTENT_BENIGN='["misp:threat-level=\"low-risk\""]'
DATADOG_THREAT_INTENT_SUSPICIOUS='["misp:threat-level=\"medium-risk\""]'
DATADOG_THREAT_INTENT_MALICIOUS='["misp:threat-level=\"high-risk\""]'

Indicators with no matching label default to suspicious. When an indicator matches multiple levels, the highest one takes precedence (benign < suspicious < malicious).

Configuration: Connector options

Validation

After starting the connector, check the container logs:

docker compose logs -f connector-misp-threat-intel

Look for log lines confirming the connector is fetching events from MISP and pushing batches to Datadog. Within a few minutes, the imported indicators appear in Datadog under Security > Threat Intelligence with the source set to misp.

Troubleshooting

• 401 Unauthorized from MISP: The API key is invalid, expired, or belongs to a disabled user. Generate a new key from the MISP web UI.
• 401 or 403 from Datadog: The API or application key is missing the Reference Tables write permission. Verify the application key’s owner has the right role.
• TLS errors on connection to MISP: Set MISP_SSL_VERIFY=false if MISP uses a self-signed certificate, or install the certificate’s CA into the container.
• No indicators appear in Datadog: Confirm that events in MISP carry the indicator types the connector exports (ip-dst, ip-src, domain, sha256, md5) and, if MISP_TAGS is set, that they carry one of the required tags.

Uninstallation

To uninstall the MISP integration:

1. In Datadog, navigate to Integrations, select the MISP tile, and click Uninstall Integration.
2. Delete all associated MISP accounts in Datadog.
3. Out-of-the-box (OOTB) assets are automatically removed.
4. If you cloned or customized any assets, delete those manually.

Once this integration has been uninstalled, any previous authorizations are revoked. Make sure that all API keys associated with this integration have been disabled by searching for “MISP” on the API Keys page.

Support

Need help? Contact Datadog Support.