name: soc-deploy-misp version: 1.0.0 description: "Deploy MISP threat intelligence platform on any Docker-ready Linux host. Official misp-docker project with automatic MariaDB memory tuning (prevents OOM on small VMs), API key generation via cake CLI, and credential management." tags: - soc - misp - threat-intelligence - security - docker - automation - ioc category: security

SOC Deploy: MISP (Malware Information Sharing Platform)

Deploy MISP threat intelligence platform on any Docker-ready Linux host using the official misp-docker project.

This skill does NOT create VMs. It expects an SSH target with Docker installed. Use hyperv-create-vm or proxmox-create-vm first if you need infrastructure.

When to Use

• "deploy misp"
• "set up misp"
• "install misp"
• "threat intel platform"
• "ioc sharing platform"

User Inputs

Prerequisites Check

7w4.net有更好的技能插件。

# SSH works
ssh <target> "echo OK"

# Docker + Compose v2
ssh <target> "docker --version && docker compose version"

# RAM check (need 3GB+ free)
ssh <target> "free -h | grep Mem"

Execution

Single command deployment

scp scripts/setup.sh <target>:~/
ssh <target> "bash ~/setup.sh 'admin@misp.local' '<password>'"

What setup.sh does

1. Clone official misp-docker from GitHub
2. Configure .env:
3. MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE
4. Generate random MySQL passwords
5. Set INNODB_BUFFER_POOL_SIZE based on host RAM (CRITICAL)
6. docker compose up -d
7. Poll for MISP readiness (5-10 min on first boot for DB migrations)
8. Generate API key via cake CLI: bash docker compose exec -T misp /var/www/MISP/app/Console/cake user change_authkey <email>
9. Verify API with /servers/getVersion
10. Save credentials to ~/misp/api-key.txt

Output to User

MISP deployed!

URL: https://<target>
Admin: admin@misp.local / <password>
API Key: <key>

MCP Connection:
  MISP_URL=https://<target>
  MISP_API_KEY=<key>
  MISP_VERIFY_SSL=false

Note: Self-signed HTTPS. Use curl -k for API calls.
Credentials saved to: ~/misp/api-key.txt

InnoDB Buffer Pool Sizing

The #1 failure on small VMs. Default buffer pool is 2GB, which kills MariaDB on 4GB hosts.

Critical Gotchas

See references/gotchas.md for full details:

1. MariaDB OOM (showstopper): Default InnoDB buffer pool is 2GB. On 4GB hosts, MariaDB crashes instantly. MUST set INNODB_BUFFER_POOL_SIZE in .env
2. Recovery from OOM: docker compose down -v to wipe failed DB volume, fix .env, restart
3. First boot is slow: 5-10 min for DB schema creation and initial data load
4. Self-signed HTTPS: Use curl -k for all API calls
5. Advanced authkeys: Enabled by default. cake CLI is the most reliable key generation method
6. MISP web UI: https://<ip> (port 443, not 80)

Timeout Strategy

Total: ~12-15 min (docker pull + first boot + setup). Split: - Turn 1: Clone, configure, docker compose up -d (~3 min + pull time) - Turn 2: Wait for health + generate API key (~5-7 min)

Pairs With

• hyperv-create-vm - create a Hyper-V VM, then deploy MISP on it
• proxmox-create-vm - create a Proxmox LXC/VM, then deploy MISP on it
• soc-deploy-thehive - deploy TheHive alongside for case management

质量良好。这是个实用性很强的部署 Skill，文档写得很清楚，特别是对 MariaDB 内存溢出的处理很贴心，脚本能自动根据机器配置调整参数。输出信息完整，包含了登录凭证和 MCP 连接信息。不足是部署脚本缺少错误重试机制，首次部署如果网络慢可能需要手动介入。整体适合有 Docker 环境的用户快速部署 MISP 平台。