# MISP Docker Auto-Deploy

Idempotent deploy script for [MISP](https://www.misp-project.org/) (Malware Information Sharing Platform) using the official [misp-docker](https://github.com/MISP/misp-docker) stack. Detects an existing install and starts containers; runs on non-standard ports by default (8443 HTTPS, 10080 HTTP) to avoid conflicts with Splunk (8080).

## Prerequisites

- **Docker Desktop** (Mac) with Docker Compose plugin
- **Git**
- Ports **8443** (HTTPS) and **10080** (HTTP) available, or override via environment variables

## Quick Start

```bash
chmod +x deploy_misp.sh
./deploy_misp.sh
```

- **First run:** Clones the repo, configures environment, starts MISP, waits for healthy, then configures **threatfeeds** and API key.
- **Later runs:** If an existing install is found, the script starts containers (if stopped) and exits. It does **not** re-run feed configuration unless you request it (see [Threatfeeds](#threatfeeds) below).

## Destroy (clean re-deploy)

To remove MISP completely—containers, volumes, and the install directory—for a clean re-deploy:

```bash
./deploy_misp.sh destroy
```

Also accepted: `--destroy` or `-d`.

**What it does:**

1. Stops all MISP containers and removes their volumes (database, Redis, uploads, etc.).
2. Deletes the install directory (e.g. `~/misp-docker` or your `MISP_INSTALL_DIR`).

**After destroy:** Run `./deploy_misp.sh` again for a fresh install. Uses the same `MISP_INSTALL_DIR` and env vars (ports, passwords) as normal deploy.

## Environment Variables

Set before running to override defaults:

| Variable | Default | Description |
|----------|---------|-------------|
| `MISP_HTTPS_PORT` | `8443` | HTTPS port on the host |
| `MISP_HTTP_PORT` | `10080` | HTTP port on the host (avoids Splunk on 8080) |
| `MISP_INSTALL_DIR` | `~/misp-docker` | Where the MISP Docker repo is cloned and run |
| `MISP_NETWORK` | `security-lab` | Docker network for MISP and n8n |
| `MISP_ADMIN_EMAIL` | `admin@admin.test` | MISP admin user (for API key / login) |
| `N8N_CONTAINER` | *(auto-detect)* | n8n container name to attach to `MISP_NETWORK` |
| `MISP_CONFIGURE_FEEDS` | `0` | Set to `1` to run feed/API configuration on an **existing** install |
| `MISP_DB_PASSWORD` | `MispDB2025Secure` | MySQL password for MISP |
| `MISP_REDIS_PASSWORD` | `MispRedis2025` | Redis password |

Example:

```bash
MISP_HTTPS_PORT=9443 MISP_INSTALL_DIR=~/my-misp ./deploy_misp.sh
```

## Threatfeeds

The script enables the default MISP feeds and adds **IOC (abuse.ch)** feeds, triggers an initial pull, and publishes events. This only runs in two cases:

1. **Fresh install** — Feed configuration runs automatically at the end of the first deploy.
2. **Existing install** — Feed configuration is **skipped** unless you set `MISP_CONFIGURE_FEEDS=1`.

If you already had MISP installed and threatfeeds were never added, run:

```bash
MISP_CONFIGURE_FEEDS=1 ./deploy_misp.sh
```

That will (without reinstalling): start MISP if needed, add the feeds, fetch from them, publish events, and write the API key to `misp_api_key.txt` in the same directory as the deploy script.

### Feeds configured

- **Default MISP feeds (enabled and set to auto-publish):** CIRCL OSINT Feed, The Botvrij.eu Data  
- **IOC (abuse.ch) feeds added:** ThreatFox IOCs, MalwareBazaar Recent, URLhaus Recent URLs, Feodo Tracker C2 IPs, SSL Blacklist IPs  

All enabled feeds use **auto-publish**: new events from initial and scheduled fetches are published automatically, so tools like MISP42Splunk can use `last/publish_timestamp` queries without manual publishing.

## Default credentials

- **URL:** `https://localhost:8443` (or your `MISP_HTTPS_PORT`)
- **User:** `admin@admin.test`
- **Password:** `admin` — change on first login

## API key

- On a run that executes feed configuration, the script generates an API key for `admin@admin.test` and saves it to **`misp_api_key.txt`** in the same directory as the deploy script (for n8n or other integrations).
- If the script did not run feed config (existing install, no `MISP_CONFIGURE_FEEDS=1`), get the key manually:
  1. Log in at the MISP URL above.
  2. **Administration → List Auth Keys → Add authentication key**
  3. Or via CLI:  
     `docker compose -f "$MISP_INSTALL_DIR/docker-compose.yml" exec misp-core /var/www/MISP/app/Console/cake user change_authkey admin@admin.test`

## n8n integration

The script deploys MISP on the same Docker network as n8n: it uses `misp_config/docker-compose.yml` (ports and **security-lab** network in-line, same style as n8n/splunk), creates/uses the `security-lab` network, and connects **n8n** to it if found.

**n8n MISP credential:**

- **Base URL:** `https://misp-core:443` (internal port is 443 regardless of host port)
- **Auth:** Auth Key = value from `misp_api_key.txt` (in the script directory) or from MISP UI
- **Allow Unauthorized Certs:** `true`

If n8n is not auto-detected:

```bash
docker network connect security-lab <your-n8n-container>
```

## Management

From the install directory (default `~/misp-docker`):

| Action | Command |
|--------|---------|
| Start | `docker compose up -d` |
| Stop | `docker compose down` |
| Logs | `docker compose logs -f` |
| Status | `docker compose ps` |
| **Full teardown (clean re-deploy)** | `./deploy_misp.sh destroy` (from script dir) |

## Troubleshooting

- **Port in use:** Set `MISP_HTTPS_PORT` and `MISP_HTTP_PORT` to free ports, or stop the process using them.
- **MISP not healthy:** Wait 1–2 minutes on first start. Check:  
  `cd $MISP_INSTALL_DIR && docker compose logs -f misp-core`
- **Feeds not added on existing install:** Run with `MISP_CONFIGURE_FEEDS=1 ./deploy_misp.sh`.
- **API key missing:** Run with `MISP_CONFIGURE_FEEDS=1` so the script regenerates and saves the key, or create one in the MISP UI as above.
