使用说明
MISP mcp
什么是MCP？
这 模型上下文协议（MCP） 是一种开放协议，旨在标准化应用程序如何向大型语言模型（LLM）提供上下文信息。就像如何 USB-C 用作连接硬件设备的通用接口， MCP充当通用连接器 在AI模型和各种数据源或工具之间。这种标准化简化了集成，增强了AI驱动应用程序的适应性和功能性。
为什么选择MCP？
MCP可帮助您在LLM之上构建代理和复杂的工作流。LLM经常需要与数据和工具集成，MCP提供：
- LLM可以直接插入的预构建集成列表越来越多
- 在LLM提供商和供应商之间切换的灵活性
- 在基础架构中保护数据的最佳实践
一般架构
MCP的核心是遵循客户端-服务器架构，其中主机应用程序可以连接到多个服务器：
- MCP主机：希望通过MCP访问数据的程序，如Claude Desktop、IDE或AI工具
- MCP客户端：与服务器保持1:1连接的协议客户端
- MCP服务器：轻量级程序，每个程序都通过标准化的模型上下文协议公开特定的功能
- 本地数据源：MCP服务器可以安全访问的计算机文件、数据库和服务
- 远程服务：MCP服务器可以通过互联网（例如，通过API）连接到的外部系统
开始
- 克隆存储库
git clone https://github.com/Eacus/misp-mcp.git
-
安装 克劳德桌面
- 遵循指南https://modelcontextprotocol.io/quickstart/user
- 添加以下MCP配置
{ "mcpServers": { "MISP-mcp":{ "command": "uv", "args": [ "--directory", "<path_to_repo>/server/", "run", "server.py" ] } } } -
重新启动Claude桌面
基本用法
按ID搜索事件
提示与 misp-mcp
你能给我id为119的MISP事件吗？
图形用户界面
PyMISP
misp_url = 'https://127.0.0.1:8443'
misp_key = '<misp_key>'
# Should PyMISP verify the MISP certificate
misp_verifycert = False
r = misp.search(eventid=[119], metadata=True, pythonify=True)
创建事件
提示与 misp-mcp
使用以下参数创建新的MISP事件：
- 信息：
This is my new MISP event- 分布：
0（仅限贵组织）- 威胁级别ID:
2（中等）- 分析级别：
1（进行中）
图形用户界面
PyMISP
from pymisp import MISPEvent
event = MISPEvent()
event.info = 'This is my new MISP event' # Required
event.distribution = 0 # Optional, defaults to MISP.default_event_distribution in MISP config
event.threat_level_id = 2 # Optional, defaults to MISP.default_event_threat_level in MISP config
event.analysis = 1 # Optional, defaults to 0 (initial analysis)
print(event.to_json())
管理任务
创建用户
提示与 misp-mcp
使用以下必填字段向MISP实例添加新用户：
email@email.com：与帐户关联的电子邮件地址test_id：用户所属组织的IDrole_id：分配给用户的角色的ID
图形用户界面
PyMisp
from pymisp import ExpandedPyMISP, MISPUser
from keys import misp_url, misp_key, misp_verifycert
import argparse
misp = ExpandedPyMISP(misp_url, misp_key, misp_verifycert, 'json')
user = MISPUser()
user.email = <email>
user.org_id = <org_id>
user.role_id = <role_id>
misp.add_user(user, pythonify=True)
添加AI功能！
总结昨天发生的MISP事件的所有信息？
根据id为114的MISP事件生成用Markdown编写的报告
# MISP Event Report: Configuration and Security Posture Issues
## Event Details
- **Event ID:** 114
- **UUID:** 9d8c6821-0db5-4745-bb58-aac4f04eab78
- **Date:** 2025-03-25
- **Status:** Not Published
- **Threat Level:** 4
- **Distribution:** 1 (Organization)
- **Analysis Status:** 0 (Initial)
## Organization Information
- **Organization:** ORG_Main
- **Organization UUID:** 3094f85b-a22f-475b-a68f-ae77c233bb72
- **Event Creator:** user88@org-admin.main.test
## Description
This event focuses on "Configuration and Security Posture Issues." It appears to be in an initial stage of analysis and has not yet been published within the MISP instance.
## Attributes
No attributes have been added to this event yet.
## Objects
No objects have been associated with this event.
## Related Events
No related events have been linked to this event.
## Galaxies
No galaxies have been associated with this event.
## Summary
This MISP event (ID: 114) is currently in development and focuses on configuration and security posture issues. The event has been created but does not yet contain any attributes, objects, or relationships with other events. The event is set to be shared only within the organization (ORG_Main).
## Recommendations
1. Add relevant attributes to provide context about the specific configuration and security posture issues being addressed
2. Consider adding objects to structure the information more effectively
3. Link to related events if applicable
4. Determine appropriate galaxies to categorize the threat information
5. Review the threat level assignment to ensure it accurately reflects the severity
6. Consider publishing the event when it contains sufficient information
------
*Report generated on April 9, 2025*
