Deploying MISP with Docker on Ubuntu — A Practical Threat Intelligence Setup Guide

Video Link: https://youtu.be/yMLpkgrhHEY

Introduction

In modern Security Operations Centers (SOC), collecting logs is only one part of the equation. The real value comes from understanding whether the activity you are observing is actually malicious.

For example:

• Is this IP address communicating with my infrastructure associated with known malicious activity?
• Is this domain linked to malware campaigns?
• Have these Indicators of Compromise (IoCs) already been observed by other organizations?

This is where Threat Intelligence becomes essential.

Rather than manually investigating every indicator, organizations need a centralized platform capable of collecting, correlating, and sharing intelligence automatically. A good Threat Intelligence platform should help security teams:

• Enrich security investigations with actionable intelligence
• Aggregate indicators from multiple intelligence sources
• Correlate suspicious activity automatically
• Reduce manual analysis time for SOC analysts

In this guide, I will walk through the deployment of MISP (Malware Information Sharing Platform) using Docker on Ubuntu, providing a fast and practical way to build your own Threat Intelligence environment.

What is MISP?

MISP is an open-source Threat Intelligence platform widely used for collecting, sharing, storing, and correlating cyber threat information.

Originally designed to facilitate intelligence sharing between organizations, MISP has become one of the most valuable tools for:

• Cyber Threat Intelligence (CTI)
• Incident Response
• SOC Operations
• Threat Hunting
• Malware Analysis

At its core, MISP allows teams to manage and distribute Indicators of Compromise (IoCs) such as:

• Malicious IP addresses
• Domains
• File hashes
• URLs
• Malware samples
• TTPs (Tactics, Techniques, and Procedures)

One of the strongest capabilities of MISP is its correlation engine, which automatically identifies relationships between indicators, campaigns, and threat actors.

Installing Docker on Ubuntu

Before deploying MISP, Docker must be installed.

Update the package index:

sudo apt update

Install required packages:

sudo apt install \
ca-certificates \
curl \
gnupg \
lsb-release

Add Docker’s GPG key:

sudo mkdir -p /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

Add the Docker repository:

sudo apt update

sudo apt install docker-ce docker-ce-cli \
containerd.io docker-buildx-plugin \
docker-compose-plugin -y

Deploying MISP with Docker

Clone the MISP Docker repository:

git clone https://github.com/MISP/misp-docker.git

Move into the project directory:

cd misp-docker

Copy the environment template:

cp template.env .env

Edit the configuration file:

nano .env

Update the following parameters according to your environment:

MYSQL_HOST=misp_db
MYSQL_DATABASE=misp
MYSQL_USER=misp
MYSQL_PASSWORD=StrongPassword

MYSQL_ROOT_PASSWORD=StrongRootPassword

MISP_ADMIN_EMAIL=admin@yourdomain.com
MISP_ADMIN_PASSPHRASE=StrongPassword

MISP_BASEURL=https://your-ip-address

TIMEZONE=Europe/Paris

Save the file and build the containers:

docker compose buil

Start MISP:

docker compose up -d

You can verify running containers with:

docker ps

If everything is configured correctly, MISP should now be accessible from your browser.