cciucd/misp-forms repository overview

⁠MISP-Forms

MISP-Forms is a service designed to provide users with a set of intuitive web forms for reporting various types of cyberattacks.
These forms ensure that all relevant data is accurately captured and structured in a way that makes it actionable for law enforcement agencies, national authorities, and organisations such as CSIRTs (Computer Security Incident Response Teams).

MISP-Forms was developed as part of the UnderServed Project https://underserved-project.eu/⁠

⁠Key Features

• Delivered through a simple Python Flask web application
• Interfaces with any MISP instance
• Each form is tailored to reflect common cyberattack types or vectors
• Prescriptive input fields help ensure all essential information is collected — even from non-technical users
• Simplified sharing and distribution options
• Supports TLP, PAP, RSIT, and CIRCL taxonomies

⁠Technical Details

Submitted data is processed using the PyMISP Python library. Each submission is:

• Mapped to the appropriate MISP data types
• Tagged with relevant taxonomy terms (TLP, PAP, RSIT, and CIRCL)
• Assigned applicable Galaxy Clusters
• Configured with suitable distribution and sharing settings

⚠️ Events are not published automatically after submission.
This supports operational security and prevents the accidental disclosure of sensitive data. It is expected that a system administrator will review and publish events when appropriate.

⁠Setup

Two config files are required to run MISP-Forms: .env and misp_keys.json

⁠.env

Specify the URL for your MISP server and add a Flask secret key

MISP_URL=
MISP_VERIFY_SSL="false"
FLASK_SECRET_KEY=
LOOKYLOO_URL=
FLASK_ENV=production
FLASK_DEBUG=0
MAX_CONTENT_LENGTH_MB=5
LOG_LEVEL=INFO

⁠misp_keys.json

Create a MISP-Forms user on your MISP instance and generate an API key for that user. Add the user's MISP organisation name and API key in this file.

{
    "organistion_name": "misp-apikey"
}

⁠Pull Image

# Create .env
# Create misp_keys.json
docker run -d --env-file .env \
    -v $(pwd)/misp_keys.json:/app/misp_keys.json \
    -p 5000:5000 cciucd/misp-forms:latest

⁠Connecting to MISP-Forms

Open your browser and visit:

http://127.0.0.1:5000

or

http://{ip-address-or-domain}:5000

MISP-Forms is intended for use within access-controlled environments, such as local area networks (LANs) or internal infrastructure. This version does not include built-in user authentication and should not be exposed directly to the public internet.

If internet exposure is required, it is strongly recommended to place MISP-Forms behind a reverse proxy or gateway that provides authentication (e.g. using solutions like Keycloak, LDAP, or HTTP Basic Auth).