rootshell/misp repository overview

⁠Introduction

This image contains the latest version of MISP (2.4.110). It requires a MySQL container to store the database. See http://www.misp-project.org/⁠ for more details. The Docker repository is: https://github.com/MISP/misp-docker⁠

⁠Configuration

The container needs the following environment variables:

• MYSQL_ROOT_PASSWORD = Root password for the MySQL database server
• MYSQL_MISP_PASSWORD = MISP user password for the database
• MYSQL_HOST = MySQL FQDN/IP
• MISP_ADMIN_EMAIL = Admin email address (used to generated the PGP key)
• MISP_ADMIN_PASSPHRASE = PGP key passphrase
• MISP_BASEURL = MISP base URL (http://fqdn⁠)
• POSTFIX_RELAY_HOST = Smart relay for the local Postfix instance
• TIMEZONE = Container timezone (optional)

The web interface is available via HTTP (TCP/80). I recommend to use a NGinx container as a reverse-proxy to provide SSL support.

⁠Startup

The container is stand alone and can be started using the 'run' command or, better, a docker compose file:

version: '2'

networks:
  misp-network:
    driver: bridge

services:
  misp-web:
    build: misp-web
    depends_on:
      - misp-db
    container_name: misp-web
    hostname: misp-web
    image: misp-web:latest
    restart: always
    networks:
      - misp-network
    links:
      - misp-db
    ports:
      - "80:80"
    volumes:
      - /dev/urandom:/dev/random
      - /data/misp:/var/www/MISP
    environment:
      - MYSQL_ROOT_PASSWORD=xxxxxxxx
      - MYSQL_MISP_PASSWORD=xxxxxxxx
      - MYSQL_HOST=misp-db
      - [email protected]
      - MISP_ADMIN_PASSPHRASE=xxxxxxxxx
      - MISP_BASEURL=http:\/\/misp\.test
      - POSTFIX_RELAY_HOST=relay.fqdn
      - TIMEZONE=Europe/Brussels

  misp-db:
    build: 
      context: misp-db
      args:
        MYSQL_MISP_PASSWORD: xxxxxxxx
    container_name: misp-db
    hostname: misp-db
    image: misp-db:latest
    restart: always
    networks:
      - misp-network
    volumes:
      - /data/mysql:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=xxxxxxxx

⁠Post Setup

The container will configure itself and MISP will be ready to use. However for a production environment, it is highly recommanded to review all the settings and adapt them to match your requirements.