Deployment guide

MISP

Overview

MISP (Malware Information Sharing Platform & Threat Sharing) is an open-source threat intelligence platform used by CERTs, SOCs and security teams to store, correlate and share indicators of compromise, threat events, feeds, taxonomies, galaxies and sharing groups. Analysts create events, attach attributes and objects, tag them with taxonomies and correlate indicators automatically across events. They also pull curated open-source feeds and share selectively with partner organisations through sharing groups and server-to-server synchronisation.

This SecureAnyCloud image runs MISP the officially supported way: the upstream MISP/misp-docker Compose stack, pinned by immutable image digest and orchestrated by systemd. Because MISP holds sensitive threat intelligence, security is enforced from first boot, before the ports are reachable.

What you get:

MISP core v2.5.44 and MISP modules v3.0.9, the full open-source stack, pinned by digest and captured into the VM
Four containers on a private network: the MISP web application and REST API (nginx, PHP-FPM and the resque background workers), the MISP enrichment modules, a bundled MariaDB database and a Valkey (Redis) cache and worker backend. The database and cache are reachable only inside the private Docker network and are never published to a host port
The MISP web application and REST API behind nginx, terminating TLS on port 443
docker.service, misp-firstboot.service and misp.service as systemd units, enabled and active on boot
A unique site admin password, REST API key, per-instance GnuPG signing key, database and cache passwords, salt and encryption key, generated for each VM on first boot and never baked into the image. The well-known upstream default administrator is rejected, and no secret is shared between customers
A clean, empty instance on first boot: no default account and no shipped threat data
24/7 SecureAnyCloud support

MISP is a trademark of its respective owner. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by the MISP project. It ships the unmodified upstream open-source release under the GNU Affero General Public License v3.0 (AGPL-3.0). The verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/sac/third-party-licences.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) comfortably runs the full stack and is the recommended starting point. Increase the size for more analysts, larger feeds and heavier correlation.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 443/tcp for the web interface and REST API. The web interface is served over HTTPS with a per-VM self-signed certificate. For production, front it with your own domain and a trusted certificate (see the final section).

Step 1 - Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud MISP offer.
Select the plan, then select Create.
On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2ms or larger.
Choose SSH public key authentication with admin username azureuser and provide your public key.
On the Networking tab, allow inbound 22/tcp from your management network and 443/tcp for the web interface.
Select Review + create, then Create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:misp-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-misp-rg \
  --name misp \
  --image sac1647283583153:misp-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web interface port. SSH is opened by default:

az vm open-port --resource-group my-misp-rg --name misp --port 443 --priority 900

Step 3 - First boot and the running stack

On first boot, the misp-firstboot.service unit generates this VM's unique secrets and resolves the base URL to the VM's reachable address. It then brings the Compose stack up and waits until MISP has finished initialising (schema import, GnuPG key generation and site configuration).

This takes a few minutes. When it completes, the three systemd units are active and all four containers are healthy. Check them with:

sudo systemctl is-active docker.service misp-firstboot.service misp.service cd /opt/misp && sudo docker compose ps

The bundled MariaDB, Valkey (Redis) and the MISP enrichment modules are never published to a host port. Only ports 80 and 443 are exposed, and 80 redirects to 443.

Step 4 - Retrieve the per-VM credentials

First boot generates a unique site admin password, REST API key, GnuPG signing key, database and cache passwords, salt and encryption key for this VM. It writes the plaintext admin password and API key to a root-only file. Read it with:

sudo cat /root/misp-credentials.txt

The file records MISP_URL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSWORD and MISP_ADMIN_KEY. The login email is <MISP_ADMIN_EMAIL> and the URL for this VM is <MISP_URL>. Keep this file secret. Its permissions are 0600 root:root.

Step 5 - Sign in to the MISP web interface

Open <MISP_URL> in your browser. The certificate is a per-VM self-signed certificate, so your browser warns once. Accept the warning to continue.

Sign in with the email <MISP_ADMIN_EMAIL> and the password from the credentials file. The upstream default password admin is rejected on this image, so only the per-VM password works.

MISP opens on the event index. To see the platform in action, create an event under Event Actions > Add Event, then add attributes (indicators of compromise) such as IP addresses, domains, URLs and file hashes. Events, their attributes and their correlations are the heart of MISP.

Open an event to see its metadata, its tags and the attributes that make up the indicators of compromise, along with any automatic correlations against other events.

Step 6 - Use the REST API

Every action in the MISP web interface is also available over the REST API, authenticated with your per-VM API key. Run a quick health check and version query:

curl -sk https://127.0.0.1/users/heartbeat -o /dev/null -w 'heartbeat HTTP %{http_code}\n'
curl -sk -H "Authorization: <MISP_ADMIN_KEY>" -H 'Accept: application/json' https://127.0.0.1/servers/getVersion.json

The image ships a helper that checks the security model end to end. It confirms that the per-VM API key authenticates as the site admin, that a bogus key and an anonymous request are rejected, and that MISP reports its version.

sudo /usr/local/sbin/misp-roundtrip.sh

You can now query and create events from your own tooling, for example with PyMISP. Use <MISP_URL> as the base URL, together with your API key.

Step 7 - Enable threat intelligence feeds

MISP ships with a catalogue of curated open-source feeds. Open Sync Actions > List Feeds and load the default feed metadata. Then enable feeds such as the CIRCL OSINT Feed or Botvrij.eu, and fetch their data to populate your instance with community indicators.

Architecture and security notes

The image runs the unmodified upstream MISP stack, pinned by immutable digest so that every VM runs exactly the reviewed images. Only ports 80 and 443 are exposed. The database, cache and enrichment modules stay on the private Docker network. To see the pinned digests, run:

cat /opt/misp/image-digests.txt

Every secret is unique to this VM and generated on first boot: the site admin password, the REST API key, a per-instance 3072-bit GnuPG signing key, the MariaDB and Valkey passwords, the MISP salt and the encryption key.

Nothing sensitive is baked into the image, and two VMs launched from this image share no secret.

Moving to production

Change the admin identity. Under Administration > List Users, change the administrator email away from the default and set your own password. Create additional users and organisations as needed.
Use your own domain and certificate. Point DNS at the VM, then set MISP's base URL and install a trusted certificate, for example with a reverse proxy or by replacing the certificate in /opt/misp/ssl. After configuration changes, restart the stack with cd /opt/misp && sudo docker compose up -d.
Restrict the network. Limit the NSG so that the web interface is reachable only from your trusted networks, and keep SSH restricted to your management range.
Enable feeds and sharing that match your trust community, and configure server synchronisation with partner MISP instances under Sync Actions.

Support

This image is produced and maintained by SecureAnyCloud with 24/7 support at sales@secureanycloud.com.

MISP is open source under the GNU Affero General Public License v3.0. The verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/sac/third-party-licences.

Deploy on Azure

Launch MISP on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure