Soc Deploy Misp

---

name: soc-deploy-misp version: 1.0.0 description: "Deploy MISP threat intelligence platform on any Docker-ready Linux host. Official misp-docker project with automatic MariaDB memory tuning (prevents OOM on small VMs), API key generation via cake CLI, and credential management." tags: - soc - misp - threat-intelligence - security - docker - automation - ioc category: security

---

SOC Deploy: MISP (Malware Information Sharing Platform)

Deploy MISP threat intelligence platform on any Docker-ready Linux host using the official misp-docker project.

This skill does NOT create VMs. It expects an SSH target with Docker installed. Use hyperv-create-vm or proxmox-create-vm first if you need infrastructure.

When to Use

"deploy misp"

"set up misp"

"install misp"

"threat intel platform"

"ioc sharing platform"

User Inputs

| Parameter | Default | Required | |-----------|---------|----------| | SSH target | - | Yes (user@host) | | Admin email | admin@misp.local | No | | Admin password | ChangeMe123! | No | | Host RAM (for buffer pool) | 4GB | No |

Prerequisites Check

# SSH works
ssh  "echo OK"
Docker + Compose v2
ssh  "docker --version && docker compose version"
RAM check (need 3GB+ free)
ssh  "free -h | grep Mem"

Execution

Single command deployment

scp scripts/setup.sh :~/
ssh  "bash ~/setup.sh 'admin@misp.local' ''"

What setup.sh does

1. Clone official misp-docker from GitHub 2. Configure .env: - MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE - Generate random MySQL passwords - Set INNODB_BUFFER_POOL_SIZE based on host RAM (CRITICAL) 3. docker compose up -d 4. Poll for MISP readiness (5-10 min on first boot for DB migrations) 5. Generate API key via cake CLI:

   docker compose exec -T misp /var/www/MISP/app/Console/cake user change_authkey 
   

6. Verify API with /servers/getVersion 7. Save credentials to ~/misp/api-key.txt

Output to User

MISP deployed!
URL: https://
Admin: admin@misp.local / 
API Key: 
MCP Connection:
  MISP_URL=https://
  MISP_API_KEY=
  MISP_VERIFY_SSL=false
Note: Self-signed HTTPS. Use curl -k for API calls.
Credentials saved to: ~/misp/api-key.txt

InnoDB Buffer Pool Sizing

The #1 failure on small VMs. Default buffer pool is 2GB, which kills MariaDB on 4GB hosts.

| Host RAM | INNODB_BUFFER_POOL_SIZE | |----------|------------------------| | 4 GB | 512M | | 8 GB | 2048M | | 16 GB | 4096M |

Critical Gotchas

See references/gotchas.md for full details:

1. MariaDB OOM (showstopper): Default InnoDB buffer pool is 2GB. On 4GB hosts, MariaDB crashes instantly. MUST set INNODB_BUFFER_POOL_SIZE in .env 2. Recovery from OOM: docker compose down -v to wipe failed DB volume, fix .env, restart 3. First boot is slow: 5-10 min for DB schema creation and initial data load 4. Self-signed HTTPS: Use curl -k for all API calls 5. Advanced authkeys: Enabled by default. cake CLI is the most reliable key generation method 6. MISP web UI: https:// (port 443, not 80)

Timeout Strategy

Total: ~12-15 min (docker pull + first boot + setup). Split:

Turn 1: Clone, configure, docker compose up -d (~3 min + pull time)

Turn 2: Wait for health + generate API key (~5-7 min)

Pairs With

hyperv-create-vm - create a Hyper-V VM, then deploy MISP on it

proxmox-create-vm - create a Proxmox LXC/VM, then deploy MISP on it

soc-deploy-thehive - deploy TheHive alongside for case management