MISP Warning Lists (Beta)

Enrich incoming events with indicator context from MISP warning lists

Overview

MISP Warning Lists enrichment is in open beta starting with Panther version 1.115, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

You can use Malware Information Sharing Platform (MISP) warning lists as an enrichment source in Panther. MISP warning lists are collections of known, non-malicious indicators that can be associated to potential false positives or errors in threat intelligence. This context can help you evaluate the relevance and validity of Indicators of Compromise (IoCs).

The misp-warninglists repository on GitHub contains a comprehensive collection of these lists.

Learn how to view stored Enrichment Provider data here, and how to view log events with enrichment data here.

How MISP enrichment works

When MISP warning lists enrichment is enabled:

1. If an incoming log has the p_any_ip_addresses field, each value contained within will be checked against all MISP warning lists where "type": "cidr".

2. If an IP address in p_any_ip_addresses appears in any cidr MISP warning lists, a misp_warning_lists object will be added in the log's p_enrichment object.

   • See an example of an event enriched with MISP warning list data below.

Setting up MISP warning lists enrichment

Console

How to set up MISP warning lists enrichment in the Panther Console

1. In the left-hand navigation bar in your Panther Console, click Detections.

2. Click the Packs tab.

3. Search for "MISP," and on the MISP Warning Lists Lookup Tables tile, click the Enabled toggle ON.

4. In the pop-up confirmation modal, click Continue.

5. To verify the Enrichment is enabled, from the left sidebar menu, click Configure > Enrichments.

   • On this page, you can see all enrichment sources, whether each source is currently enabled or disabled, and when a source’s data was last refreshed.

CLI

Example event enriched with MISP warning lists data

Below is a Snowflake.LoginHistory log enriched with MISP data. The misp_warning_lists object within p_enrichment contains additional information about an IP address found in the p_any_ip_adresses field.

{
    "p_enrichment": {
	"misp_warning_lists": {
	    "p_any_ip_addresses": [
		{
		    "cidr": "35.160.0.0/12",
		    "p_match": "35.166.231.222",
		    "warning_lists": [
			{
			    "description": "Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)",
			    "id": "amazon-aws",
			    "name": "List of known Amazon AWS IP address ranges",
			    "version": 20250719
			}
		    ]
		}
	     ]
        }
    },
    "CLIENT_IP": "35.166.231.222",
    "EVENT_ID": "1829252345804554",
    "EVENT_TIMESTAMP": "2025-09-08 10:42:59.934000000",
    "EVENT_TYPE": "LOGIN",
    "FIRST_AUTHENTICATION_FACTOR": "PASSWORD",
    "IS_SUCCESS": "YES",
    "RELATED_EVENT_ID": "0",
    "REPORTED_CLIENT_TYPE": "GO_DRIVER",
    "REPORTED_CLIENT_VERSION": "1.13.2",
    "USER_NAME": "SOME_USER"
}