MISP/misp-training

# MISP 培训资料 本仓库包含所有正在使用的培训资料，例如： - MISP 核心（软件与标准）培训 - 威胁情报与 OSINT 培训 - 构建信息共享社区研讨会 ## 资料 | 幻灯片 (PDF) | 源代码 | | ------------ | ----------- | | [0-misp-introduction-to-information-sharing](https://www.misp-project.org/misp-training/0-misp-introduction-to-information-sharing.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/0-misp-introduction-to-information-sharing) | | [MISP 数据模型概述（快速）](https://raw.githubusercontent.com/MISP/misp-training/477bdc9c71f77abd572f11c98f3ac8ecabe54310/complementary/other-slides/a.11.a-misp-data-model-overview.pdf) | | | [MISP 十诫](https://github.com/MISP/misp-training/blob/main/complementary/other-slides/MISP%2010%20Commandments%20-%20Recommendations%20and%20Best%20Practices%20when%20encoding%20data.pdf)|| | [1-misp-usage](https://www.misp-project.org/misp-training/1-misp-usage.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/1-misp-usage) | | [1.2-misp-integration](https://www.misp-project.org/misp-training/1.2-misp-integration.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/1.2-misp-integration) | | [1.1-misp-viper-integration](https://www.misp-project.org/misp-training/1.1-misp-viper-integration.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/1.1-misp-viper-integration) | | [1.2.1-misp-integration-mail2misp](https://www.misp-project.org/misp-training/1.2.1-misp-integration-mail2misp.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/1.2.1-misp-integration-mail2misp) | | [2-misp-administration](https://www.misp-project.org/misp-training/2-misp-administration.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/2-misp-administration) | | [3-misp-taxonomy-tagging](https://www.misp-project.org/misp-training/3-misp-taxonomy-tagging.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/3-misp-taxonomy-tagging) | | [3.1-misp-modules](https://www.misp-project.org/misp-training/3.1-misp-modules.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/3.1-misp-modules) | | [3.2-misp-galaxy](https://www.misp-project.org/misp-training/3.2-misp-galaxy.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/3.2-misp-galaxy) | | [3.3-misp-object-template](https://www.misp-project.org/misp-training/3.3-misp-object-template.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/3.3-misp-object-template) | | [6.0-misp-dashboard](https://www.misp-project.org/misp-training/6.0-misp-dashboard.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/6.0-misp-dashboard) | | [a.0-contributing](https://www.misp-project.org/misp-training/a.0-contributing.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.0-contributing) | | [a.1-devintro](https://www.misp-project.org/misp-training/a.1-devintro.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.1-devintro) | | [a.2-pymisp](https://www.misp-project.org/misp-training/a.2-pymisp.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.2-pymisp) | | [a.3-misp-feed](https://www.misp-project.org/misp-training/a.3-misp-feed.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.3-misp-feed) | | [a.4-best-practices](https://www.misp-project.org/misp-training/a.4-best-practices.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.4-best-practices) | | [a.5-decaying-indicators](https://www.misp-project.org/misp-training/a.5-decaying-indicators.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.5-decaying-indicators) | | [a.5-bis-decaying-indicators-light-version](https://www.misp-project.org/misp-training/a.5-bis-decaying-indicators-light-version.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.5-bis-decaying-indicators-light-version) | | [a.6-forensic](https://www.misp-project.org/misp-training/a.6-forensic.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.6-forensic) | | [a.7-rest-API](https://www.misp-project.org/misp-training/a.7-rest-API.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.7-rest-API) | | [b.1-best-practices-in-threat-intelligence](https://www.misp-project.org/misp-training/b.1-best-practices-in-threat-intelligence.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/b.1-best-practices-in-threat-intelligence) | | [b.5-turning-data-into-actionable-intelligence-training](https://www.misp-project.org/misp-training/b.5-turning-data-into-actionable-intelligence-training.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/b.5-turning-data-into-actionable-intelligence-training) | | [a.8-dev-hands-on](https://www.misp-project.org/misp-training/a.8-dev-hands-on.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.8-dev-hands-on) | | [a.9-restsearch-dev](https://www.misp-project.org/misp-training/a.9-restsearch-dev.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.9-restsearch-dev) | | [a.10-galaxy-2.0](https://www.misp-project.org/misp-training/a.10-galaxy-2.0.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.10-galaxy-2.0) | | [a.11-misp-data-model](https://www.misp-project.org/misp-training/a.11-misp-data-model.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.11-misp-data-model) | | [a.12-misp-workflows](https://www.misp-project.org/misp-training/a.12-misp-workflows.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.12-misp-workflows) | | [a.13-misp-stix](https://www.misp-project.org/misp-training/a.13-misp-stix.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.13-misp-stix) | | [a.a-widget-dev](https://www.misp-project.org/misp-training/a.a-widget-dev.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.a-widget-dev) | | [b.2-turning-data-into-actionable-intelligence](https://www.misp-project.org/misp-training/b.2-turning-data-into-actionable-intelligence.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/b.2-turning-data-into-actionable-intelligence) | | [4-misp-standard](https://www.misp-project.org/misp-training/4-misp-standard.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/4-misp-standard) | | [x.13-exercise-movie](https://www.misp-project.org/misp-training/x.13-exercise-movie.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/x.13-exercise-movie) | | [a.b-cli](https://www.misp-project.org/misp-training/a.b-cli.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.b-cli) | | [a.c-deployment](https://www.misp-project.org/misp-training/a.c-deployment.pdf) | [源码](https://github.com/MISP/misp-training/tree/main/a.c-deployment) | ### 补充资料 | 幻灯片 (PDF) | 源代码 | | ------------ | ----------- | | [完整的幻灯片 PDF 合集](https://www.misp-project.org/misp-training/misp-training.pdf) | [源码](https://github.com/MISP/misp-training/) | | [MISP 培训速查表](https://www.misp-project.org/misp-training/cheatsheet.pdf) | [源码](https://github.com/MISP/misp-training/tree/master/training-support/compact-cheatsheet) | | [MISP 功能列表（供培训师参考）](https://www.misp-project.org/misp-training/usage.pdf) | [源码](https://github.com/MISP/misp-training/tree/master/training-support/checklist) | ### 额外文档 - [MISP 手册](https://github.com/MISP/misp-book/) - [PDF](https://www.circl.lu/doc/misp/book.pdf) [ePub](https://www.circl.lu/doc/misp/book.epub) [Kindle mobi](https://www.circl.lu/doc/misp/book.mobi) [HTML](https://www.circl.lu/doc/misp/) - [威胁情报最佳实践](https://github.com/MISP/best-practices-in-threat-intelligence) [PDF](https://www.misp-project.org/best-practices-in-threat-intelligence.pdf) [HTML](https://www.misp-project.org/best-practices-in-threat-intelligence.html) - [MISP Galaxy (HTML)](https://www.misp-project.org/galaxy.html) - [PDF](https://www.misp-project.org/galaxy.pdf) - [MISP Galaxy 专属网站](https://www.misp-galaxy.org/) - [MISP 分类法 (HTML)](https://www.misp-project.org/taxonomies.html) - [PDF](https://www.misp-project.org/taxonomies.pdf) - [MISP 对象模板 (HTML)](https://www.misp-project.org/objects.html) - [PDF](https://www.misp-project.org/objects.pdf) - [建立如 ISAC 或 ISAO 等信息共享社区的指南](https://github.com/MISP/misp-compliance/blob/master/setting-up-ISACs/guidelines_to_set-up_an_ISAC.md) - [PDF](https://www.x-isac.org/assets/images/guidelines_to_set-up_an_ISAC.pdf) - [官方 MISP 安装指南](https://misp.github.io/MISP/) ### MISP 培训视频 这些示例视频可用于了解如何结合实际的 MISP 演示实例来使用这些培训资料。 - [MISP 工作流](https://www.youtube.com/watch?v=OyLE2g4zii0) - 2022年12月16日 - [MISP 威胁情报编码最佳实践（3小时 - 在线）](https://www.youtube.com/watch?v=JIeiwzY7Fvs) - 2022年12月15日 - [MISP 培训：MISP 软件的管理与部署](https://youtu.be/sIHTRIwF-Mk) - 2022年9月14日 - [MISP 培训：面向分析师和安全专业人员的威胁情报介绍](https://youtu.be/sb36MMRTtLM) - 2022年9月13日 - [FIRSTdotOrg 2021 非洲和阿拉伯地区虚拟研讨会之 MISP 基础培训](https://www.youtube.com/watch?v=00jq7Gbqdz8) - 2021年12月18日 - [MISP 通用使用培训 - 第 1 部分（共 2 部分）](https://www.youtube.com/watch?v=-NuODyh1YJE) - [MISP 通用使用培训 - 第 2 部分（共 2 部分）](https://www.youtube.com/watch?v=LlKnh5b0bgw) - [MISP 培训使用 - 2021年3月2日培训 - 2小时50分钟](https://cra.circl.lu/videos/MISP-Usage-Training-20210302.mp4) - [MISP 培训：管理与构建社区 - 2021年3月3日培训 - 2小时56分钟](https://cra.circl.lu/videos/MISP-Administration-and-Building-Communities-20210303.mp4) - [MISP 培训模块 1 - 网络安全信息共享简介](https://www.youtube.com/watch?v=aM7czPsQyaI) - [MISP 培训模块 2 - MISP 的通用用法](https://www.youtube.com/watch?v=Jqp8CVHtNVk) - [MISP covid-19 共享社区 - 简介](https://peertube.opencloud.lu/videos/watch/4f7acd4c-a909-4315-87aa-38ba95cceaf2) #### Passive DNS 与 MISP - 培训视频 - [Farsight Passive DNS 与 MISP - 第 I 部分](https://vimeo.com/561877178/ac09629591) - [Farsight Passive DNS 与 MISP - 第 II 部分](https://vimeo.com/561903295/8af1d6692b) - [Farsight Passive DNS 与 MISP - 第 III 部分](https://vimeo.com/561908216/764a2e19e4) ### MISP 培训虚拟机 预构建的 MISP 培训虚拟机可在 [https://vm.misp-project.org/](https://vm.misp-project.org/) 获取。 ## 源代码 培训幻灯片的完整源代码已公开。您需要使用安装了最新版 LaTeX（包含 latex-beamer）的操作系统才能对其进行操作。 构建完整的培训资料： ``` bash build.sh ``` 输出目录将包含所有生成的 PDF 文件，以及名为 `misp-training.pdf` 的 PDF 文件，该文件是所有幻灯片的完整讲义。 **注意**：如果渲染效果有些异常，可能与 LaTeX 使用了系统中安装在 `/usr/share/texlive/texmf-dist/tex/latex/beamertheme-focus` 的样式有关。删除此目录即可解决该问题。 ## 依赖项 [FiraMath 字体](https://github.com/firamath/firamath/releases) XeLaTex，可在 .tex 头部中进行配置（在 TeXshop 中可用）： ``` % !TEX TS-program = xelatex % !TEX encoding = UTF-8 Unicode ``` ## 许可证、致谢与资金支持 所有资料均采用双重许可：GNU Affero General Public License v3 或更高版本，以及 Creative Commons Attribution-ShareAlike 4.0 International。您可以根据对培训资料的 具体使用情况选择其中一种许可证。 MISP 项目培训资料由 CIRCL Computer Incident Response Center Luxembourg[](https://www.circl.lu/) 联合出资并提供支持，同时由 CEF (Connecting Europe Facility) 根据 CEF-TC-2016-3 - 网络安全计划，以“将 MISP 改进为下一代信息共享的构建模块”之名提供联合资金支持。   所有源代码均可在 [https://www.github.com/MISP/misp-training](https://www.github.com/MISP/misp-training) 获取。 如果您复用了这些培训资料，请勿忘记包含上述内容以作致谢。

标签：逆向工具