misp-galaxy | MISP events or attributes ( like threat actors

misp-galaxy is a Python library. misp-galaxy has no bugs, it has no vulnerabilities and it has low support. However misp-galaxy build file is not available and it has a Non-SPDX License. You can download it from GitHub.

MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default knowledge base (such as Threat Actors, Tools, Ransomware, ATT&CK matrixes) available in MISP galaxy but those can be overwritten, replaced, updated, forked and shared as you wish. Existing clusters and vocabularies can be used as-is or as a common knowledge base. MISP distribution can be applied to each cluster to permit a limited or broader distribution scheme. Galaxies can be also used to expressed existing matrix-like standards such as MITRE ATT&CK(tm) or custom ones. The objective is to have a comment set of clusters for organizations starting analysis but that can be expanded to localized information (which is not shared) or additional information (that can be shared).