MISP on Ubuntu 24.04 on Azure User Guide

Overview

MISP (Malware Information Sharing Platform & Threat Sharing) is an open source threat intelligence platform used by CERTs, SOCs and security teams to store, correlate and share indicators of compromise, threat events, feeds, taxonomies, galaxies and sharing groups. Analysts create events, attach attributes and objects, tag them with taxonomies, correlate indicators automatically across events, pull curated open source feeds, and share selectively with partner organisations through sharing groups and server to server synchronisation.

The cloudimg image runs MISP the officially supported way: the upstream MISP/misp-docker Compose stack, pinned by immutable image digest and orchestrated by systemd. Four containers run on a private network: the MISP web application and REST API (nginx, PHP-FPM and the resque background workers), the MISP enrichment modules, a bundled MariaDB database and a Valkey (Redis) cache and worker backend. Because MISP holds sensitive threat intelligence, security is enforced from first boot, before the ports are reachable: a unique site admin password, REST API key, per instance GnuPG signing key, database and cache passwords, salt and encryption key are generated for each VM, so the well known upstream default administrator is rejected and no secret is shared between customers. Backed by 24/7 cloudimg support.

MISP is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the MISP project. It ships the unmodified upstream open source release under the GNU Affero General Public License v3.0 (AGPL-3.0); the verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/cloudimg/third-party-licences.

What is included:

• MISP core v2.5.44 and MISP modules v3.0.9, the full open source stack, pinned by digest and captured into the VM
• A bundled MariaDB database and a Valkey (Redis) cache and background worker backend, reachable only inside a private Docker network (never published to a host port)
• The MISP web application and REST API behind nginx, terminating TLS on port 443
• docker.service, misp-firstboot.service and misp.service as systemd units, enabled and active on boot
• A unique site admin password, REST API key, per instance GnuPG signing key, database and cache passwords, salt and encryption key generated per VM on first boot, never baked into the image
• A clean, empty instance on first boot: no default account, no shipped threat data
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) comfortably runs the full stack and is the recommended starting point; increase the size for more analysts, larger feeds and heavier correlation. NSG inbound rules: allow 22/tcp from your management network and 443/tcp for the web interface and REST API. The web interface is served over HTTPS with a per VM self signed certificate; for production, front it with your own domain and a trusted certificate (see the final section).

Step 1 - Deploy from the Azure Marketplace

1. In the Azure portal, choose Create a resource and search the Marketplace for the cloudimg MISP offer.
2. Select the plan, then Create.
3. On the Basics tab pick your subscription, resource group and region, name the VM, and select Standard_B2ms (or larger).
4. Choose SSH public key authentication with admin username azureuser and provide your public key.
5. On the Networking tab, allow inbound 22/tcp from your management network and 443/tcp for the web interface.
6. Review and create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group my-misp-rg \
  --name misp \
  --image cloudimg:misp-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web interface port (SSH is opened by default):

az vm open-port --resource-group my-misp-rg --name misp --port 443 --priority 900

Step 3 - First boot and the running stack

On the first boot the misp-firstboot.service unit generates this VM's unique secrets, resolves the base URL to the VM's reachable address, brings the Compose stack up and waits until MISP has finished initialising (schema import, GnuPG key generation and site configuration). This takes a few minutes on first boot. Once it completes, the three systemd units are active and all four containers are healthy.

sudo systemctl is-active docker.service misp-firstboot.service misp.service
cd /opt/misp && sudo docker compose ps

The bundled MariaDB, Valkey (Redis) and the MISP enrichment modules are never published to a host port; only ports 80 and 443 are exposed, and 80 redirects to 443.

Step 4 - Retrieve the per VM credentials

A unique site admin password, REST API key, GnuPG signing key, database and cache passwords, salt and encryption key are generated for this VM on first boot. The plaintext admin password and API key are written to a root only file:

sudo cat /root/misp-credentials.txt

The file records MISP_URL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSWORD and MISP_ADMIN_KEY. The login email is <MISP_ADMIN_EMAIL> and the URL for this VM is <MISP_URL>. Keep this file secret; it is 0600 root:root.

Step 5 - Sign in to the MISP web interface

Open <MISP_URL> in your browser. Because the certificate is a per VM self signed certificate, your browser warns once; accept it to continue. Sign in with the email <MISP_ADMIN_EMAIL> and the password from the credentials file. The upstream default password admin is rejected on this image, so only the per VM password works.

MISP opens on the event index. To see the platform in action, create an event under Event Actions > Add Event, then add attributes (indicators of compromise) such as IP addresses, domains, URLs and file hashes. Events, their attributes and their correlations are the heart of MISP.

Opening an event shows its metadata, tags and the attributes that make up the indicators of compromise, along with any automatic correlations against other events.

Step 6 - Use the REST API

Every action in the MISP web interface is also available over the REST API, authenticated with your per VM API key. A quick health check and version query:

curl -sk https://127.0.0.1/users/heartbeat -o /dev/null -w 'heartbeat HTTP %{http_code}\n'
curl -sk -H "Authorization: <MISP_ADMIN_KEY>" -H 'Accept: application/json' https://127.0.0.1/servers/getVersion.json

The image ships a helper that proves the security model end to end: the per VM API key authenticates as the site admin, a bogus key and an anonymous request are rejected, and MISP reports its version.

sudo /usr/local/sbin/misp-roundtrip.sh

You can now query and create events from your own tooling, for example with PyMISP, using <MISP_URL> as the base URL and your API key.

Step 7 - Enable threat intelligence feeds

MISP ships with a catalogue of curated open source feeds. Under Sync Actions > List Feeds you can load the default feed metadata, enable feeds such as the CIRCL OSINT Feed or Botvrij.eu, and fetch their data to populate your instance with community indicators.

Architecture and security notes

The image runs the unmodified upstream MISP stack, pinned by immutable digest so every VM runs exactly the reviewed images. Only ports 80 and 443 are exposed; the database, cache and enrichment modules stay on the private Docker network.

cat /opt/misp/image-digests.txt

Every secret is unique to this VM and generated on first boot: the site admin password, the REST API key, a per instance 3072 bit GnuPG signing key, the MariaDB and Valkey passwords, the MISP salt and the encryption key. Nothing sensitive is baked into the image, and two VMs launched from this image share no secret.

Moving to production

1. Change the admin identity. Under Administration > List Users, change the administrator email away from the default and set your own password. Create additional users and organisations as needed.
2. Use your own domain and certificate. Point DNS at the VM, then set MISP's base URL and install a trusted certificate (for example with a reverse proxy or by replacing the certificate in /opt/misp/ssl). Restart the stack with cd /opt/misp && sudo docker compose up -d after configuration changes.
3. Restrict the network. Limit the NSG so the web interface is reachable only from your trusted networks, and keep SSH restricted to your management range.
4. Enable feeds and sharing that match your trust community, and configure server synchronisation with partner MISP instances under Sync Actions.

Support

This image is produced and maintained by cloudimg with 24/7 support at support@cloudimg.co.uk. MISP is open source under the GNU Affero General Public License v3.0; the verbatim licence and a pointer to the corresponding source ship inside the image under /usr/share/doc/cloudimg/third-party-licences.