Lab 7.1 — IOC Lookup

Lab Overview

The Scenario

Your SIEM has flagged suspicious network activity over the past 24 hours. The Tier 1 analyst extracted 5 IOCs from the alert data and escalated them to you for threat intelligence enrichment. Your task is to look up each IOC in your organization's MISP instance, determine whether it matches any known threat, and produce a structured report.

The 5 IOCs from the alert:

For each IOC you will: search MISP, determine if it's known or unknown, identify the associated threat (if any), and assess the confidence level.

Part 1: Accessing MISP and Orientation

Step 1: Log In to MISP

Once your lab environment is running, open the MISP web UI. Log in with:

• Email: admin@admin.test
• Password: CyberBlue2026!

Step 2: Explore the Pre-Loaded Events

Navigate to Event Actions → List Events from the top menu. You should see 5 pre-loaded threat events:

Step 3: Understand the Search Interface

Click Event Actions → Search Attributes (or use the global search bar at the top). This is where you'll perform your IOC lookups. The search interface lets you filter by:

• Value — the IOC itself (IP, hash, domain)
• Type — restrict to ip-dst, domain, md5, sha256, etc.
• Category — Network activity, Payload delivery, etc.

Click to enlarge

Part 2: IOC Lookup — Step by Step

IOC #1: IP Address 203.0.113.50

1. Go to Event Actions → Search Attributes
2. In the Value field, enter: 203.0.113.50
3. Click Search (or press Enter)

Record your findings:

• Did MISP return a match? (Yes/No)
• If yes: which event? What threat does it relate to?
• What is the attribute type? (ip-dst, ip-src, etc.)
• What tags are attached to the parent event? (Look for TLP and threat-level tags)
• What galaxy clusters are linked? (MITRE ATT&CK techniques, threat actor)

IOC #2: IP Address 198.51.100.23

Repeat the same search process:

1. Search for 198.51.100.23 in the attribute search
2. Note which event it belongs to (if any)
3. Record the attribute category, type, and any related attributes in the same event
4. Check for galaxy clusters — does MISP link this IP to a specific threat actor or technique?

IOC #3: Domain update-service.darkoperator.com

1. Search for update-service.darkoperator.com
2. This is a domain IOC — pay attention to the attribute type (domain, hostname, or url)
3. If matched, click into the parent event and look for correlations — other IOCs in the same event that might appear in your network logs

IOC #4: MD5 Hash e99a18c428cb38d5f260853678922e03

1. Search for the hash value: e99a18c428cb38d5f260853678922e03
2. If matched, note the malware family from the event name or galaxy cluster
3. Check the IDS flag — is this attribute marked for IDS signature generation?
4. Look at the comment field for analyst notes about the sample

IOC #5: SHA-256 Hash

1. Search for: 7a4b8c3d9e2f1a5b6c8d0e3f4a7b9c1d2e5f8a0b3c6d9e1f4a7b0c3d6e9f2a
2. Record match/no-match
3. If matched, compare the confidence level on this event vs. the others you've found

Part 3: Interpreting MISP Results

For each matched IOC, you need to extract and understand several metadata fields. Here's what to look for:

Threat Level

MISP assigns one of four threat levels to each event:

TLP (Traffic Light Protocol)

Look for TLP tags on events — they control how you can share the intelligence:

Confidence Tags

MISP events may include confidence indicators. Combine the source reliability with the data confidence to assess how much weight to give the IOC.

Galaxy Clusters

Galaxy clusters map threat intelligence to structured frameworks:

• MITRE ATT&CK — techniques used by the threat actor (T1566 Phishing, T1059 Command Execution, etc.)
• Threat Actor — named groups (APT29, FIN7, Lazarus, etc.)
• Malware — named malware families (Emotet, Cobalt Strike, LockBit, etc.)

Click to enlarge

Part 4: Build Your IOC Lookup Report

Using your findings, complete the following report template. This is the format a SOC analyst would attach to an incident ticket.

IOC LOOKUP REPORT
═════════════════════════════════════════
Analyst: [your name]
Date: [today's date]
Source: SIEM Alert Escalation (Tier 1)
Platform: MISP (CyberBlue Lab Instance)

IOC #1: 203.0.113.50 (IP Address)
  Status:       [KNOWN / UNKNOWN]
  Matched Event: [event name or "No match"]
  Malware Family: [family or "N/A"]
  Threat Level:  [High / Medium / Low / N/A]
  TLP:           [RED / AMBER / GREEN / WHITE / N/A]
  Confidence:    [assessment]
  ATT&CK Techniques: [T-codes or "N/A"]
  Recommendation: [block / monitor / investigate further]

IOC #2: 198.51.100.23 (IP Address)
  Status:       [KNOWN / UNKNOWN]
  Matched Event: [event name or "No match"]
  Malware Family: [family or "N/A"]
  Threat Level:  [High / Medium / Low / N/A]
  TLP:           [RED / AMBER / GREEN / WHITE / N/A]
  Confidence:    [assessment]
  ATT&CK Techniques: [T-codes or "N/A"]
  Recommendation: [block / monitor / investigate further]

IOC #3: update-service.darkoperator.com (Domain)
  Status:       [KNOWN / UNKNOWN]
  Matched Event: [event name or "No match"]
  Malware Family: [family or "N/A"]
  Threat Level:  [High / Medium / Low / N/A]
  TLP:           [RED / AMBER / GREEN / WHITE / N/A]
  Confidence:    [assessment]
  ATT&CK Techniques: [T-codes or "N/A"]
  Recommendation: [block / monitor / investigate further]

IOC #4: e99a18c428cb38d5f260853678922e03 (MD5)
  Status:       [KNOWN / UNKNOWN]
  Matched Event: [event name or "No match"]
  Malware Family: [family or "N/A"]
  Threat Level:  [High / Medium / Low / N/A]
  TLP:           [RED / AMBER / GREEN / WHITE / N/A]
  Confidence:    [assessment]
  ATT&CK Techniques: [T-codes or "N/A"]
  Recommendation: [block / monitor / investigate further]

IOC #5: 7a4b8c3d...6e9f2a (SHA-256)
  Status:       [KNOWN / UNKNOWN]
  Matched Event: [event name or "No match"]
  Malware Family: [family or "N/A"]
  Threat Level:  [High / Medium / Low / N/A]
  TLP:           [RED / AMBER / GREEN / WHITE / N/A]
  Confidence:    [assessment]
  ATT&CK Techniques: [T-codes or "N/A"]
  Recommendation: [block / monitor / investigate further]

SUMMARY
  Total IOCs Investigated: 5
  Known (Matched):        [count]
  Unknown (No Match):     [count]
  Highest Threat Level:   [level]
  Recommended Actions:    [summary of blocking/monitoring recommendations]

Deliverable Checklist

Before completing the lab, ensure you have:

• 5 IOC lookups completed — each searched in MISP with results documented
• Match/no-match determination for every IOC with justification
• Threat metadata extracted — threat level, TLP, galaxy clusters for each matched IOC
• Event pivoting performed — at least 2 matched IOCs explored via their parent event to find related indicators
• Completed IOC Lookup Report — the full template filled out with all 5 IOCs

What's Next

In Lab 7.2 — Feed Correlation, you'll go beyond manual lookups and configure MISP's automated threat intelligence feeds. Instead of searching one IOC at a time, you'll connect external feed sources and let MISP correlate incoming IOCs against your event database automatically — the way production SOC teams handle thousands of indicators per day.