Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 40 additions & 39 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -1,78 +1,79 @@
# Contributing to MISP Book

Most of MISP's documentation pages are stored as plain text files in this dedicated misp-book repository.
MISP Book is generic documentation for MISP including usage, API documentation, best practices, and specific configuration settings.
The installation guides are held in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively.
By cloning and regularly pulling from this repo, users can maintain their own up-to-date offline copy of MISP documentation rather than relying solely on the web.
Most MISP documentation pages are stored as plain-text files in this dedicated misp-book repository.
MISP Book provides general documentation for MISP, including usage, API documentation, best practices, and configuration guidance.
Installation guides are maintained in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively.
By cloning this repository and pulling regularly, users can maintain an up-to-date offline copy of the documentation instead of relying solely on the web.

MISP book is generated in HTML, PDF, epub, and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format.
The documentation is regularly published on [misp-project.org](https://www.misp-project.org/) and [circl.lu website](https://www.circl.lu/doc/misp/).
MISP Book is generated in HTML, PDF, EPUB, and MOBI formats using [Honkit](https://github.com/honkit/honkit), a framework for writing documentation in Markdown.
The documentation is regularly published on [misp-project.org](https://www.misp-project.org/) and the [CIRCL website](https://www.circl.lu/doc/misp/).

## Documentation guidelines

The documentation is a community effort. Volunteers work hard trying to keep everything accurate and comprehensive.
If you notice a problem or some way it can be improved, please edit the documentation.
The documentation is a community effort.
Volunteers work hard to keep it accurate and comprehensive.
If you notice a problem or see a way to improve it, please edit the documentation.

All pull requests against MISP must pass review before being merged.
This process is designed to ensure that contributed text is accurate and non-malicious.
Once a pull request passes review, the documentation maintainer then verifies that the pull request is mechanically sound (no merge conflicts or broken links).
If so, the documentation maintainer then merges the pull request.
This process helps ensure that contributed text is accurate and non-malicious.
Once a pull request passes review, the documentation maintainer verifies that it is mechanically sound, such as having no merge conflicts or broken links.
If everything looks good, the maintainer merges the pull request.

If you have a question about something you read in the documentation, you may ask into the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it.
If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-make-a-contributution) yourself.
If you have a question about something you read in the documentation, you can ask in the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue.
If you see documentation that should be fixed or improved, please [contribute the change](#how-to-make-a-contribution) yourself.

## How to make a contribution

Editing the documentation is easy, so if you see that a change should be made, please contribute it!
Editing the documentation is easy, so if you see something that should be changed, please contribute it.

A few notes before we get started:

- Every documentation change will be reviewed before it’s accepted. This allows us to maintain quality control and protect our users.
- If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) for it first so that we can make sure we’re on the same page before significant work begins. This ensures you do not spend time and effort on a contribution that we can’t accept.
- Every documentation change will be reviewed before it is accepted. This helps us maintain quality and protect our users.
- If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) first so we can make sure we are aligned before significant work begins. This helps avoid spending time on a contribution that cannot be accepted.

Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all.
All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)).
You can also [open issues](https://github.com/MISP/misp-book/issues) if you find any errors or propose changes.
Thanks to GitHub’s interface, you can edit MISP documentation even if you do not know Git.
All you need to do is [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repository](https://github.com/MISP/misp-book/), make your changes, and then [submit a pull request](https://help.github.com/articles/using-pull-requests/).
You can also [open issues](https://github.com/MISP/misp-book/issues) if you find errors or want to propose improvements.

[GitHub workflows](https://docs.github.com/en/actions/using-workflows) (used for automatic integration) is included in misp-book and the book generation is tested at each commit.
When you make a pull request, verify if your changes affect the result of the tests.
If the checks fail, review the output at Travis and make fixes where possible.
[GitHub workflows](https://docs.github.com/en/actions/using-workflows) are used for continuous integration in misp-book, and book generation is tested on each commit.
When you open a pull request, verify whether your changes affect the test results.
If the checks fail, review the workflow output and fix any issues where possible.

### For native English speakers

Most MISP developers are not native English speakers so you're more than welcome to correct or improve our English.
For this, you can either submit a pull request or use another way that suits you better to share your improvements with us.

Most MISP developers are not native English speakers, so corrections and improvements to our English are especially welcome.
You can submit a pull request or share your improvements in any other way that suits you.

## Organizational guidelines

- Do not duplicate documentation. Duplicating documentation is almost always a bad idea. There are many reasons for this. The main one is that almost all documentation has to be updated at some point. When similar documentation appears in more than one place, it is very easy for it to get updated in one place but not the others (perhaps because the person updating it doesn’t realize it’s in more than one place). Such traps are often more harmful than if the documentation never existed in the first place. The solution is to link to existing documentation rather than duplicating it. There are some exceptions to this policy (e.g., information that is certain not to change for a very long time), but they are rare.
- We maintain only one set of documentation for MISP. We do not maintain a different set of documentation for each version of MISP. Our single set of MISP documentation is updated on a continual, rolling basis. Our first priority is to document all current, stable releases of MISP. Our second priority is to document the next, upcoming release (if any) that is currently in the beta or release candidate stage.
- Instructions on how to install MISP are held in [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively.
- Do not duplicate documentation. Duplicating documentation is almost always a bad idea because it is easy for one copy to be updated while another is forgotten. In most cases, it is better to link to existing documentation than to repeat it. There are rare exceptions, such as information that is certain not to change for a very long time.
- We maintain only one set of documentation for MISP. We do not maintain a separate set for each version. Our single documentation set is updated on a continual basis. Our first priority is to document all current stable releases of MISP. Our second priority is to document the next upcoming release, if any, that is currently in beta or release candidate status.
- Instructions on how to install MISP are maintained in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively.

## Style guidelines

- Familiarize yourself with the terms defined in the [glossary](https://www.circl.lu/doc/misp/GLOSSARY.html). Use these terms consistently and accurately throughout your writing.
- The language in this book is American English. All the screenshots and examples are in English.
- The language in this book is American English. All screenshots and examples are in English.

## Markdown conventions

All the documentation is written in Markdown for maximum accessibility. When making contributions, please try to observe the following style conventions:
All documentation is written in Markdown for maximum accessibility.
When making contributions, please try to observe the following style conventions:

- Use spaces instead of tabs.
- To enable offline browsing, always use relative (rather than absolute) links, e.g., misp/automation/ instead of https://www.circl.lu/doc/misp/automation/. Examples of exceptions:
- URLs that appear inside code blocks (e.g., in comments and code snippets)
- Files like README.md and CONTRIBUTING.md
- Insert a newline at, and only at, the end of each sentence. This practice results in one sentence per line, which is most appropriate for sources that consist primarily of natural language text. It results in the most useful diffs and facilitates translation into other languages while mostly preserving source readability.
- If appropriate, make numerals in numbered lists match between Markdown source and HTML output. If a user is required to read the Markdown source directly, this will make it easier to follow, e.g., numbered steps in a set of instructions.
- Use Atx-style headings: `# h1`, `## h2`, `### h3`, etc.
- When writing code blocks, use syntax highlighting where possible and use [...] for anything omitted.
([This](https://daringfireball.net/projects/markdown/) is a great source for learning about Markdown.)
- To enable offline browsing, always use relative links rather than absolute links, such as misp/automation/ instead of https://www.circl.lu/doc/misp/automation/. Exceptions include URLs inside code blocks and files such as README.md and CONTRIBUTING.md.
- Insert a newline at, and only at, the end of each sentence. This results in one sentence per line, which produces more useful diffs and facilitates translation while preserving readability.
- If appropriate, make numerals in numbered lists match between Markdown source and HTML output. If a user needs to read the Markdown source directly, this makes the steps easier to follow.
- Use Atx-style headings: `# h1`, `## h2`, `### h3`, and so on.
- When writing code blocks, use syntax highlighting where possible and use [...] for omitted content.

([This](https://daringfireball.net/projects/markdown/) is a great resource for learning Markdown.)

## Git conventions

Please try to write good commit messages, according to the [instructions in our wiki](https://github.com/MISP/MISP/wiki/CommitMessageBestPractices).

## Translate MISP Book

You can help us make MISP Book available in your language. See [MISP and Internationalization (i18n)](https://www.circl.lu/doc/misp/translation/).
You can help make MISP Book available in your language.
See [MISP and Internationalization (i18n)](https://www.circl.lu/doc/misp/translation/).
8 changes: 4 additions & 4 deletions GLOSSARY.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
## MISP Glossary
This glossary is meant as a quick lookup document in case of any need of clarification of any threat sharing, threat-intel lingo.
Be careful when adding terms to the glossary. Adding a generic term like: *MISP* will prevent terms like *MISP noticelist* to be addded. As a matter of definition please use the singular for any terms.
In case you use any CCBYSA licensed content, or other pieces that are subject to licensing, make sure to add it as a by-line at the end of the mention.
This glossary is intended as a quick reference for clarifying threat-sharing and threat-intelligence terminology.
Be careful when adding terms to the glossary. Adding a generic term such as *MISP* will prevent more specific terms such as *MISP noticelist* from being added. As a general rule, please use the singular form for each term.
If you use any CC BY-SA licensed content, or any other material that is subject to licensing, make sure to add the appropriate attribution at the end of the entry.

## API
MISP makes extensive use of its RESTful API (Application programming interface) both internally and provides an external API for automation, synchronisation or any other tasks requiring a machine to machine interface.
Expand All @@ -17,7 +17,7 @@ Sharing groups in MISP are a more granular way to create re-usable distribution

## Site admin
As an admin (not to be confused with Org Admin), you can set up new accounts for users, edit user profiles, delete them, or just have a look at all the viewers' profiles.
Site admins have access to every administrator feature for all the data located on the system including global features such as the creation and modification of user roles and instance links. You will also see all other organisations connected or setup in the instance. The site admin can be considered as a super-user of a MISP instance.
Site admins have access to every administrator feature for all the data located on the system including global features such as the creation and modification of user roles and instance links. You will also see all other organizations connected to or set up in the instance. The site admin can be considered as a super-user of a MISP instance.

## Indicators
Indicators contain a pattern that can be used to detect suspicious or malicious cyber activity.
Expand Down
13 changes: 8 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,13 @@ description: Introduction to MISP - Open Source Threat Intelligence Sharing Plat

![MISP logo](https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/logos/misp-logo.png)

User guide for MISP - The Open Source Threat Intelligence Sharing Platform. This user guide is intended for ICT professionals such as security analysts, security incident handlers, or malware reverse engineers who share threat intelligence using MISP or integrate MISP into other security monitoring tools. The user guide includes day-to-day usage of the MISP's graphical user interface along with its automated interfaces \(API\), in order to integrate MISP within a security environment and operate one or more MISP instances.
This guide introduces MISP, the open source threat intelligence sharing platform.
It is intended for ICT professionals such as security analysts, incident responders, and malware reverse engineers who share threat intelligence with MISP or integrate MISP into other security monitoring tools.
The guide covers day-to-day use of the MISP graphical user interface together with its automated interfaces (API) so that teams can integrate MISP into their security environment and operate one or more MISP instances.

## Acknowledgement

The MISP user guide is a collaborative effort between all the contributors to [MISP](https://www.github.com/MISP) including:
The MISP user guide is a collaborative effort involving contributors to [MISP](https://www.github.com/MISP), including:

* Belgian Ministry of Defence \(CERT\)
* [CIRCL Computer Incident Response Center Luxembourg](https://www.circl.lu/)
Expand All @@ -21,17 +23,18 @@ The MISP user guide is a collaborative effort between all the contributors to [M
* Cthulhu Solutions
* [CERT-EU](https://cert.europa.eu)

and many other contributors especially the ones during the [MISP hackathons](https://github.com/MISP/MISP/wiki/Hackathon "MISP Hackathon Wiki").
and many other contributors, especially those who participated in the [MISP hackathons](https://github.com/MISP/MISP/wiki/Hackathon "MISP Hackathon Wiki").

## Contributing

We welcome contributions to the MISP book. If you want to contribute, see our [contributing guide](/CONTRIBUTING.md)
We welcome contributions to the MISP book.
If you want to contribute, see our [contributing guide](/CONTRIBUTING.md).

<div class="pagebreak"></div>

## Format

MISP book is available in [HTML](https://www.circl.lu/doc/misp/), [PDF](https://www.circl.lu/doc/misp/book.pdf), [ePub](https://www.circl.lu/doc/misp/book.epub) and [Kindle mobi format](https://www.circl.lu/doc/misp/book.mobi).
The MISP book is available in [HTML](https://www.circl.lu/doc/misp/), [PDF](https://www.circl.lu/doc/misp/book.pdf), [ePub](https://www.circl.lu/doc/misp/book.epub), and [Kindle mobi format](https://www.circl.lu/doc/misp/book.mobi).

## License

Expand Down
25 changes: 12 additions & 13 deletions SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,36 +4,35 @@
* [Book Convention](book-convention/README.md)
* [Quick Start](quick-start/README.md)
* [Requirements](requirements/README.md)
* [Get Your Instance](get-your-instance/README.md)
* [Get Your Own MISP Instance](get-your-instance/README.md)
* [General Layout](general-layout/README.md)
* [General Concepts](general-concepts/README.md)
* [User Management and Global Actions](user-management/README.md)
* [Using the System](using-the-system/README.md)
* [Delegation of Event](delegation/README.md)
* [Extending Events](extended-events/README.md)
* [Delegation](delegation/README.md)
* [MISP Extended Events](extended-events/README.md)
* [Administration](administration/README.md)
* [Managing Feeds](managing-feeds/README.md)
* [Updating Python dependencies](updating-python/README.md)
* [Updating Python Dependencies](updating-python/README.md)
* [Automation and MISP API](automation/README.md)
* [PyMISP - Python Library to Access MISP](pymisp/README.md)
* [Create an Event Based on a Report](create-event-report/README.md)
* [Taxonomies](taxonomy/README.md)
* [Galaxies](galaxy/README.md)
* [MISP Objects](misp-objects/README.md)
* [Sightings](sightings/README.md)
* [Warning lists](warninglists/README.md)
* [Notice lists](noticelists/README.md)
* [Warning Lists](warninglists/README.md)
* [Notice Lists](noticelists/README.md)
* [Categories and Types](categories-and-types/README.md)
* [Synchronisation/Sharing](sharing/README.md)
* [Synchronization and Sharing](sharing/README.md)
* [External Connectors](connectors/README.md)
* [Modules](modules/README.md)
* [ZeroMQ - MISP publish-subscribe](misp-zmq/README.md)
* [Keyboard shortcuts](keyboard-shortcuts/README.md)
* [ZeroMQ - MISP Publish/Subscribe](misp-zmq/README.md)
* [Keyboard Shortcuts](keyboard-shortcuts/README.md)
* [Translations - i18n & l10n](translation/README.md)
* [FAQ](faq/README.md)
* [Dev FAQ](dev-faq/README.md)
* [Developer FAQ](dev-faq/README.md)
* [Best Practices](best-practices/README.md)
* [User stories](user-stories/README.md)
* [User personas](user-personas/README.md)
* [User Stories](user-stories/README.md)
* [User Personas](user-personas/README.md)
* [Appendices](appendices/README.md)

Loading
Loading