Sharing Threat Intelligence Between Networks: MISP and Data Diodes

Cyber threat intelligence plays a crucial role in enabling organizations to proactively build defenses in modern digital environments. As new attack techniques and malware continuously emerge, it is essential to rapidly identify and share indicators of compromise (IOCs). This prevents repeated analysis and helps organizations take preventive action against similar threats. This approach saves time, reduces resource consumption, and strengthens collective cybersecurity.

One of the most prominent tools in this field is MISP (Malware Information Sharing Platform), an open-source solution that facilitates the structured collection, analysis, and sharing of IOCs. Through MISP, cybersecurity communities can establish a standardized and reliable threat intelligence sharing infrastructure.

What is MISP for Threat Intelligence?

MISP is an open-source platform that collects, correlates, and enables the sharing of malware and attack information. Initially developed with contributions from organizations like CIRCL and NATO NCIRC, MISP is widely used by security analysts, SOC teams, and CERTs. Its primary objective is to simplify threat intelligence sharing among trusted entities, reduce redundant analysis, and enable broader defensive capabilities.

Key benefits of MISP

• IOC Management: Centralized storage and correlation of indicators such as IP addresses, domains, and file hashes.

• Sharing Communities: Synchronization between MISP servers enables institutional data exchange.

• Flexible Export: Supports exporting data in JSON, CSV, STIX, and XML formats.

• REST API & Automation: MISP supports interaction via web interface and REST API, enabling automated integration using scripts and custom tools.

Thanks to MISP, organizations can collect, analyze, and operationalize threat intelligence in a standardized and effective manner.

What is a Data Diode?

Certain organizations operate isolated networks (air-gapped environments) to meet high-security requirements. In such cases, importing data from external sources introduces risk. Data diodes offer a hardware-based solution by enforcing unidirectional data flow between open and closed networks. These devices physically prevent any return traffic from the closed side to the open side.

Secure Unidirectional Transfer with DataDiodeX

DataDiodeX, developed by DataFlowX, is a data diode device that operates based on this principle. The TX (transmit) module is positioned on the open network, while the RX (receive) module is placed on the closed network. The device transmits data through a one-way optical link.

Additional features include:

• Recognition of over 300 file formats

• Content Disarm & Reconstruction (CDR)

• Schema validation

• Identity verification and access control

DataDiodeX not only ensures physical isolation but also inspects the content of the transmitted data for policy compliance.

Scenario 1: Transferring IOC Data from MISP in an Open Network to a Closed Network

In this scenario, a MISP server on the open network collects threat intelligence from external sources. On the closed network side, a secure analytics environment or another internal MISP server is present. The goal is to securely transfer the data from the open to the closed network.

The process includes:

• Data Preparation: IOC data from MISP is exported in JSON or CSV format.

• Upload: The exported file is uploaded to the TX interface of DataDiodeX.

• One-Way Transfer: The file is transmitted from TX to RX through the unidirectional connection.

• Reception: The RX module receives the file and forwards it to the internal system.

• Utilization: IOC data is used by internal SIEMs, firewalls, or antivirus platforms.

This architecture protects the closed network from external threats while allowing it to benefit from real-time threat intelligence. The unidirectional nature of the data diode ensures no data can flow from the closed to the open side.

Data flow diagram:

[Open Network MISP] → [DataDiodeX - TX] => [DataDiodeX - RX] → [Closed Network Analytics System]

Scenario 2: Transferring MISP Data via HTTP Pull and Web API

In this alternative approach, threat data from the MISP server is directly pulled via REST API and securely transmitted to the closed network through the data diode. This is a modern and automated method, eliminating the need for manual file transfers.

Flow overview:

• On the TX side, DataDiodeX is configured to send periodic HTTP GET requests to MISP’s REST API endpoint (e.g., https://<misp_ip>/events/restSearch/json).

• The response (JSON) is sent one-way to the RX side.

• On the RX side, the data is made available through a Web API service with access key control.

• Internal systems on the closed network can fetch the latest MISP data using a command like:

curl http://<rx_ip>:<port>/v1/webService/misp/<access-key>

The received data can be fed into SIEMs, IDSs, antivirus solutions, or custom analysis tools.

Why This Method?

• Eliminates the need for manual file transfers

• Fully automated and real-time

• Easily integrates with internal systems using JSON

• Maintains physical one-way data transfer

• Access control is enforced on the RX side using API keys

This method is especially suitable for high-frequency or real-time data transfers. It offers a fast, secure, and maintenance-friendly alternative to traditional approaches.

Combining MISP & Data Diodes for Robust Network Segmentation

MISP enables effective collection and the sharing of threat intelligence, while DataDiodeX ensures the secure delivery of such data into air-gapped environments. When used together, these technologies enable the safe transfer of threat intelligence without compromising network segmentation. This architecture is particularly well-suited for government agencies, military networks, and critical infrastructure systems.

---

References

• Wagner, C., Dulaunoy, A., Wagener, G., & Iklody, A. (2016). MISP: The Design and Implementation of a Collaborative Threat Intelligence Sharing Platform. https://doi.org/10.1145/2994539.2994542

• European Union Agency for Cybersecurity (ENISA). (2021). Threat Intelligence Sharing. https://www.enisa.europa.eu

• CIRCL.lu. (2024). MISP Project Documentation. https://www.misp-project.org

• MITRE. (2023). Introduction to Indicators of Compromise (IOCs). https://attack.mitre.org