My current setup of Cuckoo is that Cuckoo is scanning attachments of emails in an automated way using PeekabooAV. Based on the score of the analysis that Cuckoo gave and the raised signatures the attachment is seen as bad or not/unknown.

My question is, would there a benefit using the MISP integration in Cuckoo for analysis?

Would MISP enhance the accuracy of cuckoo when looking at the score and raised signatures? Like, is there a chance that Cuckoo is reporting a bad file falsely as clean but with MISP it would report it correctly as bad?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.