My current setup of Cuckoo is that Cuckoo is scanning attachments of emails in an automated way using PeekabooAV. Based on the score of the analysis that Cuckoo gave and the raised signatures the attachment is seen as bad or not/unknown.

My question is, would there a benefit using the MISP integration in Cuckoo for analysis?

Would MISP enhance the accuracy of cuckoo when looking at the score and raised signatures? Like, is there a chance that Cuckoo is reporting a bad file falsely as clean but with MISP it would report it correctly as bad?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.