tracking: new element scope - MISP standalone (admin/misp)

[hyde-repo]

tracking: new admin element scope - MISP standalone (admin/misp)

Umbrella: #178
Wave: WAVE_04 (since 2026-06-05)
Cross-repo: range42/range42-playbooks#69, range42/range42#198, range42/range42-ansible_roles-debug-devkit#114

New admin element : MISP (Malware Information Sharing Platform) standalone
Docker deployment as an operational service students use within their
training context (threat intel logging, IOC sharing, team collaboration,
export to PDF deliverables). MISP is part of the lab toolchain alongside
Gitea / Mattermost / Nextcloud / Rocket.Chat - not a MISP-administration
training subject ; pre-installed, pre-configured, ready-to-use on day 1.

Not in the catalog yet - to be added under 03_container_layer/docker/admin/misp/,
aligned with the patterns of the other admin/* services (Dockerfile +
compose.yml + Makefile + README.md + provisioning/ + .env.example +
catalog_try.yml).

Planning checklist : items to scope and integrate.

Scope to cover

• HTTPS support : self-signed cert auto-generated at first boot (MISP requires HTTPS for many features : secure cookies, OAuth, sync)
• Slot for operator-provided signed cert (volume mount or env)
• Pre-defined organisations - one per player-team plus one for instructors (each team's MISP org = their intel space, where their events live)
• Player-team layer : each player-team maps to a MISP org (or sharing group) - events scoped per team, with explicit sharing-group rules for cross-team exchange when needed
• Pre-created users assigned to their team's org at provisioning, with appropriate role (org-admin for the team lead, user for the rest)
• API key generation per user, surfaced in the credentials schema (students need this to script against the MISP REST API from their own labs)
• Warning lists : curated subset enabled at first boot so the platform feels populated and warnings actually fire (MISP ships ~60 ; pick the relevant ones for the lab)
• Galaxy clusters + taxonomies pre-loaded (TLP, MITRE ATT&CK, kill chain, etc.) - shared vocabulary across all student events
• 1-2 pre-seeded sample events with IOCs and attributes - so the platform has content on day 1, not an empty UI
• PDF export module activated (MISP built-in "PDF Export") - students export their own event reports as PDF deliverables straight from the UI
• Cross-service integration : outgoing webhook to a chat service (Mattermost / Rocket.Chat #soc-alerts) on new event publish
• Catalog_try contract : catalog_try.yml for L2 smoke (service mode, HTTP poll on the MISP API root, generous init_timeout - MISP cold-start is heavy)
• Emit misp-credentials.json per the shared training-doc credentials schema (defined in the "training-doc pipeline" tracking issue on range42/range42-playbooks) ; service_specific includes org, roles, api_keys, plus any MISP-specific fields surfaced by the items above
• SSO via Gitea OAuth/OIDC (admin + user accounts delegate auth to the standalone Gitea instance) - MISP supports OAuth2
• Pre-configured sharing groups across player-teams (e.g. red-vs-blue intel exchange group with explicit publish rules)
• Custom warning list entries specific to the range42 lab (in addition to upstream lists - block known-lab-IPs etc.)
• Demo feeds : 1-2 read-only OSINT feeds wired (e.g. CIRCL OSINT, OTX stub) - students see external intel flow in
• MISP-modules service deployed alongside (the separate misp-modules container with the enrichment / export plugins)

Deferred (tracked here for context, not for this iteration)

(no deferred items at this iteration)

[romainkieffer]

For the purpose of getting something fuctional, I decided to go ahead with .env managed team provisioning, to be adapted with ansible roles and playbooks further down the line.