Monitoring MISP with Vigilmon

MISP is the operational backbone of threat intelligence sharing for CERTs, ISACs, and enterprise security teams. When background workers stall, feed synchronization breaks, or MySQL slows down, your threat intelligence quietly goes stale — analysts keep making decisions based on outdated IoC data without knowing it. Vigilmon gives you uptime monitoring for the MISP web application, worker health watchdogs, feed sync alerts, MySQL performance checks, and disk usage monitoring across your full MISP deployment.

What You'll Set Up

• HTTP uptime monitor for the MISP web application and REST API
• Background worker health watchdog via cron heartbeat
• Feed synchronization freshness alert
• MySQL database health and performance monitor
• Redis queue depth watchdog
• MISP-to-MISP sync health check
• Disk storage usage alert for attachment files

Prerequisites

• MISP installed and running (accessible on port 443 or 80)
• MISP API key with read access (/users/view/me.json must return 200)
• Access to the MISP host for cron job installation
• A free Vigilmon account

Step 1: Monitor the MISP Web Application

MISP's /servers/getVersion endpoint returns the current version and confirms the CakePHP application is running. When this fails, both the web UI and the REST API are unavailable.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter https://your-misp-host/servers/getVersion.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Under Response body, set Contains to "version".
7. Enable Monitor SSL certificate and set Alert when certificate expires in less than 30 days.
8. Click Save.

This single monitor covers web UI availability, REST API availability, and TLS certificate health simultaneously.

Step 2: Watchdog MISP Background Workers

MISP uses Python-based background workers (via CakeResque) to process feed imports, event exports, email notifications, and scheduler tasks. Workers can stop silently after a fatal exception, leaving your MISP instance unable to import new threat intelligence.

#!/bin/bash
# /usr/local/bin/misp-worker-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-worker-heartbeat-id"
MISP_URL="http://localhost"
MISP_API_KEY="your-misp-api-key"

# Check worker status via MISP API
WORKERS=$(curl -s \
  -H "Authorization: $MISP_API_KEY" \
  -H "Accept: application/json" \
  "$MISP_URL/servers/workersDiagnostics" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
# All worker types should have at least one process
workers = data.get('workers', {})
ok = all(
    any(w.get('alive') for w in group) if isinstance(group, list) else group.get('alive')
    for group in workers.values()
    if group
)
print('ok' if ok else 'error')
" 2>/dev/null || echo "error")

if [ "$WORKERS" = "ok" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval. Worker restarts are instantaneous, so a single missed ping means the workers are genuinely stopped.

Alternatively, check the worker process count directly:

WORKER_COUNT=$(ps aux | grep -c "[m]isp.*worker" || echo "0")
if [ "$WORKER_COUNT" -ge 4 ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Adjust the 4 to match your expected worker count (default, email, cache, prio, update are the standard queues).

Step 3: Monitor Feed Synchronization Health

MISP pulls threat intelligence from threat feeds (CIRCL OSINT, abuse.ch, AlienVault OTX, and custom feeds). When feed sync breaks, your IoC database quietly falls behind. Add a freshness watchdog:

#!/bin/bash
# /usr/local/bin/misp-feed-sync-check.sh
MISP_URL="http://localhost"
MISP_API_KEY="your-misp-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-feed-sync-heartbeat-id"

# Check last feed fetch time for all enabled feeds
STALE_FEEDS=$(curl -s \
  -H "Authorization: $MISP_API_KEY" \
  -H "Accept: application/json" \
  "$MISP_URL/feeds/index" | \
  python3 -c "
import sys, json, time
feeds = json.load(sys.stdin)
now = time.time()
stale = []
for feed in feeds:
    if not feed.get('Feed', {}).get('enabled'):
        continue
    last_fetched = feed.get('Feed', {}).get('last_fetched')
    if last_fetched:
        age_hours = (now - int(last_fetched)) / 3600
        if age_hours > 25:  # more than 25 hours stale
            stale.append(feed['Feed']['name'])
print(len(stale))
" 2>/dev/null || echo "99")

if [ "$STALE_FEEDS" = "0" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 2 hours with a 3-hour heartbeat interval. This gives you an alert within 3 hours of any feed going stale.

Step 4: Monitor MySQL Database Health

MISP stores all events, attributes, tags, and sharing groups in MySQL. Database connectivity loss causes the web UI to show errors and all API calls to fail. Monitor both TCP reachability and query performance:

1. In Vigilmon, click Add Monitor → TCP Port.
2. Enter your MySQL host and port 3306.
3. Set Check interval to 1 minute.
4. Click Save.

For query latency, add a cron heartbeat:

#!/bin/bash
# /usr/local/bin/misp-db-latency-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-db-latency-heartbeat-id"
MYSQL_USER="misp"
MYSQL_DB="misp"

START=$(date +%s%N)
mysql -u "$MYSQL_USER" "$MYSQL_DB" -e "SELECT 1;" > /dev/null 2>&1
EXIT_CODE=$?
END=$(date +%s%N)
LATENCY_MS=$(( (END - START) / 1000000 ))

if [ $EXIT_CODE -eq 0 ] && [ "$LATENCY_MS" -lt 1000 ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval.

Step 5: Monitor Redis Queue Health

MISP uses Redis for background job queuing. When Redis becomes saturated or unreachable, the worker queue stalls and feed imports, exports, and notifications back up silently.

1. In Vigilmon, click Add Monitor → TCP Port.
2. Enter your Redis host and port 6379.
3. Set Check interval to 1 minute.
4. Click Save.

For queue depth monitoring:

#!/bin/bash
# /usr/local/bin/misp-redis-queue-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-redis-queue-heartbeat-id"
REDIS_HOST="localhost"
REDIS_PORT="6379"

# Check queue depths for all MISP worker queues
TOTAL_QUEUED=$(redis-cli -h "$REDIS_HOST" -p "$REDIS_PORT" \
  LLEN "resque:queue:default" 2>/dev/null || echo "9999")

# Alert if more than 500 jobs queued (indicates worker backlog)
if [ "$TOTAL_QUEUED" -lt 500 ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval.

Step 6: Monitor MISP-to-MISP Synchronization

Organizations run interconnected MISP networks for bilateral threat intelligence sharing. Sync failures in either direction leave your partners without your event data — and vice versa.

#!/bin/bash
# /usr/local/bin/misp-server-sync-check.sh
MISP_URL="http://localhost"
MISP_API_KEY="your-misp-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-server-sync-heartbeat-id"

# Check all sync server connectivity
SERVERS=$(curl -s \
  -H "Authorization: $MISP_API_KEY" \
  -H "Accept: application/json" \
  "$MISP_URL/servers/index" | \
  python3 -c "
import sys, json
servers = json.load(sys.stdin)
failing = [s['Server']['name'] for s in servers
           if s.get('Server', {}).get('push_rules') or s.get('Server', {}).get('pull_rules')
           if not s.get('Server', {}).get('reachable', True)]
print(len(failing))
" 2>/dev/null || echo "99")

if [ "$SERVERS" = "0" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 30 minutes with a 45-minute heartbeat interval.

Step 7: Monitor Disk Storage for Attachment Files

MISP stores malware samples, screenshots, and file attachments on disk. When storage fills up, new file uploads fail and analysts receive confusing errors when trying to attach samples to events.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set Expected ping interval to 60 minutes.
3. Copy the heartbeat URL.

#!/bin/bash
# /usr/local/bin/misp-disk-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-disk-heartbeat-id"
MISP_ATTACHMENTS_DIR="/var/www/MISP/app/files"

# Get disk usage percentage for the MISP files partition
USAGE=$(df "$MISP_ATTACHMENTS_DIR" | awk 'NR==2 {print $5}' | tr -d '%')

# Alert if disk is over 80% full
if [ "$USAGE" -lt 80 ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule hourly with a 90-minute heartbeat interval. This gives you a >90-minute warning before disk saturation causes upload failures.

Step 8: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add your notification channel — email, Slack, or a webhook to your threat intelligence team's ticketing system.
2. For MISP web application alerts, route to the threat intelligence team's on-call channel — MISP downtime blocks all sharing with partner organizations.
3. For worker and feed sync alerts, use an async channel (email or Slack) — these are operational issues that don't require immediate human action but should be resolved within hours.

Recommended Alert Thresholds

| Monitor | Alert After | Notes | |---|---|---| | Web application (HTTPS) | 2 failures | Apache/Nginx restart causes brief gap | | Background workers | 1 failure | Workers don't have transient failures | | Feed synchronization | 1 failure | 25h staleness threshold is conservative | | MySQL TCP (port 3306) | 2 failures | Transient connection drops possible | | Redis TCP (port 6379) | 2 failures | Redis restart is fast | | MISP-to-MISP sync | 1 failure | Partner org impact is immediate | | Disk usage (80%) | 1 failure | You have ~20% headroom to act | | TLS certificate | — | 30 days remaining |

Conclusion

With these monitors in place, Vigilmon gives you complete observability across your MISP deployment: web application availability, background worker health, feed synchronization freshness, database performance, Redis queue depth, bilateral sync with partner MISP instances, and disk capacity. Your threat intelligence team can share IoCs confidently knowing the platform health is tracked.

For more self-hosted security monitoring guides, visit vigilmon.online.