MISP is a threat intelligence sharing platform designed for incident analysts, security teams and malware researchers.
It gives organisations a structured environment for recording technical and contextual intelligence, correlating it, and exchanging selected data with trusted communities. Its flexible data model can represent simple indicators, complex objects, incidents and reports, with relationships connecting related intelligence. MISP is also designed to feed structured intelligence into detection, log analysis and security monitoring systems rather than leaving information isolated inside the platform.
This is free and open source software.
Key Features
- Automatic correlation engine with support for exact matches, fuzzy hashing and CIDR-based relationships.
- Granular distribution controls, sharing groups and synchronisation between MISP instances.
- Event, attribute, object and report models for representing technical and non-technical intelligence.
- Graphical views for exploring events, objects, attributes and their relationships.
- Configurable workflows for qualification, analysis, modification and publication of intelligence.
- Extensive REST API with OpenAPI documentation for automation and external integrations.
- Import from free text, URLs, bulk data, CSV, STIX and MISP-native formats.
- Export to MISP JSON, STIX, CSV, OpenIOC, Suricata, Snort, Zeek and RPZ formats.
- Taxonomies and MISP galaxies for classification, including threat actors, malware and MITRE ATT&CK data.
- Sightings, analyst opinions, comments and relationships for collaborative intelligence assessment.
- Expansion modules for enrichment and integration with external services.
- Customisable role-based access control, auditing and real-time publishing through ZMQ or Kafka.
Website: github.com/MISP/MISP
Support:
Developer: MISP Project
License: GNU Affero General Public License v3.0
MISP is written mainly in PHP. Learn PHP with our recommended free books and free tutorials.
Related Software
| Threat Intelligence Platforms | |
|---|---|
| IntelOwl | Automates enrichment and analysis across a broad range of threat sources |
| OpenCTI | Connects threat data in a searchable intelligence graph |
| MISP | Share and correlate actionable threat intelligence |
| Yeti | Builds richer investigations from indicators, entities and context |
| ThreatDeck | Tracks threat intelligence feeds and surfaces meaningful changes quickly |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.