Categories
Self-Hosted Cybersecurity Threat Intelligence Incident Response Security Operations Information Sharing Malware Analysis SIEM IntegrationStars
Forks
Watchers
Developer links
MISP
MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.
Benefits
- Spot Connections Across Past Incidents
- The correlation engine links events that share values, including fuzzy hashes and CIDR ranges, so an indicator in a new case immediately points to earlier incidents and partner sightings.
- Share Intelligence Without Oversharing
- Sharing groups and per-event distribution levels, down to individual attributes, let an organization exchange indicators with trusted peers while sensitive context stays inside its own instance.
- Feed Detection Tools Automatically
- Export indicators as Suricata, Snort, or Zeek rules, STIX bundles, OpenIOC, CSV, or RPZ zones, and let SIEMs and network sensors pull fresh data through the REST API.
- Cut False Positives Early
- Warning lists check new attributes against known benign values such as public DNS resolvers and top-ranked domains, so analysts publish cleaner indicators and downstream tools raise fewer false alarms.
Features
- Events, Attributes, And Objects
- Events hold attributes and templated objects for files, network activity, and email, plus Markdown reports, analyst comments, and sightings that record who observed an indicator.
- Taxonomies And Galaxies
- Machine-readable taxonomies such as TLP and galaxies for threat actors, malware, ransomware, and MITRE ATT&CK classify events consistently, and both can be shared between instances.
- Event And Correlation Graphs
- An interactive event graph and a correlation graph with a timeline map relationships between attributes, objects, and related events without leaving the browser.
- Sync And Sharing Groups
- Instances synchronize events and attributes with partners automatically, and sharing groups, distribution levels, and delegated publishing control which organization sees each item.
- REST API And PyMISP
- An OpenAPI-described REST API with restSearch, the PyMISP Python library, and Python expansion modules let scripts and services read, add, and enrich events programmatically.
- Dashboards And Workflows
- Drag-and-drop dashboards track activity with configurable widgets, and the workflow editor builds pipelines for data qualification, automated analysis, modification, and publication control.
