MISP (Malware Information Sharing Platform)

What Does MISP Do?

MISP gives a security team one place to keep what it knows about threats in a structured form. An analyst records an incident or a report as an event, adds the indicators of compromise and tags them with context. MISP then matches each new value against everything it already holds and shows the links.

The project sums up the job in one line: store indicators in a structured way, then put them to work. That means correlation, automated exports to an IDS or SIEM, and synchronization with other MISP servers. Sharing is the other half. MISP was built to move intelligence between organizations, with control over who receives each event or value.

The project says MISP is built by and for incident analysts, security and IT professionals, and malware reversers. CIRCL adds that the data model now also covers vulnerability, fraud, disinformation and physical security intelligence. In other words, MISP is a threat intelligence platform with sharing at its core.

MISP is free software under the GNU Affero General Public License version 3 (AGPL-3.0). Its copyright is held jointly by all contributors, which the project says stops any one company from turning it into a closed product. The stable line is MISP 2.5, and release 2.5.50 came out on 9 October 2026. MISP v3.0 entered early access on 16 October 2026, and the project asks users to keep it off production systems for now.

Where Did MISP Come From?

MISP began in May 2011 as a side project. Christophe Vandeplas was tired of seeing indicators passed around in emails and PDF files that machines could not read. At home he built a proof of concept in CakePHP, a PHP framework, and called it CyDefSIG, short for Cyber Defence Signatures.

The Belgian Defence started to use CyDefSIG officially in mid-August 2011. NATO saw a presentation in January 2012, sent a part-time developer and later hired a full-time one.

The code was released under the Affero GPL, and the tool was renamed MISP. In January 2013 Andras Iklody became its main full-time developer. He is still the lead developer and now works for CIRCL.

Teams such as CERT-EU and CIRCL adopted it and promoted it across the CERT world. As the tool grew beyond malware into fraud and vulnerability data, the long name fell away. Today the core software, the PyMISP library and the shared formats, taxonomies and warning lists are run as one community project by volunteers.

How Does MISP Structure Threat Data?

Everything in MISP lives inside an event. The MISP core format is the JSON format MISP servers use to exchange data. It says an event can hold an incident, a security analysis report or a threat actor analysis. These are the parts an analyst works with every day.

Here is one attribute in MISP’s JSON format. The values are reserved for documentation and point to no real system.

{
  "type": "domain",
  "category": "Network activity",
  "value": "secure-login.example.net",
  "to_ids": true,
  "comment": "Training example: login page imitating a bank.",
  "Tag": [{"name": "tlp:amber"}]
}

Two things in this small block do most of the work. The type and category tell MISP and every export what the value is. The to_ids flag decides whether the value may reach a firewall, IDS or SIEM, so it deserves a deliberate choice on every attribute.

Correlation runs across all of this. MISP links matching values between events, and it can also match fuzzy hashes and overlapping IP ranges. The MISP user guide is careful about what a match means. Two events share a value, but that is not proof that the value is malicious or that one actor is behind both.

How Does MISP Control Who Sees the Data?

Every event, object and attribute has a distribution setting. It decides who can see the data on your server and how far it may travel when servers synchronize. These are the five audiences the MISP user guide describes.

An attribute can inherit the event’s audience or narrow it, but it cannot widen it past the event. The user guide also warns that unpublished does not mean private. If an event’s distribution reaches your community, other organizations may see it before you press Publish.

Handling rules sit on top of distribution as tags. MISP ships the Traffic Light Protocol as a taxonomy, so an event can carry tlp:red, tlp:amber+strict, tlp:amber, tlp:green or tlp:clear. A TLP tag tells people how far they may pass the data on. The user guide is clear that a tag is not an access control, so the distribution setting still has to match it.

Many organizations use MISP through a community rather than alone. CIRCL runs several, and its private sector community has more than 1,100 international member organizations, according to the MISP communities page. Access to CIRCL’s communities is free, but every applicant is vetted first.

How Do Feeds Bring Data Into MISP?

A feed lets MISP read a published source without a two-way connection to another server. It can be a public list or a paid source that needs a key. MISP accepts three feed formats.

• MISP format: a folder with a manifest.json file and one JSON file per event, named by its UUID. Events arrive whole, with tags and context.
• CSV: a table of indicators. You choose the delimiter and the columns that hold values.
• Free text: MISP finds candidate indicators in plain text. You preview the result and remove noise before import.

MISP ships a list of default feeds that an administrator can load with one action. On 10 November 2026, the project’s default feed page listed 108 feeds from 52 providers: 47 in CSV, 43 in free text and 18 in MISP format. The user guide says plainly that this list is not a recommendation to ingest everything.

Each feed can be cached, imported or both. Caching keeps the values in a lookup store, so analysts see a “feed hit” when an event contains a value from that source. Importing creates real events and attributes.

A feed hit only says the source contains the value; it is not a verdict that the value is malicious. For background on choosing sources, see our entry on threat feeds.

How Do Teams Use MISP With Commercial Threat Intelligence?

Open feeds cover a lot, but paid intelligence can add what public lists lack, such as findings from criminal forums, phishing sites aimed at one brand, or leaked credentials. MISP becomes the place where that data meets your own incidents and your partners’ events. The table shows the routes MISP documents for bringing such data in.

One route is easy to misread. MISP has a built-in TAXII 2.1 client, but the user guide describes it as a way to browse remote collections and push events out. To bring a provider’s STIX and TAXII collection in, plan a script that fetches the objects and hands them to the STIX import.

Before the first import, agree on a data contract with the provider. The MISP user guide’s chapter on connectors lists what to settle:

• which records you receive, with which handling tags and detection flags;
• how each record keeps a stable identity, by UUID rather than a local number;
• how corrections, expiry and withdrawals reach you, because a one-time import cannot keep that state;
• how batches, retries and checkpoints work when a run fails halfway;
• whether your sightings and false positive reports should flow back to the provider.

The guide also suggests a separate staging server for high-volume imports and parser tests. Analysts review there, and only checked events move to the server that feeds detection. On a single server, the same rule applies: import with a restricted audience and publish on purpose.

What Happens to a Provider’s STIX Record in MISP?

We tested this on 10 November 2026 with Brandefense’s own data. Our public exploited vulnerabilities dataset on GitHub holds 93 entries under CC BY 4.0 and ships a STIX 2.1 bundle. We took its record for CVE-2024-3400 in PAN-OS GlobalProtect and ran it through misp-stix 2026.10.12. That is the converter MISP itself uses for STIX import.

We ran the library on its own, not inside a MISP server, so your server’s version may behave a little differently. To see what happens to indicators and markings, we also converted two made-up indicators with a TLP:AMBER marking. Their values are reserved for documentation. Here is the converted Brandefense record, shortened.

{
  "info": "STIX 2.1 Bundle (...) and converted with the MISP-STIX import feature.",
  "distribution": "0",
  "published": false,
  "Tag": [{"name": "misp-galaxy:producer=\"Brandefense\""}],
  "Galaxy": [{
    "type": "stix-2.1-vulnerability",
    "GalaxyCluster": [{
      "value": "CVE-2024-3400",
      "source": "Brandefense",
      "description": "CVE-2024-3400 is a flaw in the GlobalProtect feature of ...",
      "meta": {
        "external_id": "CVE-2024-3400",
        "refs": [
          "https://brandefense.io/knowledge-hub/vulnerabilities/cve-2024-3400/",
          "https://security.paloaltonetworks.com/CVE-2024-3400",
          "..."
        ]
      }
    }]
  }]
}

Four checks follow from this test, whatever the provider. First, check that handling labels survive. Our TLP marking came through on indicators but vanished on the vulnerability, so set an event-level TLP tag yourself. Second, review to_ids before anything reaches detection, because every converted indicator arrived ready to export.

Third, read the comment and the tags, not just the value. The indicator names and labels that carried part of the meaning did not survive.

Fourth, a CVE imported this way sits in a galaxy cluster, not in an attribute. If you want it to correlate with other events, add it as a vulnerability attribute too. Our earlier MISP lab loaded CVEs that way, as five vulnerability attributes in two events.

For the STIX side of this test, our validated STIX 2.1 indicator and relationship examples show how such objects look before any platform reads them.

How Does MISP Send Indicators to Detection Tools?

MISP exports in many formats: MISP JSON, STIX 1 and 2, OpenIOC, CSV, plain text, Suricata, Snort and Zeek rules, DNS RPZ zones and cache formats for forensic tools. For automated exports, the MISP user guide points to the restSearch API. It recommends a dedicated key that can only read, and HTTPS with certificate checks left on.

This request asks for detection-ready domains, URLs and IP addresses from published events marked TLP:CLEAR, as CSV. The MISP server address is a placeholder, and the key comes from an environment variable.

curl --silent --show-error --fail-with-body \
  --request POST "$MISP_URL/attributes/restSearch" \
  --header "Authorization: $MISP_KEY" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{
    "returnFormat": "csv",
    "type": ["domain", "url", "ip-dst"],
    "tags": ["tlp:clear"],
    "published": true,
    "to_ids": true,
    "enforceWarninglist": true,
    "limit": 1000,
    "page": 1
  }'

Three filters in this request carry the safety. The published and to_ids filters keep drafts and context values out of your blocklist. The enforceWarninglist filter drops values that match MISP’s warning lists, such as reserved and private addresses, public infrastructure and common domains. The guide adds a caution: a value missing from a warning list is not proof that it is safe.

For a near real-time stream instead of polling, MISP can publish new events, attributes, sightings and tag changes over ZeroMQ or Kafka. A false positive found downstream should come back as a sighting of type 1, so teams that share the event can see it too.

What Does It Take to Run MISP?

MISP runs on your own server, in the cloud or as a hosted service. The MISP user guide recommends the official installer for production on supported Ubuntu, Debian and RHEL-based systems. The project also maintains misp-docker, which is what our lab used.

We ran MISP 2.5.50 in Docker for our OpenCTI vs MISP lab on 25 October 2026. The stack used six containers: MariaDB, Valkey, the MISP core, the modules, nginx and mail. The images took 4.83 GB, and the stack used 1.65 GiB of memory at idle. The first start took a couple of minutes while MISP loaded its warning lists, taxonomies and galaxies.

Two operating points are easy to miss. MISP is a PHP application, so a fix for PHP itself comes from you, your distribution or your image maintainer, not from a MISP release. Our post on PHP applications in your security stack covers who ships which patch. API keys inherit the rights of their user, so give each integration its own account, an expiry date and, where possible, an IP restriction.

If running a server is too much, CIRCL lets eligible members use its hosted instances through the web interface and API. Organizations, CERTs, trusted researchers and security vendors can apply. CIRCL then maintains the platform and the community connection.

Where Does MISP Fall Short?

MISP is a platform, not a source. It holds what you and your partners put in, so its value depends on feed choice, review and upkeep. A server that ingests every default feed with auto-publish on can turn into a noisy blocklist that analysts stop trusting.

Its model is organized around events. Teams that work mainly with linked knowledge, such as actors, tools and reports and the relations between them, may run a second tool next to it. Our OpenCTI vs MISP lab ran both side by side and queried them with one AI agent. In that lab, the agent’s first guessed filter came back empty, and an empty answer did not mean the data was missing.

Finally, MISP does not judge your exposure. It can tell you that a domain appears in several partner events. It cannot tell you that a new lookalike of your brand went live this morning unless a source reports it. That gap is where outside monitoring and your own telemetry come in.

How Do You Start With MISP Safely?

1. Decide what MISP is for in your team: detection exports, incident records, sharing with a community, or all three.
2. Set up a test server first, on MISP 2.5. Keep the v3.0 early access build off production until the final release.
3. Load the default feed list, then enable a few feeds that match your sector and cache them before you import anything.
4. For each paid source, write down its license, its TLP rules and how withdrawals reach you, then pick a route from the table above.
5. Import with Override IDS on and auto-publish off, and keep the audience at Your organisation only until an analyst has checked the data.
6. Turn on warning lists, and export to detection tools only with published, to_ids and enforceWarninglist set.
7. Send sightings and false positives back, so the data gets better over time.
8. Ask CIRCL or your sector community about membership, if sharing is one of your goals.

For the wider choice of platform, see Threat Intelligence Platforms 101. Brandefense delivers its cyber threat intelligence through a RESTful API with STIX 2.0 and TAXII 2.1. TIPs connect through the API and the Brandefense MCP server, and the full list is on the integrations page.