MISP

What it is

MISP is a free open-source threat intelligence and sharing platform (misp-project.org, GitHub MISP/MISP). Security teams use it to collect, store, correlate and share structured cyber threat indicators, malware details and incident information across organisations and communities under open standards.

What it helps with

- Capturing and structuring indicators of compromise and related threat objects for day-to-day analysis.
- Sharing and synchronising threat data with trusted partners, ISACs and other MISP instances.
- Correlating events and attributes to spot overlaps across incidents and feeds.
- Using taxonomies, galaxies and open MISP formats for interoperable threat exchange.
- Supporting incident responders, SOC analysts and malware analysts in collaborative defence.
- Running self-hosted under AGPL without a commercial licence for the core software.

Who it's for

Threat intelligence teams, CERT/CSIRT and SOC analysts who need an open sharing platform as a peer to commercial TI products such as Recorded Future, with optional professional or hosted services if desired.

Worth knowing

MISP core software is free and open source (AGPL). Optional paid professional services and hosted MISP offerings are available from the project ecosystem and are separate from the free software. Official site: misp-project.org. Distinct from closed commercial threat intel suites.