MISP
Last updated
Last updated
Share.Store.Correlate.Analyse.
Targeted attacks.Financial Fraud.Counter-terrorism.
Seeing helps understanding.
MISP comes with many visualization options helping analysts find the answers they are looking for.
MISP is more than Software
It is also a massive collection of open taxonomies that can be used in any software.
AM!TT for disinformation,
ATT&CK for threat actors, TTPs,
Attack4fraud, TLP, GDPR, Veris, admiralty, estimative language, document classification, and much more!
is to share more, smarter and faster
with your friends and allies
than your adversaries would like to.
Isn’t it sad to have a lot of data and not use it because it’s too much work? Thanks to MISP you can store your IOCs in a structured manner, and thus enjoy the correlation, automated exports for IDS, or SIEM, in STIX or OpenIOC and synchronize to other MISPs. You can now leverage the value of your data without effort and in an automated manner. Check out MISP features.
The primary goal of MISP is to be used. This is why simplicity is the driving force behind the project. Storing and especially using information about threats and malware should not be difficult. MISP is there to help you get the maximum out of your data without unmanageable complexity.
Sharing is key to fast and effective detection of attacks. Quite often similar organizations are targeted by the same Threat Actor, in the same or different Campaign. MISP will make it easier for you to share with, but also to receive from trusted partners and trust-groups. Sharing also enabled collaborative analysis and prevents you from doing the work someone else already did before.
Threat Intelligence is much more than Indicators of Compromise. This is why MISP provides metadata tagging, feeds, visualization and even allows you to integrate with other tools for further analysis thanks to its open protocols and data formats.
Having access to a large amount of Threat information through MISP Threat Sharing communities gives you outstanding opportunities to aggregate this information and take the process of trying to understand how all this data fits together telling a broader story to the next level. We are transforming technical data or indicators of compromise (IOCs) into cyber threat intelligence. MISP comes with many visualization options helping analysts find the answers they are looking for.
The MISP Threat Sharing ecosystem is all about accessibility and interoperability: The software is free to use, data format and API are completely open standards and for support you can rely on community and professional services.
The MISP Threat Sharing project consists of multiple initiatives, from software to facilitate threat analysis and sharing to freely usable structured Cyber Threat Information and Taxonomies.
The MISP is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and ICT professionals or malware reversers to support their day-to-day operations to share structured information efficiently.
MISP Portal
Many MISP galaxy clusters are already available like MITRE ATT&CK, Exploit-Kit, Microsoft Activity Group actor, Preventive Measure, Ransomware, TDS, Threat actor or Tool used by adversaries.
Taxonomies provide a set of already defined classifications modeling estimative language, CSIRTs/CERTs classifications, national classifications or threat model classification.
MISP Galaxies & Taxonomies
In a continuous effort since 2016, CIRCL frequently gives practical training sessions about MISP. The purpose is to reach out to security analysts using MISP as a threat intelligence platform along with users using it as an information sharing platform.
All the training materials are open source, include slides and a virtual machine preconfigured with the latest version of MISP. Reach out if you are looking for custom training.
MISP Docu & Trainings
PyMISP is a Python library to access MISP platforms via their REST API.
PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes programmatically. Discover more
PyMISP
MISP modules are autonomous modules that can be used to extend MISP for new services such as expansion, import and export.
The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components.
For more information: Extending MISP with Python modules slides from MISP training.
MISP Modules
MISP is an open source software and it is also a large community of MISP users creating, maintaining and operating communities of users or organizations sharing information about threats or cyber security indicators worldwide.
September 15, 2023
MISP 2.4.176 released with various improvements and bugs fixed. This version also includes major improvements in the misp-stix library especially on the storing relationships and the description of relationships in the MISP standard format.
[logs] add time based filter. Quite useful when you have a large set of logs.
[audit] add last password change timestamp for users.
[UI] show which attributes/objects are new and awaiting publication still.
[console:TrainingShell] Added deleteAllSyncs function.
[feeds] add Ellio threat list.
[internal] improved parameter parsing.
Properly filter out query parameters.
Method call on null.
Fixed invalid ordering errors.
Do not require jobId for AdminShell jobGenerateCorrelation, create a new job if jobId is null. fixes #9206.
[dashboard:organisationMapWidget] Do not require the config to have start and end date.
[restSearch] exact match for values starting with %, fixes #9258.
Unable to enrich individual shadow attribute.
Unable to enrich individual attribute, fixes #9267.
[stix2 import] Fixed debugging message for errors and warnings when the debug option is set.
Unable to enrich individual shadow attribute.
Unable to enrich individual attribute, fixes #9267.
Disable submodule update section when MISP.self_update is disabled, to allow not carrying git dependencies in docker.
Various fixes to MISP objects such as email, virustotal-report and relationships.
Update of target sectors in threat-actor database. This now includes the known target sectors as meta.
Various updates to the threat-actor database.
Cisco umbrella block pages added to the MISP warning-lists.
Various improvements to the generation tools.
Fix the url of the VirusTotal collection in the VirusTotal expansion module.
Various bugs fixed where fixed in PyMISP. For more details, PyMISP changelog.
The MISP projet has its own Mastodon server misp-community.org - don’t forget to follow @misp@misp-community.org on the fediverse. Core contributors of MISP can sign-up if they wish to have an account.
The latest video of MISP Training - Advanced, Developer session, from API to MISP internals is now available on YouTube.
MISP Professional Services (MPS) is a program handled by the lead developers of MISP Project, in order to offer highly skilled services around MISP and to support the sustainability of the MISP project. This initiative is meant to address the policy requirements of companies/organisations requiring commercial support contracts. Don’t hesitate to get in touch with us if you need specific services.
