MISP vs OpenCTI
GitHub Stats
About MISP
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, and counter-terrorism data. It provides a robust data model for structuring threat data, automatic correlation of attributes and indicators, flexible sharing groups for controlled distribution, and import/export in STIX, OpenIOC, and many other formats. MISP includes a built-in feed system for consuming external threat intelligence, a REST API for automation, and taxonomies and galaxies for consistent classification. It's used by CERTs, SOCs, threat intelligence teams, and law enforcement worldwide as their primary threat intelligence management platform.
About OpenCTI
OpenCTI is an open-source platform for managing cyber threat intelligence knowledge and observables. Built on a STIX2-native data model, it provides a unified view of threat data including threat actors, intrusion sets, campaigns, malware, vulnerabilities, and their relationships. OpenCTI uses a graph database (Neo4j or Amazon Neptune) to store and visualize complex relationships between entities, making it easy to understand how threat actors, TTPs, and infrastructure are connected. It supports connectors for automatic ingestion from MISP, AlienVault, VirusTotal, Shodan, and dozens of other sources. The platform includes role-based access control, workflow management for analyst collaboration, and export capabilities for integration with SIEMs and SOAR platforms.
Platform Support
Tags
Shared
MISP only
OpenCTI only