MISP

AGPL-3.0

🧠 Threat Intelligence · PHP/Python

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, and counter-terrorism data. It provides a robust data model for structuring threat data, automatic correlation of attributes and indicators, flexible sharing groups for controlled distribution, and import/export in STIX, OpenIOC, and many other formats. MISP includes a built-in feed system for consuming external threat intelligence, a REST API for automation, and taxonomies and galaxies for consistent classification. It's used by CERTs, SOCs, threat intelligence teams, and law enforcement worldwide as their primary threat intelligence management platform.

6.2kstars

1.6kforks

2809issues

Updated 2d ago

View on GitHub Official Website Documentation

Installation

Install script (Ubuntu)

$ curl -o /tmp/INSTALL.sh https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/INSTALL.sh && bash /tmp/INSTALL.sh

Docker

$ git clone https://github.com/MISP/misp-docker.git && cd misp-docker && docker compose up -d

Use Cases

Collecting and correlating IOCs from multiple sources into a structured database
Sharing threat intelligence with trusted partners through sharing groups
Automating threat feed ingestion and IOC enrichment via REST API
Exporting structured threat data in STIX/TAXII format for SIEM integration
Tracking threat actor campaigns and malware families across incidents