Skip to content
SPECIFICTION
Get listed

MISP

misp-project.org

From €0.61/mo Free plan Open source WebLinuxAPISelf-hosted
Visit misp-project.org
Spec score 9.0 #1 of 32 in Threat Intelligence Platforms

What it is

MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information using fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, and instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS, and the project recommends Ubuntu 24.04 or misp-docker for deployment. The software costs nothing under AGPL. Paid yearly support, sustainability support, and training options are also listed.

Spec sheet

What it does
MISP is an open-source platform for collecting, storing, correlating, analysing and sharing cyber-threat intelligence.Read 15 Oct 2026 · misp-project.org
Purpose
MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis.Read 9 Oct 2026 · misp-project.org
Intended users
The project says MISP is designed for incident analysts, security and ICT professionals, and malware reversers.Read 9 Oct 2026 · misp-project.org
Deployment
MISP can run on-premises, in the cloud or as a SaaS deployment.Read 15 Oct 2026 · misp-project.org
API
MISP provides an OpenAPI-described REST API with extensive restSearch capabilities and bundled PyMISP support.Read 15 Oct 2026 · misp-project.org
Security
MISP supports signing and encrypting notifications with GnuPG or S/MIME, and signing and validating shared information.Read 9 Oct 2026 · misp-project.org
Support
Core issues are tracked on GitHub and community support is available through MISP Gitter channels.Read 15 Oct 2026 · misp-project.org
Analysis
MISP supports correlation, including fuzzy hashes and CIDR overlaps, and lets analysts add comments, sightings, opinions, proposals, and counter-analysis.Read 9 Oct 2026 · misp-project.org
Automation and API
MISP provides an OpenAPI-described REST API, the PyMISP library, Python enrichment modules, and ZMQ or Kafka streaming channels.Read 9 Oct 2026 · misp-project.org
Collaboration
Users can add opinions, relationships, comments, sightings, proposals and counter-analysis to shared intelligence.Read 15 Oct 2026 · misp-project.org
Company facts
LinkedIn lists MISP Project as a nonprofit founded in 2012, headquartered in Luxembourg, with 11–50 employees.Read 15 Oct 2026 · lu.linkedin.com
Containers
The project documents production Docker images and also lists Puppet, Ansible and RPM installation options.Read 15 Oct 2026 · misp-project.org
Core licence
MISP core software is licensed under GNU AGPL version 3 or later.Read 15 Oct 2026 · misp-project.org
Correlation
Correlation supports exact matches, fuzzy hashes and CIDR overlaps with granular controls.Read 15 Oct 2026 · misp-project.org
Documentation
Documentation is maintained in the misp-book project and is offered in HTML, PDF, EPUB and Kindle MOBI formats.Read 15 Oct 2026 · misp-project.org
Extensibility
Python expansion, import and export modules extend functionality without changing core components.Read 15 Oct 2026 · misp-project.org
External security issue
The GitHub Advisory Database describes an authorization flaw in freetext-feed preview that could expose restricted event correlations and feed metadata.Read 15 Oct 2026 · github.com
Formats
Exports include MISP JSON, STIX 1 and 2, OpenIOC, CSV, text, Suricata, Snort, Zeek, RPZ and forensic-cache formats.Read 15 Oct 2026 · misp-project.org
Funding and stewardship
The project is financially and resource supported by CIRCL, the Computer Incident Response Center Luxembourg.Read 15 Oct 2026 · misp-project.org
Government advisory
Canada's Cyber Centre advised users to update MISP because versions before 2.5.39 were affected by vulnerabilities disclosed in June 2026.Read 15 Oct 2026 · cyber.gc.ca
Hosted service limits
The listed virtual hosting configuration includes one managed organization and 100 GB of HDD space; dedicated hosting lists unlimited managed organizations and 500 GB.Read 9 Oct 2026 · misp-project.org
Imports
The platform imports MISP, STIX, CSV, proprietary formats, URLs, batches, sandbox results and bulk data through its UI or API.Read 15 Oct 2026 · misp-project.org
Independent adoption
RH-ISAC launched a community MISP instance for members to share, enrich, vet, correlate and analyse intelligence, with SIEM, SOAR and EDR integrations.Read 15 Oct 2026 · rhisac.org
Independent history
RH-ISAC reports that the project began in 2011 as CyDefSIG and was renamed after NATO became involved in 2012.Read 15 Oct 2026 · rhisac.org
Integrations and formats
The product supports imports and exports including STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek, and connects to external services through modules and APIs.Read 9 Oct 2026 · misp-project.org
Latest release
MISP 2.5.50 was released on 9 October 2026 with security hardening, Overmind interface work, TAXII, object, graph and administration improvements.Read 15 Oct 2026 · github.com
Library licence
PyMISP is licensed under the BSD 2-Clause Simplified licence.Read 15 Oct 2026 · misp-project.org
Limit: deployment effort
Independent reviewers say deployment and maintenance require Linux administration expertise and dedicated engineering resources.Read 15 Oct 2026 · comparisec.com
Limit: feed noise
An independent review warns that community-feed value depends on curation and trust settings because raw shared indicators can become noisy without governance.Read 15 Oct 2026 · osintbench.com
Limit: strategic modelling
An independent review says MISP is less natural than graph-oriented platforms for deep relationship modelling and long-horizon strategic analysis.Read 15 Oct 2026 · osintbench.com
Limit: user experience
An independent review describes the interface as reflecting a technical heritage rather than a polished commercial product.Read 15 Oct 2026 · comparisec.com
Notable news
MISP Modules 3.0.12 was released on 14 October 2026 with richer enrichment, better MISP-object interoperability and reliability improvements.Read 15 Oct 2026 · misp-project.org
Notifications
Notifications can be signed and encrypted with GnuPG or S/MIME.Read 15 Oct 2026 · misp-project.org
Operating systems
The installer targets standard GNU/Linux distributions and Ubuntu 24.04 is recommended for MISP 2.5.Read 15 Oct 2026 · misp-project.org
Platform requirement
The download page says MISP can be installed on standard GNU/Linux distributions and recommends Ubuntu 24.04 for MISP 2.5.Read 9 Oct 2026 · misp-project.org
Praise: interoperability
An independent review praises MISP's free open-source model, strong STIX/TAXII support and broad integrations with commercial threat-intelligence platforms.Read 15 Oct 2026 · comparisec.com
Praise: sharing
An independent review highlights MISP's event-based sharing, trusted-community synchronization and practical IOC exchange for CERTs, SOCs and MSSPs.Read 15 Oct 2026 · osintbench.com
Rating on G2
4.5 out of 5 from 80 reviewsRead 15 Oct 2026 · comparisec.com
SDK
PyMISP is the official Python library for accessing MISP REST APIs and manipulating events, attributes and samples programmatically.Read 15 Oct 2026 · misp-project.org
Security disclosure
MISP publishes CVE or GCVE identifiers for security issues, including minor bugs suspected to have security impact.Read 15 Oct 2026 · misp-project.org
Security process
The project says confirmed vulnerabilities are usually fixed within 48 hours and followed by a release containing the fixes within days.Read 15 Oct 2026 · misp-project.org
Sharing controls
Distribution levels and custom sharing groups can be applied down to individual attributes.Read 15 Oct 2026 · misp-project.org
Streaming
ZMQ and Kafka channels can publish new events, indicators, sightings and tagging changes in real time.Read 15 Oct 2026 · misp-project.org
Support limits
The yearly support contract covers five prioritized issues, configuration requests, or fast-tracked bug fixes during business hours; new custom features are usually project-based.Read 9 Oct 2026 · misp-project.org
Synchronization
MISP instances can automatically exchange events, attributes and higher-level intelligence with trusted communities.Read 15 Oct 2026 · misp-project.org
Target users
The project is designed for incident analysts, security and ICT professionals, malware reversers and organisations sharing structured threat information.Read 15 Oct 2026 · misp-project.org

Plans and prices

MISP core Free Open-source software · no paid tiers stated Read 15 Oct 2026 · misp-project.org
MISP software Free Open source software released under AGPL Read 9 Oct 2026 · misp-project.org
Yearly support contract €7.31 a year per year Fast-tracked resolution of 5 issues; business-hours ticket support; custom features usually project-based Read 9 Oct 2026 · misp-project.org
Sustainability support €10.97 a year per year Logo displayed in the project website supporter section Read 9 Oct 2026 · misp-project.org
Support contract with sustainability support €18.28 a year per year Fast-tracked resolution of 6 issues; business-hours ticket support; supporter-section logo Read 9 Oct 2026 · misp-project.org
Closed training in Luxembourg Price not published per training day Up to 30 attendees; food and beverages included Read 9 Oct 2026 · misp-project.org
On-site closed training Price not published per training day plus additional expenses Up to 30–50 attendees, depending on location conditions Read 9 Oct 2026 · misp-project.org

Every MISP plan and price →

Strong points and limits

Strong points

  • Correlates fuzzy hashes and CIDR overlaps
  • Controls sharing down to individual attributes
  • Synchronizes intelligence between instances in real time
  • Provides REST API, PyMISP, and streaming options
  • Imports and exports several listed formats

Limits

  • Yearly support covers five prioritized issues
  • Support tickets are handled during business hours
  • New custom features are usually project-based

Who it suits

MISP suits incident analysts, security and ICT professionals, and malware reversers who need to analyze and share threat information. Its API, streaming channels, and supported formats also fit teams integrating intelligence into other systems.

Verdict

MISP offers detailed controls for analyzing and sharing threat information, with multiple deployment and automation options. The software is free; prioritized support and training are paid offerings.

Where Specifiction places it

Alternatives to MISPAll alternatives →