MISP vs Pulse Intelligence

MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information using fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, and instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS, and the project recommends Ubuntu 24.04 or misp-docker for deployment. The software costs nothing under AGPL. Paid yearly support, sustainability support, and training options are also listed.

Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.