MISP vs Threat Intelligence Platform

MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information using fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, and instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS, and the project recommends Ubuntu 24.04 or misp-docker for deployment. The software costs nothing under AGPL. Paid yearly support, sustainability support, and training options are also listed.

Threat Intelligence Platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time. Its web interface provides details about a host and its underlying infrastructure. The Domain Infrastructure Analysis API returns web, mail, and name servers, known subdomains, IP addresses, geolocation, and subnet information. The Domain Reputation API assesses domains and IPv4 addresses against more than 120 parameters to calculate a reputation score. Other APIs cover SSL certificate chains, SSL configuration, malware checks, and connected domains. The APIs are presented for integration with cybersecurity products such as CTI platforms, SIEM solutions, and DRP solutions, and for enriching systems or examining indicators of compromise, third-party digital assets, and attack-surface exposure. The service is available on the web and through APIs, with cloud deployment. A free, fully functional trial requires no credit card or company information. The free subscription provides 100 credits after sign-up; web analysis costs 10 credits per request, and API requests cost 1–3 credits each. API use is limited to 100 requests per minute.