MISP vs ThreatQ
MISP
misp-project.org
ThreatQ
threatq.comSide by side
| Figure | MISP | ThreatQ |
|---|---|---|
| Price from | €0.61/mo | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 7 | 1 |
| Spec score · Threat Intelligence Platforms | 9.0 (#1) | 6.9 (#24) |
| Deployment | MISP can run on-premises, in the cloud or as a SaaS deployment. | ThreatQ v6 provides standard and air-gapped installation guides. |
| Intended users | The project says MISP is designed for incident analysts, security and ICT professionals, and malware reversers. | ThreatQuotient describes use cases including threat hunting, vulnerability management, alert triage, threat intelligence management, and spear-phishing investigations. |
| Purpose | MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. | ThreatQ is a cyber threat intelligence platform for collecting, prioritizing, analyzing, and operationalizing threat intelligence. |
| Support | Core issues are tracked on GitHub and community support is available through MISP Gitter channels. | The ThreatQ Help Center provides product documentation, developer resources, integration information, and support contact options. |
Plans
MISP
- MISP coreFree
- MISP softwareFree
- Yearly support contract€7.31 a year
- Sustainability support€10.97 a year
- Support contract with sustainability support€18.28 a year
- Closed training in LuxembourgPrice not published
- On-site closed trainingPrice not published
In their own words
MISP
MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information using fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, and instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS, and the project recommends Ubuntu 24.04 or misp-docker for deployment. The software costs nothing under AGPL. Paid yearly support, sustainability support, and training options are also listed.
ThreatQ
ThreatQ is a cyber threat intelligence platform for collecting, prioritizing, analyzing and operationalizing threat information. It ingests material from commercial feeds, open sources, ISACs, partners and internal tools, then normalizes, correlates and enriches it. Threat Library applies customer-defined parameters and organizational context to score and prioritize intelligence. Adaptive Workbench supports configurable enrichment, workflows, prioritization logic, watchlists and operations using existing tools and workflows. The marketplace lists over 450 integrations, with APIs and SDKs available for customization. Integration listings have differing support designations, and ThreatQuotient does not maintain integrations published by other parties. ThreatQ v6 has standard and air-gapped installation guides. Investigations, Data Exchange and TDR Orchestrator are additional modules outside the default deployment. Authentication can use local accounts, LDAP, SAML or SSL client certificates, and account-level two-step verification is available. The default session timeout is sixty minutes of inactivity. Pricing is on request; the platform requires a license, and licenses are not perpetual.