MISP
MISP is an open-source platform for gathering, storing, analyzing, and sharing cybersecurity indicators and threat information for incident and malware analy…
What MISP is
MISP is an open-source platform for gathering, storing, analyzing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information, including fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis.
Sharing controls include distribution levels and custom groups that can apply down to individual attributes, and MISP instances can synchronize intelligence in real time. The platform supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS. The software is free under AGPL; paid support and training are also offered.
Good
- Free open-source software released under AGPL.
- Sharing controls reach individual attributes.
- Supports real-time synchronization between instances.
- Provides REST API, PyMISP, and streaming channels.
Watch out
- Yearly support covers five prioritized issues.
- Custom features are usually project-based.
- Paid support and training are separate options.
Who it suits
MISP is suited to incident analysts, security and ICT professionals, and malware reversers who need to manage and exchange threat information. Its API, streaming channels, and sharing controls may also fit teams automating intelligence workflows.
Verdict
MISP combines indicator analysis, controlled sharing, and automation in software that can be deployed in several ways. Community support is available, while prioritized assistance and training are paid options.
Plans and prices
From MISP's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| MISP software | Free | Open source software released under AGPL |
| MISP core | Free | Open-source software · no paid tiers stated |
| Yearly support contract | €7.31 a year | Fast-tracked resolution of 5 issues; business-hours ticket support; custom features usually project-based · per year |
| Sustainability support | €10.97 a year | Logo displayed in the project website supporter section · per year |
| Support contract with sustainability support | €18.28 a year | Fast-tracked resolution of 6 issues; business-hours ticket support; supporter-section logo · per year |
| On-site closed training | — | Up to 30–50 attendees, depending on location conditions · per training day plus additional expenses |
| Closed training in Luxembourg | — | Up to 30 attendees; food and beverages included · per training day |
The facts
Each one read from MISP's own pages, with the date it was checked.
What it does
- Analysis
- MISP supports correlation, including fuzzy hashes and CIDR overlaps, and lets analysts add comments, sightings, opinions, proposals, and counter-analysis.checked 9 Oct 2026
- API
- MISP provides an OpenAPI-described REST API with extensive restSearch capabilities and bundled PyMISP support.checked 15 Oct 2026
- Automation and API
- MISP provides an OpenAPI-described REST API, the PyMISP library, Python enrichment modules, and ZMQ or Kafka streaming channels.checked 9 Oct 2026
- Collaboration
- Users can add opinions, relationships, comments, sightings, proposals and counter-analysis to shared intelligence.checked 15 Oct 2026
- Containers
- The project documents production Docker images and also lists Puppet, Ansible and RPM installation options.checked 15 Oct 2026
- Core licence
- MISP core software is licensed under GNU AGPL version 3 or later.checked 15 Oct 2026
- Correlation
- Correlation supports exact matches, fuzzy hashes and CIDR overlaps with granular controls.checked 15 Oct 2026
- Deployment
- MISP can run on-premises, in the cloud or as a SaaS deployment.checked 15 Oct 2026
- Documentation
- Documentation is maintained in the misp-book project and is offered in HTML, PDF, EPUB and Kindle MOBI formats.checked 15 Oct 2026
- Extensibility
- Python expansion, import and export modules extend functionality without changing core components.checked 15 Oct 2026
- External security issue
- The GitHub Advisory Database describes an authorization flaw in freetext-feed preview that could expose restricted event correlations and feed metadata.checked 15 Oct 2026
- Formats
- Exports include MISP JSON, STIX 1 and 2, OpenIOC, CSV, text, Suricata, Snort, Zeek, RPZ and forensic-cache formats.checked 15 Oct 2026
- Funding and stewardship
- The project is financially and resource supported by CIRCL, the Computer Incident Response Center Luxembourg.checked 15 Oct 2026
- Government advisory
- Canada's Cyber Centre advised users to update MISP because versions before 2.5.39 were affected by vulnerabilities disclosed in June 2026.checked 15 Oct 2026
- Hosted service limits
- The listed virtual hosting configuration includes one managed organization and 100 GB of HDD space; dedicated hosting lists unlimited managed organizations and 500 GB.checked 9 Oct 2026
- Imports
- The platform imports MISP, STIX, CSV, proprietary formats, URLs, batches, sandbox results and bulk data through its UI or API.checked 15 Oct 2026
- Independent adoption
- RH-ISAC launched a community MISP instance for members to share, enrich, vet, correlate and analyse intelligence, with SIEM, SOAR and EDR integrations.checked 15 Oct 2026
- Independent history
- RH-ISAC reports that the project began in 2011 as CyDefSIG and was renamed after NATO became involved in 2012.checked 15 Oct 2026
- Integrations and formats
- The product supports imports and exports including STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek, and connects to external services through modules and APIs.checked 9 Oct 2026
- Intended users
- The project says MISP is designed for incident analysts, security and ICT professionals, and malware reversers.checked 9 Oct 2026
- Latest release
- MISP 2.5.50 was released on 9 October 2026 with security hardening, Overmind interface work, TAXII, object, graph and administration improvements.checked 15 Oct 2026
- Library licence
- PyMISP is licensed under the BSD 2-Clause Simplified licence.checked 15 Oct 2026
- Limit: deployment effort
- Independent reviewers say deployment and maintenance require Linux administration expertise and dedicated engineering resources.checked 15 Oct 2026
The company
- Company facts
- LinkedIn lists MISP Project as a nonprofit founded in 2012, headquartered in Luxembourg, with 11–50 employees.checked 15 Oct 2026
Alternatives to MISP
- 1
Pulse Intelligence
Free planWebAPILinuxmacOS6.8Free plan - 2
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 3
Kaspersky Threat Intelligence Portal
Free planWebAPI6.5Free plan - 46.5From $4,550 a year
- 5
IBM X-Force Exchange
Free planWebAPI6.3Free plan - 6
Shodan Monitor
WebAPILinux6.3From $69 a month