MISP Threat Intelligence Platform: What It Is and How to Use It

MISP in a cyber security context is an open-source threat intelligence platform: software for collecting, storing, distributing and sharing cyber security indicators and threats. This guide is for analysts, research-security and IT staff who want to know what it is and how to record a first event in it. (MISP is also an unrelated acronym in insurance and medicine; those senses are not covered here.)

What does MISP stand for?

The MISP book published by CIRCL, the Luxembourg CERT that documents the project, expands the name as “MISP Intelligence Sharing Platform” and describes it as “an open source platform for sharing threat intelligence”. An older expansion, “Malware Information Sharing Platform”, still appears in the title of FIRST’s page for its own instance, so you will see both in the wild. The project home page itself uses the name without expanding it. The same answer covers the “MISP full form” and “MISP meaning” searches.

What is MISP?

MISP is described on the project site as an open-source software solution for collecting, storing, distributing and sharing cyber security indicators and threats. The source code is on GitHub under the GNU AGPL v3 licence. Features listed on the project site include:

• correlation between stored data;
• automated exports for IDS and SIEM systems in STIX or OpenIOC;
• synchronisation with other MISP instances;
• taxonomies and galaxies, for example MITRE ATT&CK;
• feeds and dashboards;
• open formats and an API, with the PyMISP Python library and MISP modules (expansion, import and export).

What it is used for in research

MISP is a place to record structured threat data (an “event” containing “attributes” such as a domain name) and to share it with chosen partners. The platform’s correlation feature compares stored values across events. Because instances can synchronise with each other, a group can share selected data while keeping the rest private through each event’s distribution setting.

Install or access

Download and install options are listed at misp-project.org/download, and the official install guides are at misp.github.io/MISP. At the time of reading (2026-11-07) those guides covered Ubuntu 22.04 and 20.04, RHEL 8 and 7, Debian 10, CentOS 7, Kali, NetBSD, OpenBSD and Tsurugi, among others. The core code is at github.com/MISP/MISP; this is the “MISP GitHub” most searches are looking for. Documentation is at misp-project.org/documentation.

Many people do not install anything: they receive a login to an instance run by a community, such as the one operated by FIRST, and use the steps below on it. For a new self-run installation, the CIRCL quick start says that if ADMIN_EMAIL and ADMIN_PASSWORD are left empty in the .env file, the default login is [email protected] with password admin, and that the default password must be changed immediately. Treat this as the first task after any fresh install.

Create your first event

These steps follow the CIRCL MISP book quick start (read 2026-11-07). Menu names can shift between releases, so check them against the documentation for your version.

1. Log in. If you are on a fresh install, change the default password first.
2. Go to Data points → Events → Add Event.
3. Fill in the event info (a short description), the date, the analysis and threat level, and the distribution. For a first test, choose a restrictive option such as “Your organisation only”.
4. Select Create Event Entry.
5. Open the event’s Attributes tab and choose Add Attribute. The quick start example is a domain, example.org. Untick the “for Intrusion Detection System” option (the to_ids flag) unless you intend the value to feed detection exports.
6. To add many values at once, use the event’s General tab, then Import, then Freetext Import. Paste the text into the IOCs box, select Run Freetext Import, review the attributes MISP detected, then select Create attributes.

Output and how to read it

Open the event’s Correlation tab, and the Related Events panel, to see other events that share a value with yours. The quick start’s guidance is that a shared value is a lead to assess, not a conclusion: two events sharing a domain tells you to look closer, not that they describe the same activity. Before an event is published or shared, review its tags and distribution. Detection exports for IDS or SIEM tools can require the event to be published.

Troubleshooting

• Cannot log in on a new install: check whether ADMIN_EMAIL and ADMIN_PASSWORD were set in .env; if they were left empty the defaults above apply.
• No correlations appear: correlation depends on matching values already stored in the instance. An empty Related Events panel on a new, empty instance is expected.
• An export is empty: check that the event is published and that the attributes you expected are flagged for detection.
• Anything version-specific: use the official documentation and the install guide for your operating system.

Free alternatives

MISP is itself free and open source (AGPL v3). The table lists open-source platforms covered elsewhere on this site.

Tool	What the site covers
OpenCTI	Open-source threat intelligence platform guide
MalwareBazaar	Free malware sample sharing service and how to query it (a data source rather than a platform)
MITRE ATLAS	Threat matrix for AI systems, a knowledge base rather than a sharing platform

For testing AI models rather than sharing indicators, see the Garak vulnerability scanner guide.

FAQ

What does MISP stand for?

CIRCL’s documentation uses “MISP Intelligence Sharing Platform”; the older form is “Malware Information Sharing Platform”.

What is MISP?

An open-source platform for collecting, storing, correlating and sharing cyber security indicators and threat information.

What is MISP insurance?

That is an unrelated use of the acronym. This page covers only the threat intelligence platform, and does not give insurance or policy information.

What is a MISP policy?

Also an unrelated sense of the acronym, outside the scope of this page. For the software, the closest equivalent is an event’s distribution setting, which controls who can see shared data.

Sources

• MISP Project, misp-project.org, read 2026-11-07.
• CIRCL, MISP book and quick start, read 2026-11-07.
• MISP on GitHub and the official install guides, read 2026-11-07.