Structure intelligence
Capture data as events, attributes and reusable MISP Objects. Add context with tags, taxonomies and MISP Galaxies for threat actors, malware, tools and other knowledge.
CIRCL-operated sharing communities
Turn threat information into collective defence
MISP is an open-source threat intelligence and sharing platform. It gives analysts, incident responders and automated security tools a common, structured way to collect, enrich, correlate and exchange knowledge about threats.
More than an IOC database
MISP models both technical and contextual intelligence: observables and indicators, incidents, threat actors, campaigns, vulnerabilities, tactics and techniques, and the relationships between them. Instead of moving unstructured lists between teams, contributors build reusable knowledge that can be searched, correlated, enriched and acted upon.
CIRCL develops MISP with a broad international open-source community and operates several trusted MISP communities for eligible organisations in Luxembourg and partner networks.
What MISP does
Correlate and assess
Find relationships across shared data, record sightings and false positives, and preserve analysts' notes, opinions and links with Analyst Data.
Share with control
Apply distribution levels, sharing groups and markings such as TLP to decide who receives information—down to individual attributes and objects.
Operationalise
Use feeds, synchronisation, exports and APIs to bring intelligence into detection, incident response, SIEM and other security workflows.
Explain the analysis
Create Event Reports alongside structured data, so human-readable findings and machine-readable intelligence stay together.
Automate safely
Build MISP Workflows from triggers, conditions and actions to support review, enrichment, publication and notification processes.
Built for many intelligence domains.
Although MISP grew from malware and incident/intelligence information sharing, its flexible data model also supports vulnerability, fraud, disinformation, physical-security and sector-specific intelligence.
How CIRCL communities work
CIRCL runs multiple MISP instances for different constituent and partner communities. Members can contribute intelligence, benefit from data shared by trusted peers and—where authorised—exchange events with connected MISP communities.
1Contribute an event or ingest it through the API
2Enrich it with context, relationships and analysis
3Control its distribution and audience
4Use it in detection and response
Distribution and trust
MISP’s standard distribution choices are Your organisation only, This community only, Connected communities and All communities. Sharing Groups provide a more precise audience spanning selected organisations and instances. The event creator can also apply distribution controls to attributes and objects within an event.
Participants remain responsible for choosing the appropriate audience and markings. CIRCL communities use the Traffic Light Protocol (TLP) to help communicate handling expectations.
Data stays useful and accountable
Contributors can update events as investigations mature. Correlations expose matching indicators, while proposals, sightings, warninglists and analyst annotations help recipients evaluate quality and relevance. Each organisation retains control over what it publishes and synchronises.
Automation and integrations
Every CIRCL MISP community provides a web interface for analysts and a REST API for automation. Common integrations include:
- importing and exporting structured threat intelligence;
- synchronising authorised data between MISP instances;
- feeding SIEM, IDS, case-management and detection systems;
- enriching events through MISP modules;
- automating common tasks with PyMISP, the maintained Python library for the MISP API; and
- using native MISP formats or interoperable formats when an integration requires them.
API keys are tied to a user and inherit that user’s permissions. Treat them as credentials, scope access appropriately and rotate them according to your organisation’s security policy.
Hosted by CIRCL
Start sharing without operating a server
Eligible members can use a CIRCL-operated instance through the web interface and API. CIRCL maintains the platform and community connection.
Run your own MISP
Keep local control and synchronise
Organisations with operational capacity can deploy MISP locally and synchronise only the data permitted by their sharing relationships.
MISP for law enforcement agencies
Restricted LEA community
Dedicated access through misp-lea.org
misp-lea.org is available exclusively to eligible law enforcement agencies. LEA representatives can request access for their agency through the MISP-LEA website; every request is reviewed before access is granted.
Request access
Access to CIRCL’s MISP communities is free of charge but subject to validation. Organisations, CERTs/CSIRTs, trusted security researchers and security vendors can apply. Placement depends on your organisation and the community relevant to its work.
Join a trusted community
Tell us who you are and how you plan to participate
Contact CIRCL with your organisation, role, intended use and the community you want to join. We will follow up with the onboarding and identity-verification requirements.
Already a member but cannot sign in? Ask your organisation’s MISP administrator to reset your account. If that is not possible, contact CIRCL.
Resources
Documentation
Official guides for users, administrators and developers ↗
Source and releases
Review the code, release notes and issue tracker on GitHub ↗
Training material
Learn MISP with CIRCL's openly available course material →
MISP communities
Discover sharing communities around the world ↗
For public bugs, use the MISP issue tracker. Please do not disclose a suspected security vulnerability in a public issue; follow the project’s security policy or contact CIRCL.