MISP - Malware Information Sharing Platform & Threat Sharing - Training Materials

You can report incidents via our official contact including e-mail, phone or use the Anonymous reporting form.


CIRCL is accredited TI CIRCL is a FIRST member CIRCL is an OASIS member


In a continuous effort since 2016, CIRCL frequently gives practical training sessions about MISP(Malware Information Sharing Platform & Threat Sharing). The purpose is to reach out to security analysts using MISP as a threatintel platform along with users using it as an information sharing platform.

This page includes all the materials used during the training, including slides and a virtual machine, preconfigured with the latest version of MISP.

Next trainings

Training Materials (Latest update: September 19 2018)

In complement to the above materials, the overall MISP documentation is available in misp-book. HTML format - PDF format - EPUB format - MOBI/Kindle format

Additional references for taxonomies PDF, object templates PDF and galaxy PDF).

MISP Virtual Machine

Login and passwords for the VirtualBox MISP image are the following:

For the MISP web interface -> admin@admin.test:admin
For the system -> misp:Password1234

If you want to convert the image from VirtualBox to Parallels:

  • Get ovftools from VMware: https://www.vmware.com/support/developer/ovf/
  • Convert image: /Applications/VMware\ OVF\ Tool/ovftool –lax misp-training.ova misp-training.vmx
  • Open misp-training.vmx in Parallels
  • It converts and starts the image and it is ready to be used on a DHCP’ed IP address

MISP Community at CIRCL

If you want to connect to the CIRCL MISP community, feel free to contact us.


  • 3rd May 2016 - Virtual box image updated with MISP version 2.4.41
  • 29th July 2016 - Virtual box image updated MISP version 2.4.49
  • 4th September 2016 - Virtual box image 2.4.51 added (Brussels Training)
  • 18th November 2016 - Virtual box image with updated Ubuntu and MISP 2.4.54 added
  • 21st November 2016 - Broken link to ‘ovftools’ fixed, added clarification for web interface
  • 30th November 2016 - Virtual box image 2.4.55.ova added
  • 23th December 2016 - Virtual box image with MISP 2.4.58 added
  • 9th January 2017 - Virtual box image MISP 2.4.59 added
  • 18th January 2017 - Virtual Machine (VM) for MISP 2.4.60 added
  • 25th January 2017 - Virtual Machine updated to MISP 2.4.61
  • 13th March 2017 - Virtual Machine updated to version 2.4.69
  • 31th March 2017 - Virtual Machine updated to version 2.4.70
  • 12th April 2017 - 2.4.71 updated + new MISP training in Luxembourg
  • 28th April 2017 - MISP 2.4.72 VM updated
  • 26th June 2017 - MISP 2.4.76 VM updated
  • 13th July 2017 - MISP 2.4.77 VM updated
  • 28th August 2017 - MISP 2.4.79 VM updated
  • 22nd November 2017 - MISP VM updated to default generated VMs
  • 5th December 2017 - New MISP training in Luxembourg
  • 1st February 2018 - New MISP training in Luxembourg
  • 30th March 2018 - New set of MISP training - feeds added and complete slide deck in one PDF
  • 19th September 2018 - Updated slides with the latest version, new slides added + some references