MISP - Malware Information Sharing Platform & Threat Sharing - Training Materials

MISP - Malware Information Sharing Platform & Threat Sharing - Training Materials

Back to Services

  1. Introduction
  2. Training Materials (Luxembourg training 2017)
  3. MISP Virtual Machine
  4. MISP Community at CIRCL
  5. Updates

You can report incidents via our official contact including e-mail, phone or use the Anonymous reporting form.


CIRCL is accredited TI CIRCL is a FIRST member CIRCL is an OASIS member


In a continuous effort since 2016, CIRCL frequently gives practical training sessions about MISP(Malware Information Sharing Platform & Threat Sharing). The purpose is to reach out to security analysts using MISP as a threatintel platform along with users using it as an information sharing platform.

This page includes all the materials used during the training, including slides and a virtual machine, preconfigured with the latest version of MISP.

Training Materials (Luxembourg training 2017)

In complement to the above materials, the overall MISP documentation is available in misp-book. HTML format - PDF format - EPUB format - MOBI/Kindle format

MISP Virtual Machine

  • (most recent) Virtual image with MISP 2.4.76 SHA512 sum: 420795cd5066cdec140a220a18ad2be02f219bd121259d51cb7cc23a7e49fe86bf5bf22aa292d5958d394c8a834a94970d7fb96b3c89cd3dfe93f93a9cc5984b SHA1 sum: 4776a76078e2414fb3d5c560afc2d979b8a81183

Login and passwords for the VirtualBox MISP image are the following:

Web interface (default network settings):
MISP admin:  admin@misp.training/Password1234
MISP user:  user@misp.training/Password1234
Shell/SSH: misp/Password1234
MySQL:  root/Password1234 - misp/Password1234

If you want to convert the image from VirtualBox to Parallels:

  • Get ovftools from VMware: https://www.vmware.com/support/developer/ovf/
  • Convert image: /Applications/VMware\ OVF\ Tool/ovftool –lax misp-training.ova misp-training.vmx
  • Open misp-training.vmx in Parallels
  • It converts and starts the image and it is ready to be used on a DHCP’ed IP address

MISP Community at CIRCL

If you want to connect to the CIRCL MISP community, feel free to contact us.


  • 3rd May 2016 - Virtual box image updated with MISP version 2.4.41
  • 29th July 2016 - Virtual box image updated MISP version 2.4.49
  • 4th September 2016 - Virtual box image 2.4.51 added (Brussels Training)
  • 18th November 2016 - Virtual box image with updated Ubuntu and MISP 2.4.54 added
  • 21st November 2016 - Broken link to ‘ovftools’ fixed, added clarification for web interface
  • 30th November 2016 - Virtual box image 2.4.55.ova added
  • 23th December 2016 - Virtual box image with MISP 2.4.58 added
  • 9th January 2017 - Virtual box image MISP 2.4.59 added
  • 18th January 2017 - Virtual Machine (VM) for MISP 2.4.60 added
  • 25th January 2017 - Virtual Machine updated to MISP 2.4.61
  • 13th March 2017 - Virtual Machine updated to version 2.4.69
  • 31th March 2017 - Virtual Machine updated to version 2.4.70
  • 12th April 2017 - 2.4.71 updated + new MISP training in Luxembourg
  • 28th April 2017 - MISP 2.4.72 VM updated
  • 26th June 2017 - MISP 2.4.76 VM updated