CIRCL Services

MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing - Training Materials

Introduction

In a continuous effort since 2016, CIRCL frequently gives practical training sessions about MISP (Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing). The purpose is to reach out to security analysts using MISP as a threat intelligence platform along with users using it as an information sharing platform.

The MISP training repository is the reference for the training materials and their LaTeX source code. It covers core MISP software and standards, threat intelligence and OSINT, and workshops on building information sharing communities.

The materials below include slide decks, exercises, supporting documentation and recordings. Pre-built MISP training virtual machines are available separately from the MISP VM download site.

Next trainings

Next MISP Threat Intelligence summit

  • MISP Summit is now part of hack.lu

MISP Materials

Slides (PDF) Source Code
0-intro-shorter source
0-misp-introduction-to-information-sharing source
1-misp-usage source
1.2-misp-integration source
1.1-misp-viper-integration source
1.2.1-misp-integration-mail2misp source
2-misp-administration source
3-misp-taxonomy-tagging source
3.1-misp-modules source
3.2-misp-galaxy source
3.3-misp-object-template source
6.0-misp-dashboard source
a.0-contributing source
a.1-devintro source
a.2-pymisp source
a.3-misp-feed source
a.4-best-practices source
a.5-decaying-indicators source
a.5-bis-decaying-indicators-light-version source
a.6-forensic source
a.7-rest-API source
b.1-best-practices-in-threat-intelligence source
b.5-turning-data-into-actionable-intelligence-training source
a.8-dev-hands-on source
a.9-restsearch-dev source
a.10-galaxy-2.0 source
a.11-misp-data-model source
a.12-misp-workflows source
a.12-misp-workflows-short source
a.13-misp-stix source
a.a-widget-dev source
b.2-turning-data-into-actionable-intelligence source
4-misp-standard source
x.13-exercise-movie source
a.b-cli source
a.c-deployment source
b.6-automation source

Complementary materials

Slides (PDF) Source Code
Complete slide deck in one PDF source
MISP training cheat-sheet source
MISP feature list (for the trainers) source
MISP data model overview (quick) —
MISP Ten Pillars — recommendations and best practices when encoding data —

The exercises and sample events provide material for hands-on sessions.

Source code and reuse

The complete LaTeX source is available in the training repository. Its README explains the dependencies and how to build the slide decks with bash build.sh. The generated PDFs are placed in output/, and misp-training.pdf contains the complete handout.

The materials are dual-licensed under the GNU Affero General Public License version 3 or later and Creative Commons Attribution-ShareAlike 4.0 International. Choose the license appropriate to your use case and retain the attribution and funding acknowledgements when reusing the materials.

Additional documentation

MISP Training videos

Sample videos which can be used to understand how the training materials are used in companion with a live MISP demo instance.

Passive DNS and MISP - Training videos

MISP Training support videos

Those are videos to support MISP trainings or demonstrations at large:

MISP Virtual Machine

Pre-built MISP training VMs are available at vm.misp-project.org. Consult the download site for the current images and their setup instructions.

MISP Community at CIRCL

If you want to connect to the CIRCL MISP community, feel free to contact us.

Updates

  • 4th October 2026 - Aligned the materials, source links and supporting resources with the MISP training repository
  • 7th July 2021 - Updates to the official training links
  • 26th September 2019 - Fixing links to training materials
Top