MISP Open Source Threat Intelligence Platform & Open Standards For Threat Intelligence Sharing

MISP v2.5.35: Decomposed Event Views, Overmind UI Enhancements, Security Hardening and MISP-STIX major update

Thu, 19 Mar 2026 00:00:00 +0000

The MISP v2.5.35 release introduces significant architectural improvements to the Event View, massive performance optimizations for attribute searching, and critical security hardening for installers. This version marks a major step forward in the “Overmind” UI project, transitioning toward a more modern, responsive user experience.

Setting up UniqueSignal in MISP

Tue, 17 Mar 2026 00:00:00 +0000

Note: This post also appeared on the VMRay website: Setting up UniqueSignal in MISP.

VMRay UniqueSignal

Last year VMRay announced UniqueSignal, a threat intelligence feed that includes:

MISP-STIX 2026.3.13 Released

Mon, 16 Mar 2026 00:00:00 +0000

MISP-STIX v2026.3.13: Improved Indicator-Observable Matching and Expanded STIX Coverage

Introduction

misp-stix is the Python library powering bidirectional conversion between MISP and STIX (versions 1.x, 2.0, and 2.1).
It is used by MISP core software, available as misp-stix on PyPI, and also available directly as a conversion service on cti-transmute.org.

MISP Workbench `v1.0` (beta) Released

Fri, 13 Mar 2026 00:00:00 +0000

MISP Workbench – First Release `v1.0` (beta)

MISP Workbench is a powerful analyst-focused platform designed to tame the challenge of working with large volumes of threat intelligence at scale. It is capable of ingesting data from multiple origins — including MISP instances, external feeds, and other threat intelligence sources — and consolidates them into a unified workspace where analysts can actually get things done. At its core, MISP Workbench puts the analyst in control: query across your entire data corpus, enrich and process indicators, pivot between related intelligence, and push curated results back to MISP or downstream consumers — all from one place. Whether you’re triaging a large batch of incoming indicators, hunting for patterns across feeds, or preparing a finished intelligence product, MISP Workbench is built to cut through the noise and accelerate the workflow from raw data to actionable insight.

Have You Ever Thought About Drones in MISP?

Tue, 10 Mar 2026 00:00:00 +0000

Have You Ever Thought About Drones in MISP?

The Drone Threat

Unmanned Aerial Vehicles (UAVs), commonly referred to as drones, are increasingly present in civilian, industrial and military environments. While they provide many legitimate capabilities, they also introduce new security risks. In recent years, incidents have illustrated how drones are becoming a recurring operational and security concern across multiple sectors.

The Economic Power of Federated Threat Intelligence

Wed, 04 Mar 2026 00:00:00 +0000

The Economic Power of Federated Threat Intelligence

Introduction: Why Policy Matters to Developers

As developers of the MISP project, we spend most of our time thinking about UUIDs, JSON schemas, and API synchronization performance. However, every so often, a piece of academic research comes along that reminds us why this work matters beyond the code.

MISP v2.5.33: Performance, Security, and the New Overmind Theme

Tue, 03 Mar 2026 00:00:00 +0000

MISP v2.5.33 Release Notes (2026-02-27)

🎨 A Fresh Look: The “Overmind” Evolution

The UI is undergoing its most significant transformation in years. With the introduction of the Overmind theme, MISP is transitioning to a modern stack.

FlowIntel 3.0.0 released and MISP integration

Wed, 18 Feb 2026 00:00:00 +0000

FlowIntel & MISP

FlowIntel in a Nutshell

FlowIntel is an open-source platform built for handling security investigations in a structured way. It combines case management, task tracking, documentation, and collaboration in one place.

MISP architecture choices

Wed, 11 Feb 2026 00:00:00 +0000

MISP architecture

Getting your MISP architecture right from the start makes all the difference. A well-designed deployment keeps your threat intelligence platform running smoothly, protects your data, and ensures your analysts have what they need when they need it. Poor choices lead to performance bottlenecks, security gaps, and maintenance headaches that only get worse as your data grows.

MISP v2.5.32 released bringing new workflow capabilities, enhancement, security fix and various bugs fixed

Thu, 15 Jan 2026 00:00:00 +0000

We are pleased to announce the release of MISP v2.5.32, bringing new workflow capabilities, improvements to attachment handling, security fixes, and multiple dependency updates.

NGSOTI: Building an Integrated Threat-Intelligence and Information Sharing Ecosystem for the Next Generation of SOC Analysts

Fri, 02 Jan 2026 00:00:00 +0000

The Next Generation Security Operator Training Infrastructure (NGSOTI) initiative was created to address a growing gap in cybersecurity education: the need to train analysts not only on tools, but on real-world workflows, collaboration models, and operational constraints. Rather than focusing on isolated technologies, NGSOTI brings together a coherent ecosystem of open-source projects designed to reflect how modern Security Operations Centers (SOCs) actually function.

Empowering the Ecosystem: MISP’s 2025 Progress and the Open Source Future

Wed, 31 Dec 2025 00:00:00 +0000

In 2025, the MISP project hit its stride with the transition to the 2.5 branch, delivering a major UI/UX overhaul and modernized background processing to enhance platform performance. This progress was bolstered by significant updates to satellite projects, including taxonomies, objects, galaxy, misp-modules, misp-guard, and SkillAegis, ensuring that 2026 will be full of new surprises for both contributors and users as the ecosystem evolves.

MISP v2.5.31 released - Stability, Synchronization Improvements & Year-End Knowledge Base Refresh

Tue, 23 Dec 2025 00:00:00 +0000

MISP v2.5.31 Release Notes

📅 Release date: 2025-12-23

Stability, Synchronization Improvements & Year-End Knowledge Base Refresh

We are happy to announce the release of MISP v2.5.31, a maintenance-focused update bringing refreshed knowledge bases, UI refinements, improved synchronization behavior, and several important fixes.

MISP v2.5.30 and v2.5.29 released: Beta UI/UX Mode, New Workflow modules and Performance Enhancements

Sat, 13 Dec 2025 00:00:00 +0000

This release introduces a foundational beta UI/UX mode (which will be the foundation for the next versions, feedback is more than welcome), new workflow modules, improvements to the Event Index, and important security updates.

MISP v2.5.28 Release: Security, Dashboard Upgrade, and Community Enhancements

Thu, 11 Dec 2025 00:00:00 +0000

MISP v2.5.28 Release Notes (2025-12-10)

MISP v2.5.28 delivers critical security fixes, a major dashboard upgrade to Gridstack 12, and significant platform stability enhancements. This release includes extensive XSS vulnerability patching, refined tag filtering logic, and better support for Meta Communities.

MISP v2.5.27 - released with new features and various fixes

Thu, 27 Nov 2025 00:00:00 +0000

This release delivers important new modules, major internal performance optimisations, updates to validation logic, and several security fixes. A large amount of work focused on improving JSON handling, filter pipelines, encoding performance, and overall system robustness.

MISP v2.5.26 - released with performance improvements and interoperability fixes

Thu, 20 Nov 2025 00:00:00 +0000

This release brings new features focused on performance improvements, logging enhancements, and data standardisation with the introduction of the UUID attribute type. It also includes several important bug fixes and dependency updates.

MISP v2.5.25 - Performance Update

Sun, 16 Nov 2025 00:00:00 +0000

This release introduces a security fix, significant performance improvements for REST searches, new default feeds, and several important bug fixes.

MISP v2.5.24 - Security & Stability Update

Tue, 04 Nov 2025 00:00:00 +0000

This release focuses on security enhancements, bug fixes, and minor improvements to stability and functionality.

GCVE-1-2025-0010 < MISP 2.5.24 - Arbitrary file-hash inclusion via templates in the template engine in MispAttribute allows a web user to obtain the MD5 hash of any file accessible to them via inclusion of tmp_name in templates.
GCVE-1-2025-0011 < MISP 2.5.24 - Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request.
GCVE-1-2025-0012 < MISP 2.5.24 - Potential vulnerability in file check upload but this vulnerability is non-exploitable as the code is never executed. This vulnerability information is kept for archiving.
GCVE-1-2025-0013 < MISP 2.5.24 - Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation.
GCVE-1-2025-0014 < MISP 2.5.24 - Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports.
GCVE-1-2025-0015 < MISP 2.5.24 - Cross-site scripting in decaying tool simulation UI/component in MISP on web application allows an attacker/org who can set an organization’s display name to execute arbitrary JavaScript in other users’ browsers when they view or run simulations via a crafted organization name containing a script payload that is rendered unsanitized when a specific attribute is chosen for the simulation.
GCVE-1-2025-0016 < MISP 2.5.24 - Local file inclusion in [ImportFromUrl() URL handling component in MISP event report (with pandoc support) on server-side document import feature / web application allows an attacker who can supply a URL to read local filesystem documents and disclose sensitive information (limited to document file types) via providing file:// URLs to ImportFromUrl() that are fetched without proper scheme/host validation.

Thanks to Raphael Lob and Jeroen Pinoy from NATO Cyber Security Center for the security evaluation and report.

MISP 2.5.23 Released with Enhanced Benchmarking, Many Bug Fixes, and Documentation Updates

Wed, 15 Oct 2025 00:00:00 +0000

MISP 2.5.23 Release Notes - (2025-10-15)

We’re rolling out MISP 2.5.23! This release is another step in our continuous effort to keep MISP running smoothly and effectively for the entire threat intelligence community. We know how crucial it is to have a reliable platform for sharing and analyzing threat data, and we’re committed to delivering regular updates that bring you solid improvements and quick fixes.

Wazuh and MISP integration

Mon, 06 Oct 2025 00:00:00 +0000

Wazuh–MISP Integration: Real-Time Threat Detection with File Hashes

The goal of this tutorial is to integrate MISP with Wazuh, enabling automated threat intelligence correlation. When a new file is created on a monitored endpoint, Wazuh will query its hash against indicators stored in the MISP instance. If a match is found, Wazuh will automatically generate an alert, enhancing detection and response capabilities.

MISP 2.5.22 released with improvements and bugs fixes

Thu, 02 Oct 2025 00:00:00 +0000

We are pleased to announce the release of MISP v2.5.22.

This release brings new features, improvements, fixes, and important updates to keep MISP stable and up to date.

MISP Synchronisation - Test and Validation Project

Fri, 19 Sep 2025 00:00:00 +0000

MISP Synchronisation - Test and Validation Project

Introduction

To ensure effective threat intelligence sharing, MISP allows data synchronisation between different instances. The administrators of each instance can decide whether they want to send or receive data with the instances they want. In addition, synchronization also allows filtering between the data you want between public and private internal instances. However, this synchronisation mechanism must follow strict rules that define how and to what extent information can be shared.

MISP 2.5.21 released with a new recorrelate feature, various fixes and updates.

Thu, 11 Sep 2025 00:00:00 +0000

MISP 2.5.21 released (2025-09-10)

We are pleased to announce the release of MISP v2.5.21.
This version introduces new features affecting the various correlation tools, important fixes, and various updates to objects, taxonomies, and galaxy.

MISP 2.5.19 brings important fixes, improvements to the on-demand correlation engine, refinements in the task scheduler, and better error handling.

Fri, 29 Aug 2025 00:00:00 +0000

MISP 2.5.19 Release Notes

Release date: 2025-08-20

MISP 2.5.19 brings important fixes, improvements to the on-demand correlation engine, refinements in the task scheduler, and better error handling.

MISP v2.5.18 released with new on-demand correlation engine, a new improved task scheduling system and many more updates

Wed, 20 Aug 2025 00:00:00 +0000

MISP v2.5.18 Release Notes

We are pleased to announce the release of MISP v2.5.18, featuring a brand-new on-demand correlation engine, new improved task scheduling, Forgejo CI integration, and a wide range of fixes and refinements.

MISP Releases v2.5.16 & v2.4.214 - A Major Leap in Performance and Stability

Sat, 19 Jul 2025 00:00:00 +0000

We are thrilled to announce two new releases for the MISP project: a significant feature and performance release, v2.5.16, and a stable maintenance release, v2.4.214.

MISP 2.4.213 & 2.5.15 Released - A Double Dose of Security, Search, and Stability

Tue, 24 Jun 2025 00:00:00 +0000

We are thrilled to announce a dual release of MISP, bringing significant enhancements to both our stable and development branches with versions 2.4.213 and 2.5.15.

MISP 2.4.211 & 2.5.13 Released - A Double Dose of Security, Search, and Stability

Fri, 06 Jun 2025 00:00:00 +0000

We are excited to announce the parallel release of two new MISP versions: 2.5.13 for our latest branch and 2.4.211 for the 2.4 branch. These releases are packed with critical security patches, a major overhaul of the search functionality, and a host of improvements and bug fixes to enhance your threat intelligence experience.

MISP 2.4.210 / 2.5.12 released with many improvements, UI enhancement and various fixes

Wed, 14 May 2025 00:00:00 +0000

This release provides a critical round of security fixes, significant improvements to attribute validation, and UI enhancements for event views and analyst workflows. Multiple components including Galaxy, STIX, and warning lists were also updated. Special attention has been given to improving compatibility, performance, and documentation.

MISP v2.4.209 and v2.5.11 Released with new features, security fixes and improvements in workflow engine.

Wed, 07 May 2025 00:00:00 +0000

This release introduces several new features, important security fixes, and major improvements to the workflow engine, sharing group logic, and plugin handling. It also includes enhancements developed during hackathon.lu 2025.

MISP reporting

Thu, 17 Apr 2025 00:00:00 +0000

MISP reporting

Introduction

MISP already offers several ways to examine what is happening on your instance:

Statistics page - available via Global Actions ▸ Statistics – shows headline figures for events, attributes, users, organisations and sightings. (Tip: append .json to the URL to retrieve the raw data.)
Dashboard plug‑ins - provide live widgets on usage, trending attribute values and popular tags.
Periodic summary - delivers a snapshot of recent activity straight to your inbox.
Visualisation in PowerBI - uses PowerBI to visualise MISP data.

These tools are invaluable for quick checks, yet they stop short of answering a few questions:

MISP v2.4.208 and v2.5.10 Released with Many Bugs Fixed

Fri, 04 Apr 2025 00:00:00 +0000

This release introduces important security fixes, enhancements in authentication plugin handling, and better cache management in the workflow editor. It also updates various MISP components and improves remote sync behavior.

MISP v2.4.207 and v2.5.9 Released with Many Bugs Fixed

Wed, 26 Mar 2025 00:00:00 +0000

Summary

This dual release of MISP (versions 2.4.207 and 2.5.9) brings significant stability improvements, better performance, and architectural refinements, particularly around background job handling, workflow modules, and Galaxy cluster operations.

MISP v2.4.206 and v2.5.8 Released - new workflow modules, improved graph object relationship management and many other improvements

Wed, 19 Mar 2025 00:00:00 +0000

Summary

MISP v2.4.206 and v2.5.8 introduces new workflow modules, enhanced object relationship management and significant improvements to the event synchronisation mechanism. Key highlights include improved a reworked attribute search functionality, better handling of event reports, and various security fixes. Additionally, numerous optimizations and bug fixes enhance stability and performance.

MISP v2.4.205 and v2.5.7 Released - Enhancements, Fixes, and Improved Correlation Management

Mon, 24 Feb 2025 00:00:00 +0000

Combined Release Notes: MISP v2.5.7 & v2.4.205 (2025-02-24)

The MISP Project is pleased to announce the release of MISP v2.5.7 and v2.4.205, bringing several new features, important fixes, and enhancements to improve the overall user experience and platform functionality. This release addresses critical improvements in synchronization filtering, correlation management, and UI enhancements, ensuring a more stable and efficient MISP environment.

Latest misp-stix Release: Enhanced Support for Analyst Data

Fri, 07 Feb 2025 00:00:00 +0000

MISP Analyst Data Format: Enhancing STIX 2.1 Integration

The MISP Analyst Data format, part of the broader MISP-standard.org ecosystem, represents a significant step forward in structuring and exchanging cyber threat intelligence. Developed in collaboration with industry partners, this format builds upon the lessons learned from OASIS STIX, addressing its practical shortcomings while ensuring greater efficiency, flexibility, and usability for analysts.

MISP 2.4.204 and 2.5.6 released including new features, performance improvements and many other improvements.

Mon, 13 Jan 2025 00:00:00 +0000

Combined Release Notes: MISP v2.5.6 & v2.4.204 (2025-01-03)

The MISP team is excited to announce the release of MISP v2.5.6 and MISP v2.4.204. These updates bring several new features, fixes, and performance improvements to enhance the platform’s usability and efficiency. Here’s a summary of the key changes:

MISP 2.4.203 and 2.5.5 released including new features, improvements and many security improvements.

Sun, 12 Jan 2025 00:00:00 +0000

MISP Software Release: Combined Updates for v2.4.203 and v2.5.5

Introduction

We are thrilled to announce the release of MISP v2.4.203 and MISP v2.5.5, bringing a range of new features, improvements, and fixes to enhance the platform’s performance, usability, and security. These updates reflect our ongoing commitment to providing a robust and reliable open-source threat intelligence platform for the community.

MISP 2.4.202 and 2.5.4 released with numerous enhancements including analyst data, bug fixes, and security improvements

Tue, 24 Dec 2024 00:00:00 +0000

Changes

Configuration

Base URL Setting: Added a new setting to skip base URL coercion for the framework. This resolves issues when running MISP under a subdirectory but may have adverse effects for other setups.

Settings

REST Client Settings: Enhanced security by tightening REST client-related settings:
- rest_client_baseurl is now CLI-only.
- Updated rest_client_enable_arbitrary_urls description for clarity.
Removed Unused Setting: Security.disable_form_security, a legacy setting for testing purposes, has been removed.

Updates

Taxonomies, Warning Lists, Objects, Galaxy: Updated to their latest versions.
MISP-STIX and PyMISP: Updated to the latest versions.

Analyst Data

Analyst Data objects like Notes and Opinions are now flattened lists attached to their data layer instead of nested.
Improved handling of analyst data in various endpoints and views.
Added new metrics for analyst data and event reports.

UI

Minor tweaks and improvements.

Attributes

Support for adding combinations of tag collection tags and other tags simultaneously.

Statistics

Added metrics for analyst data and event reports.

CI

Path fixes and branch updates.

Fixes

Security

Resolved multiple vulnerabilities:
- Stored XSS in JsonTool::encode() used in JavaScript.
- Tightened template elements endpoint to prevent abuse.
- File upload process improved to prevent abuse.
- Prevented TOTP secret logging in audit logs.
Updated encoding in the upload_file view element.

Analyst Data

Addressed issues with nested data handling and JSON export.
Fixed data fetching inconsistencies and restored functionality for viewing nested analyst data.

REST Search

Adjusted deleted flag behavior to improve results consistency.

Miscellaneous

Corrected variable definition, CLI arguments, and template index naming.

Other

Merge Requests: Integrated various feature and fix branches into 2.4-develop.
Community Additions: Added Threatmon MISP Community.
Custom Image Path Check: Updated image path validation logic.

This release includes several critical security fixes, updates, and enhancements, improving the overall functionality and stability of MISP. Users are encouraged to update promptly to benefit from the latest improvements and security measures.

MISP v2.5.3 and v2.4.201 released with numerous enhancements, bug fixes, and security improvements to strengthen threat information sharing capabilities.

Sun, 22 Dec 2024 00:00:00 +0000

We are excited to announce the latest updates to MISP with versions v2.5.3 and v2.4.201, which bring numerous enhancements, bug fixes, and security improvements to strengthen threat information sharing capabilities. As with any security release, we highly recommend that you update ASAP and inform your partners to do the same.

FlowIntel 1.3.1 released and MISP integration

Mon, 09 Dec 2024 00:00:00 +0000

FlowIntel 1.3.1 released and MISP integration

FlowIntel is a lightweight and flexible platform built to help teams manage their tasks and cases efficiently. It offers a range of features, from detailed documentation tools to integration with external platforms, ensuring that workflows remain seamless and adaptable to various needs.

MISP 2.4.200 and 2.5.2 released - Post Hack.lu/CTI-Summit release with many new features

Tue, 19 Nov 2024 00:00:00 +0000

The Hack.lu/CTI-Summit once again allowed us to get in touch with the community and sit down to talk about new features and issues to be implemented. As usual, it was a real pleasure to get that much concentrated feedback. In this release, we put a lot of effort trying to fix and create new content as much as possible based on the collected needs of the community.

MISP ioC retrosearch with misp42 Splunk app.

Tue, 22 Oct 2024 00:00:00 +0000

Introduction

Hi, in this blog post I am going to share how I have built a framework on Splunk to retrosearch on MISP indicators of compromise.

MISP 2.4.198 released with many bugs fixed, security fixes and improvements.

Tue, 17 Sep 2024 00:00:00 +0000

MISP v2.4.198 (2024-09-13)

Based on a set of fixes including a security fix, we are pleased to announce the immediate availability of MISP 2.4.198. You can find a list of the detailed changes along with new features further below. As with any security release, we highly encourage everyone to update their instance as soon as possible.

MISP 2.4.197 released with many bugs fixed, a security fix and improvements.

Mon, 02 Sep 2024 00:00:00 +0000

Release Notes - v2.4.197 (2024-09-02)

New Features

Config Option: Added a new configuration option user_org_uuid_in_response_header to include a response header with the requesting user’s organization UUID. [Jeroen Pinoy]
Build: Display required STIX dependencies versions during the build process. [Jakub Onderka]
Bookmark now supports comment.

Changes

Version: Version bump. [iglocska]
Warning List: Updated the warning list. [Alexandre Dulaunoy]
Taxonomies: Updated to the latest version. [Alexandre Dulaunoy]
MISP Galaxy: Updated to the latest version. [Alexandre Dulaunoy]
PyMISP: Version bump. [Raphaël Vinot]
Internal Logging: Added logging when an event will not be published. [Jakub Onderka]
Global Menu - Bookmarks: Added comment field as the dropdown element’s title in the global menu bookmark. [Sami Mokaddem]
Database Upgrade - Bookmarks: Upgraded the database to support bookmark comments. [Sami Mokaddem]
Bookmark View: Added a missing comma for the new comment function and added a field for comments in the bookmark view. [Jan Z.]
Bookmark Index: Added a field to display comments in the bookmarks index. [Jan Z.]
Bookmark Add/Edit: Added a field to add and edit comments for bookmarks. [Jan Z.]
MISP Object: Updated to the latest version. [Alexandre Dulaunoy]

Fixes

UI/Footer: Improved UI footer to avoid confusion for some users. [Alexandre Dulaunoy]
IOC Import: Added a check to ensure the provided XML is valid. [Jakub Onderka]
Schema: Updated schema version. [Jakub Onderka]
UI: Fixed tag popover to return already parsed data. [Jakub Onderka]
Bookmarks - Add: Lower-cased the comment field. [Sami Mokaddem]
Sightings: Correctly retrieve sightings per the requested event. [Tom King]
Bookmarks - Verbose Returns: Fixed an issue with overly verbose returns from bookmarks when shared with the organization. This fix was reported by Sharad Kumar Dahal of Green Tick Nepal Pvt. Ltd. [iglocska] This fixes a security issue recorded as CVE-2024-45509.
Feed: When pulling feeds, events are now checked against specified rules if any rules are provided. [Benni0]

Other

Merged pull requests addressing issues with unpublished events logging, tag popover parsing, sightings restSearch performance, and STIX dependencies version display. [Jakub Onderka, Andras Iklody, Andrew Hicks]
Fixed issues related to sightings restSearch negation of organization ID. [Andrew Hicks]

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

MISP 2.4.196 released with many bugs fixed and improvements.

Wed, 21 Aug 2024 00:00:00 +0000

MISP 2.4.196 released with many bugs fixed and improvements.

New Features

Decaying Model: Introduced a new DecayingModel that leverages true positive and false positive sightings for better decision-making. [Marcel Slotema]
Log Search Enhancement: Added an optional hh:mm:ss accuracy to log searches, allowing for more precise time-based queries. This update also includes significant refactoring to improve code quality. [iglocska]
User Log Review: Improved the functionality of the “review user logs” button. It now links directly to logs relevant to the specific user, considering the new audit log system. Future enhancements will include email-based log searches. [iglocska]

Changes

PyMISP Update: Updated PyMISP to the latest version. [Raphaël Vinot]
Decaying Model Formulas: Enhanced error handling by catching undefined indexes in decaying model formulas. [Sami Mokaddem]
Attributes Search: Added support for sorting by publish_timestamp and introduced the X-Skipped-Elements-Count header to improve pagination during REST searches. [Benni0]
Reverse Proxy Handling: Fixed issues with base URL handling for reverse proxies, eliminating problematic redirects. Special thanks to Mitch Germansky for the extensive debugging. [iglocska]
MISP Components Update: Updated MISP Object, Galaxy, and STIX components to their latest versions. [Alexandre Dulaunoy, Christian Studer]

Fixes

STIX 2 Import: Updated the STIX 2 parsers following recent changes in MISP-STIX. [Christian Studer]
Base URL Setting: Adjusted the priority order in beforeFilter to avoid redis errors during benchmarking. [iglocska]
Image Helper: Allowed for variable-width organization logos without overlapping text. [iglocska]
Workflow Module: Ensured correct type return if redis fails to load during workflow:getEnabledModules. [Sami Mokaddem]
Settings Management: Fixed multiple issues related to changing instance settings, including improvements to CLI checks. [iglocska]
Attribute Search Ordering: Reverted ID-based sliding window ordering due to performance concerns. [iglocska]

Other

Merged several development branches to integrate recent changes, updates, and fixes from various contributors. Notably, the branches related to attribute search order, skipped elements count, and environment dependencies were integrated into the main branch. [iglocska, Christian Studer, Sami Mokaddem, Alexandre Dulaunoy, Stefano Ortolani, Andras Iklody]

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

SkillAegis

Wed, 14 Aug 2024 00:00:00 +0000

Design and Execute Cyber Threat Intelligence Scenarios with SkillAegis

Practical experience is essential for skill development, and effective training must be both engaging and capable of identifying gaps in understanding. That’s why we’re pleased to launch version 1.0.0 of SkillAegis, your new training companion.

MISP 2.4.195 - hot summer olympic release

Fri, 09 Aug 2024 00:00:00 +0000

MISP 2.4.195 - hot summer olympic release

We are pleased to announce the immediate availability of MISP v2.4.195, a summer release aiming to introduce new features, fix a long list of reported bugs and deficiencies as well as give your servers a breather in the scorching summer heat by taking a load off your CPUs thanks to a set of impactful performance fixes.

Maltego Integration with MISP

Tue, 16 Jul 2024 00:00:00 +0000

Maltego Integration with MISP

Understanding How Maltego Integrates with MISP Data for Enhanced Cyber Threat Analysis

Introduction

Many organizations run MISP instances with other cybersecurity tools and OSINT for data-driven investigations. Investigators can integrate both internal and external data to map with MISP data in various ways. This blog details how to look up information directly in the MISP community using MISP Transforms on Maltego Graph, highlighting its seamless integration for efficient and comprehensive investigations.

Collaborative Threat Intelligence Sharing and Automated Information Exchange - Insights from the JTAN Project Experience

Mon, 01 Jul 2024 00:00:00 +0000

The JTAN (Joint Threat Analysis Network) Project, co-funded by the European Union’s CEF program, addresses the critical need for efficient and effective threat intelligence sharing among cybersecurity teams. As cyber threats grow in complexity and scale, the ability to quickly exchange and analyze threat data across organizations has become essential for maintaining robust security.

MISP 2.4.194 released with new functionalities and various bugs fixed

Fri, 21 Jun 2024 00:00:00 +0000

MISP 2.4.194 released with new functionalities and various bugs fixed.

Sorry, cannot display the video as the video tag is not supported by your browser.

New Features

Bookmark Functionality:
- Users can now create bookmarks.
- Bookmarks can be shared with all users in the same organization.
Heartbeat Endpoint:
- New /users/heartbeat endpoint.
- Accessible without authentication; returns a 200 response to indicate the instance is operational.
- Designed for quick checks to see if the instance is up and running.
Skip OTP Requirement:
- New role permission to exclude certain roles from OTP requirements.
- Useful for filtered, local service accounts.
Users API Update:
- Added a new boolean field indicating whether TOTP is set up for the user.
- Applicable to /users/view, /admin/users/view, /admin/users/index endpoints.

Changes

Various Version Bumps:
- Updates for misp-stix, schema, PyMISP, warning-lists, misp-galaxy, and misp-objects.
Bookmark Improvements:
- Added title documentation for the exposed_to_org field.
- Enhanced quick search support for bookmarks.
ACL and Schema Updates:
- Heartbeat added to the ACL component.
- Updates to schema and mysql.sql.

Fixes

Default Roles and Permissions:
- Added delegation permission for sync user and publisher roles.
- Readded default roles.
- Fixed issues with PyMISP tests, default roles, and various editor and ingestion bugs.
UI and Functional Fixes:
- Corrected event report markdown editor to display tags.
- Included user agent in feed ingestion to address issues with specific feeds.
- Fixed editing view for galaxycluster blocklist.
- Readded missing org logo in the decaying model.
- Corrected JSON response handling in the decaying tool.
- Fixed object reference links for proper view refocus.
- Corrected errors in the server edit view.
- Fixed typo in bookmark description.
- Adjusted default role settings in mysql.sql.
- Updated local flag in EventTags to be boolean.
- Corrected filenames in RHEL background worker migration guide.
- Improved performance by increasing chunk size for sighting sync.

For a complete list of updates, please refer to the changelog pages. Many thanks to all the diligent contributors that ensure that MISP keeps improving rapidly!

MISP 2.4.193 released with many bugs fixed, API improvements and security fixes

Fri, 07 Jun 2024 00:00:00 +0000

MISP 2.4.193 released with many bugs fixed, API improvements and security fixes

New

[attributes/enrich] endpoint added.
- Simply post a list of modules you wish to enrich the attribute by.
- URL: /attributes/enrich/[attribute_id|attribute_uuid]
- Post body format: {"dns": 1, "foo_bar_baz": 1} listing all modules to execute.
[misp-community] MISP-LEA information sharing community added.

MISP 2.4.192 released with many performance improvement, fixes and updates.

Tue, 07 May 2024 00:00:00 +0000

New Features

Security Enhancements:
- Ability to disable TOTP/HTOTP when linked to an identity provider with strong authentication.
- Introduced Fast API Authentication with temporary storage of hashed API keys in Redis to enhance endpoint performance.
Logging and Tracking:

MISP 2.4.190 (and 2.4.191) released with new feed improvement, workflows and a new benchmarking suite.

Mon, 22 Apr 2024 00:00:00 +0000

We are excited to announce the release of MISP v2.4.190. This latest version introduces a slew of new features, improvements, and fixes designed to streamline operations and enhance security measures for our users.

Using your MISP IoCs in Kunai (the open source EDR for Linux)

Fri, 19 Apr 2024 00:00:00 +0000

Using your MISP IoCs in Kunai

Kunai is an open-source security monitoring tool, specifically designed to address the threat-hunting and threat-detection problematic on Linux. It has been inspired by Microsoft Sysmon, to provide a Sysmon alike experience to the end user. However, it comes with some more advanced features such as fine grained event filtering, detection rules and IoC matching. In this blog post, we are going to introduce how to implement real time MISP IoC matching in a very short amount of time.

MISP 2.4.189 released with bug fixes, performance improvements and a new blocklist feature.

Fri, 12 Apr 2024 00:00:00 +0000

We are pleased to announce the immediate release of MISP 2.4.189, released with bug fixes, performance improvements and a new blocklist feature.

MISP - Elastic Stack - Docker Lab

Fri, 05 Apr 2024 00:00:00 +0000

MISP - Elastic Stack - Docker

This lab explains how to connect MISP to the Elastic Stack in order to leverage IOCs from MISP and trigger alerts based on user defined rules.

Partnership Collaboration between the MISP Project and the Yeti Platform

Thu, 28 Mar 2024 00:00:00 +0000

The MISP Project, renowned for its threat intelligence sharing platform, and Yeti Platform, the Forensics Intelligence platform supporting CTI and DFIR practitioners, are coming together to create a more robust and interconnected open source landscape.

MISP 2.4.188 released major performance improvements and many bugs fixed.

Mon, 25 Mar 2024 00:00:00 +0000

We are pleased to announce the immediate release of MISP 2.4.188, with major performance improvements and many bugs fixed.

New Features

Datasource Improvements:
- Updates to some datasources with the ignoreIndexHint parameter (mysqlExtended, mysqlObserverExtended).
- Fix for forceIndexHint.
Settings:
- Added setting to temporarily disable the loading of sightings via the API (affects restsearch and /events/view endpoints). This helps with performance issues caused by large sighting data sets.

Changes

PyMISP:
- Multiple version bumps.
Version and Internal Updates:
- General version bump.
- Improved error handling and marking BadRequestException as fail log in CI.
- Attempt to fix a failing test.
- Updated misp-galaxy, misp-object, and warning-lists.
Attribute Search Rework:
- Significant performance improvement when using MysqlExtended or MysqlObserverExtended data sources.
- Event level lookup moved to subqueries for faster queries.
- Ignoring the deleted index to improve speed.
OpenAPI Updates:
- Added content for analyst-data and event-reports.
Sighting Policy Support:
- Added support of sighting policy in sightings:getLastSighting.
Attribute Search Performance:
- Improved performance of includeDecayScore by a factor of 5.
Attribute Fetch Refactor:
- Simplified conditions and optimizations.

Fixes

Attribute Search:
- Enforced unpublishedprivate directive.
Internal Error Handling:
- Error handling improvements in AttachmentScan.
CurlClient HEAD Request:
- Added CURLOPT_NOBODY for HEAD requests.
CLI and ECS Updates:
- Fix for redisReady in dragonfly.
- Change type from Exception to Throwable in ECS.
OIDC:
- Default organization handling if not provided by OIDC.
Publishing and Sync Issues:
- Fix for publishing and sync errors.
Performance Improvements:
- Bulk loading of analyst data to speed up event loading.
UI Update:
- Added MISP.email_reply_to to server config.

Other

Multiple merges of branches and updates.
Fixes and changes in misp-stix, attachment scan error handling, OIDC default org handling, alert email titles, shadow attribute handling, and community additions (ICS-CSIRT.io).

Community and Contribution Updates

Additions and changes to the community, including the introduction of the ICS-CSIRT.io community.

Details changes are available in Changelog.

Poppy a new Bloom filter format and open source project

Mon, 25 Mar 2024 00:00:00 +0000

Poppy a new Bloom filter format and open source library

Introduction

At CIRCL we use regularly bloom filters for some of our use cases especially in digital forensic. Such as providing a small, fast and shareable caching mechanism for Hashlookup database which can be used by incident responders.

MISP 2.4.187 released with security fixes, new features and bugs fixes.

Sun, 24 Mar 2024 00:00:00 +0000

We are pleased to announce the immediate release of MISP 2.4.187, including security fixes, new features and bugs fixes.

New Features

CLI Enhancements:
- Added org list to shell commands.
- New command to change user role.
- Fixes to role management.
OIDC Update:
- New option OidcAuth.update_user_role to disable role changes from OIDC.

Changes

Version and Software Updates:
- Version bump.
- Updates to PyMISP, misp-galaxy, misp-warninglists, misp-objects, and taxonomies.
Internal Updates:
- Added ext-zstd to suggested PHP extensions.
- Fixed non-focusable relationship dropdown search field in analyst data.

Fixes

General Fixes:
- Corrected variable unset in events:restsearch to prevent attribute override.
- Ensured sync pulls continue after an event save failure.
- Database update fixes for older MySQL versions.
- Improved API consistency.
- Fixed pulling from remote servers when analyst data is not supported.
- Logging fix for removeTagFromObject().
- Security improvements for file and logo uploads. (Thanks to Rémi Matasse and Raphael Lob from Synacktiv for the report)
  - CVE-2024-29859 < MISP 2.4.187 - add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
  - CVE-2024-29858 < MISP 2.4.187 - __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
- Correct message display when disabling a galaxy.
CLI Updates:
- Added new functionalities including listing roles and creating users.

Details changes are available in Changelog.

Introducing Standalone Functionality to MISP Modules - A New Era of Flexibility and Efficiency

Tue, 12 Mar 2024 00:00:00 +0000

Introducing Standalone Functionality to MISP Modules: A New Era of Flexibility and Efficiency

In the ever-evolving landscape of information security, the need for adaptable and efficient tools has never been greater. The MISP project, known for facilitating the sharing of structured threat information, has taken a significant leap forward. We’re excited to announce a pivotal enhancement to the misp-modules, a collection of modules for MISP, extending their functionality to operate not only as an integral part of MISP but also as a standalone web application.

MISP 2.4.186 released with analyst data feature including analyst notes, opinions and relationships.

Wed, 06 Mar 2024 00:00:00 +0000

We are pleased to announce the immediate release of MISP 2.4.186, which includes two major new feature called “Analyst Data” and “Collections” along with an extension to the MISP standard format.

HarfangLab Use-Case with MISP

Mon, 26 Feb 2024 00:00:00 +0000

EDR Use-Cases with MISP

Historically, teams shared indicators of compromise (IOCs) via email in documents that were often difficult to analyze and challenging to automate for processing.

MISP 2.4.185 released with sighting performance improvements, security and bugs fixes

Tue, 20 Feb 2024 00:00:00 +0000

We are happy to announce the immediate availability of MISP 2.4.185. This is mainly a bug fix release resolving several issues as well as tightening the security posture of the org image handling.

MISP 2.4.184 released with performance improvements, security and bugs fixes.

Tue, 06 Feb 2024 00:00:00 +0000

MISP 2.4.184 released with performance improvements, security and bugs fixes.

Improvements

Speed up improvements in ssdeep correlation and many other parts of MISP. Thanks to Jakub Onderka for the work on this.
[objects] restsearch first/last seen filters added.
[event:publication] Added new setting to block event publication if the publishing user is the creator.
[events:export] Make setting MISP.disable_cached_exports enabled by default. Since the /events/export has been marked deprecated for a years, we are starting the process to phase it out by first disabling the endpoint by default. The MISP ReST search API is the API to be used in the future if you still have very old scripts relying on export. We recommend to start making plans to rework those scripts.
[organisation:orgMerge] Added missing models for organisation handover

Security fixes

A series of security fixes were done in this release, the vulnerabilities are accessible to authenticated users, especially those with specific privileges like Org admin. We urge users to update to this version especially if you have different organisations having access to your instances.

MISPbot

Sat, 20 Jan 2024 00:00:00 +0000

MISPbot

What is MISPbot?

The MISPbot is a simple tool to allow users to interact with MISP via Mastodon or Twitter.

Bridging the Gap: Introducing MISP Airgap for Secure Environments

Fri, 12 Jan 2024 00:00:00 +0000

Bridging the Gap: Introducing MISP Airgap for Secure Environments

In an era where cybersecurity threats are ever-evolving, the need for robust and secure information sharing platforms is paramount. Enter MISP (Threat Intelligence Sharing Platform), a renowned tool in the cybersecurity arsenal. But how do you deploy such a critical tool in the most secure environments, those that are air-gapped from the outside world? This is where the MISP airgap project comes into play.

MISP 2.4.183 released with new ECS log feature, improvements and bugs fixed

Tue, 09 Jan 2024 00:00:00 +0000

MISP 2.4.183 released with a new ECS log feature, improvements and bugs fixed.

MISP now supports Elastic Common Schema (ECS) security logging. A new option has been added Security.ecs_log to enable this new functionality. A new Security.alert_on_suspicious_logins to security audit has been added.
The sync configuration in MISP now supports sharing group blueprints for a simple creation of filter rules based on dynamically updated organisation lists.
Major improvement to STIX import handling and especially the misp-stix library such as Parsing PE binary extensions within File observable objects and many more improvements/fixes.
API add tag functions updated to also work with uuids, rather than just local IDs.
[event:view] Added option to mass local cluster tag.

Many bugs fixed and minor improvements. Feel free to read the detailed changelog

Using Zeek's new JavaScript support for MISP integration

Wed, 03 Jan 2024 00:00:00 +0000

Using Zeek’s new JavaScript support for MISP integration

With Zeek 6.0, experimental JavaScript support was added to Zeek, making Node.js and its vast ecosystem available to Zeek script developers to more easily integrate with external systems.

MISP 2.4.182 released with new features, improvements bugs fixed and an important security fix.

Fri, 22 Dec 2023 00:00:00 +0000

MISP 2.4.182 released with new features, improvements bugs fixed and an important security fix.

MISP Core

New Features

[event:view] Added new option show_server_correlations_for_all_users allowing non-privileged users to view server correlations. [Sami Mokaddem]

Changes

[Version] bump. [iglocska]

MISP 2.4.181 hot fix release to disable by default the alert on suspicious login plus some minor fixes.

Thu, 21 Dec 2023 00:00:00 +0000

Changes

[tools:misp-delegation] Do not use self-documented expression in f-string anymore. [Sami Mokaddem]
[version] bump. [iglocska]
[warning-lists] updated to the latest version. [Alexandre Dulaunoy]
[misp-galaxy] updated to the latest version. [Alexandre Dulaunoy]
[tests] search for errors in logs. [Christophe Vandeplas]
[warning-lists] updated to the latest version. [Alexandre Dulaunoy]
[misp-galaxy] updated to the latest version. [Alexandre Dulaunoy]

Fix

[Alert on suspicious logins] disabled by default. [iglocska]
- requires logs table to be better indexed currently to not be a bottleneck (user_id and action fields)
- Will be made default in an upcoming version once the performance issues are resolved
[tests] fix path in logs_tests.sh. [Christophe Vandeplas]
[tests] fixes path of logs_tests. [Christophe Vandeplas]
[userloginprofiles] undefined variable #9424. [Christophe Vandeplas]
[customauth] missing Class init fixes #9425. [Christophe Vandeplas]

MISP 2.4.180 released with a new security user login profile feature, bugs fixed and many improvements.

Wed, 20 Dec 2023 00:00:00 +0000

MISP 2.4.180 released with a new security user login profile feature, bugs fixed and many improvements.

New

[api] added X-MISP-AUTH as an alternative header to Authorization, fixes #9418. [iglocska]

Changes

[VERSION] bump. [iglocska]
[workflows] restored 7.2 and 7.3. [iglocska]
[user login profile] old version compatibility. [iglocska]
[event index] hover over ID will show the info field, generally more useful than the threat level. [iglocska]

Fix

[login] fixes bad fix and catches first login after update. [Christophe Vandeplas]
[revert] dumb check. [iglocska]
[compatibility] make the ancient gods happy. [iglocska]
[user login profile] skip checks for ancient php versions. [iglocska]
[Attribute:EditPostProcessing] Make sure the ID is set. [Sami Mokaddem]
[attribute:editPostProcessing] Fixed typo in condition preventing tags to be detached. [Sami Mokaddem]
[attributes] type field added to editable fields. [iglocska]
[RPZ] export custom parameters ingored, fixes #9420. [iglocska]
[Attribute:editPostProcessing] Fixed sighting capture. [Sami Mokaddem]
[Attribute:EditPostProcessing] Make sure the ID is set. [Sami Mokaddem]
[attribute:validation] Typo in function name. [Sami Mokaddem]
[attribute:editPostProcessing] Fixed typo in condition preventing tags to be detached. [Sami Mokaddem]

Other

Merge remote-tracking branch ‘origin/develop’ into 2.4. [Christophe Vandeplas]

Current state of the MISP playbooks

Fri, 08 Dec 2023 00:00:00 +0000

Current state of the MISP playbooks

The MISP playbooks at https://github.com/MISP/misp-playbooks address common use-cases encountered by SOCs, CSIRTs or CTI teams to detect, react and analyse intelligence received by MISP. The project started early 2023 and as we’re now ending the year it’s time to look back at its current state and get an early glimpse of the future features.

MISP 2.4.179 released with a host of improvements a security fix and some new tooling.

Sun, 26 Nov 2023 00:00:00 +0000

MISP 2.4.179 released with a host of improvements a security fix and some new tooling.

First baby steps taken towards LLM integration

We currently included our first attempt at an LLM integration for report summarisation and extraction. The development is an outcome of our work with @aaronkaplan during hack.lu 2024 and relies on stochasticCTIExtractor for the extraction and interfacing with LLMs.

MISP 2.4.178 released with many workflow improvements, enhancement and bugs fixed.

Mon, 30 Oct 2023 00:00:00 +0000

MISP 2.4.178 released with many workflow improvements, enhancement and bugs fixed.

Improvements

[workflow] Added option to provide a custom JSON in the hashpath picker helper.
[workflow] New action modules (blocklist, warninglist, counter…) to add event in the blocklist.
[workflow] New trigger event before save.
[workflow] Various improvements in the quick hashpath filter.
[workflow] Improved webhook to support HTTP request method, headers, payload. It also now supports self-signed certificates.
[workflow] Many improvements in debugging and workflow logging.
[RestClient/OpenAPI] totp_delete added in query builder and API documentation.
[STIX upload] Improved in the galaxies handling including more detailed option while importing STIX 2 and creating galaxies/clusters.

Changes

[dashboard-widget:worldmap] Added support of custom scale in widget config.
[API even:restSearch] Added support of orgc_id as valid filter.
[Auditing] API access time is now stored once per hour by default.
[API] includeGranularCorrelations is now exposed in the event RestSearch.

Fixes

[API] Add sharinggroup as an allowed parameter in attribute search.
[objects:edit] Restored behavior of upgrading object to newer template.
Many other fixes check the ChangeLog for detailed changes.

Other improvements

MISP Objects

New objects added such as cryptocurrency-transaction and many updates to other objects. For detailed changes, MISP objects changelog.

MISP Galaxy

Many new objects such as ammunition, firearms and many updates in threat actor, Sigma and many other. For detailed changes, MISP galaxy changelog

MISP warning-lists

Warning-lists updated to the latest version. New warning list with known hostname for lookup source IP of the DNS resolver. MISP warning-lists changelog.

Don’t forget to follow us on Mastodon

The MISP projet has its own Mastodon server misp-community.org - don’t forget to follow @misp@misp-community.org on the fediverse. Core contributors of MISP can sign-up if they wish to have an account.

MISP 2.4.177 released with various improvements and bugs fixed.

Wed, 27 Sep 2023 00:00:00 +0000

MISP 2.4.177 released with various bugs fixed and improvements.

Improvements

[dev] added a shell script to generate the restsearch parameters.
[CLI] add command to expire active AuthKeys that do not have an IP allowlist set.
[cli] Add command to trigger password change on next login for users with old pw.
[Users] add last password change timestamp for users.
[workflowModules:event_distribution_operation] Added action module.

Changes

[tests] testing disabling the timestamp greater as old timestamp for password changes.

MISP 2.4.176 released with various improvements and bugs fixed.

Fri, 15 Sep 2023 00:00:00 +0000

MISP 2.4.176 released with various improvements and bugs fixed. This version also includes major improvements in the misp-stix library especially on the storing relationships and the description of relationships in the MISP standard format.

MISP to Microsoft Sentinel integration with Upload Indicators API

Sat, 26 Aug 2023 00:00:00 +0000

MISP to Microsoft Sentinel integration

Introduction

The MISP to Microsoft Sentinel integration allows you to upload indicators from MISP to Microsoft Sentinel. It relies on PyMISP to get indicators from MISP and an Azure App to connect to Sentinel.

MISP 2.4.175 released with various bugs fixed, improvements and security fixes.

Thu, 24 Aug 2023 00:00:00 +0000

MISP 2.4.175 released with various bugs fixed, improvements and security fixes.

Improvements

Added support of start_date and end_date options in the MISP dashboard widgets.
In the user periodic reporting, allow users to set the number of days to include in the reporting (UI).
In the MISP dashboard org Widget, added support for first_half_year and second_half_year timeframe.
New enrich object functionality added, in order to allow for the enrichment of a complete MISP object. Used by the SigMF module but this can be used with any expansion modules supporting objects.
New feeds added.
Improve the diagnostics when an instance does not have internet access or does not use the self-update feature

Bugs fixed

Update the CA bundle of the CakePHP submodule maintained by the MISP project.
IndexFilter: correct index page filtering is now fixed for ReST requets.
Prevent push_rules from being required in API requests to the /server/edit endpoint.
The annoying MISP event import bug from JSON has been fixed, you can now import MISP JSON events without the Event key.
Various fixes in the MISP dashboard interface.
Fix

Security fixes

CVE-2023-40224 <= MISP 2.4.174 - allows XSS in app/View/Events/index.ctp. (reported by BeDisruptive OSS Team)
CVE-2023-41098 <= MISP 2.4.174 - In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.

Thanks to BeDisruptive OSS Team and Centre for Cyber Security Belgium (CCB) for the reporting.

MISP now supports Signal Metadata Format Specification SigMF

Wed, 23 Aug 2023 00:00:00 +0000

As one of the outcomes of GeekWeek8, MISP now supports a new set of features useful for handling radio frequency information in the Signal Metadata Format Specification) (SigMF), commonly used in Software Defined Radio (SDR), digital signal processing and data analysis applications.

MISP 2.4.174 released with major workflow enhancements, new features and fixes

Mon, 31 Jul 2023 00:00:00 +0000

We are thrilled to announce the immediate availability of MISP v2.4.174 with significant workflow improvements, accompanied by a host of quality-of-life enhancements and bug fixes.

MISP 2.4.173 released with various bugfixes and improvements

Tue, 11 Jul 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.173 with a new password reset feature, along with a host of quality of life improvements and fixes.

MISP 2.4.172 released with new TOTP/HTOP authentication, many improvements and bugs fixed

Tue, 13 Jun 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.172 with new TOTP/HTOP authentication, many improvements and bugs fixed.

Time-based and Single Use One-time password support (TOTP / HOTP)

New TOTP support are now included in MISP. This functionality works in two modes:

MISP 2.4.171 released with a long list of fixes, a dashboard rework, STIX 2.1 improvements and more

Thu, 18 May 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.171 with a long list of fixes, major STIX 2 improvements and an overhaul over the dashboard widget toolkit.

How to push to a TAXII server from MISP

Sat, 29 Apr 2023 00:00:00 +0000

If you want to push data from your MISP instance to a TAXII server, there are a few steps you need to follow. Firstly, you’ll need to ensure that your MISP instance is configured to export data in a format that the TAXII server can accept. This typically involves converting the data to STIX 2.x format by using the builtin misp-stix converter. Next, you’ll need to establish a connection between your MISP instance and the TAXII server by configuring the appropriate API and collection endpoints in the MISP sync action. Once this is done, you can initiate the data transfer from your MISP instance to the TAXII server by pushing the searched data to the designated API and collection.

MISP 2.4.170 released with new features, workflow improvements and bugs fixed

Thu, 13 Apr 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.170 with new features, workflow improvements and bugs fixed.

It includes many improvement release of misp-stix, the core Python library for importing and exporting STIX (1, 2.0 and 2.1).

MISP to Azure Sentinel integration

Mon, 03 Apr 2023 00:00:00 +0000

MISP to Azure Sentinel integration

Introduction

The MISP to Azure / Sentinel integration allows you to upload indicators from MISP to Microsoft Sentinel. It relies on PyMISP to get indicators from MISP and an Azure App and Threat Intelligence Data Connector in Azure.

MISP 2.4.169 released with various improvements and bug fixes.

Tue, 14 Mar 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.169 with various improvements and bug fixes.

It includes many improvement release of misp-stix, the core Python library for importing and exporting STIX (1, 2.0 and 2.1).

MISP and fail2ban

Thu, 23 Feb 2023 00:00:00 +0000

fail2ban - MISP

fail2ban is known to do a great job at giving attackers a hard time when they try to “test” passwords or enumerate users of a service. fail2ban constantly analyses relevant log files and keeps track of IP addresses trying to log into such services. If a configurable threshold is reached, it uses the Linux firewall (Netfilter / iptables) to block the suspected attackers.

Critical SQL injection vulnerabilities in MISP (fixed in v2.4.166 and v2.4.167)

Mon, 20 Feb 2023 00:00:00 +0000

Critical SQL injection vulnerabilities in MISP (fixed in v2.4.166 and v2.4.167)

Introduction

As of the past 2 months, we’ve received two separate reports of two unrelated SQLi vector vulnerabilities in MISP that can lead to any authenticated user being able to execute arbitrary SQL queries in MISP.

MISP 2.4.168 released with bugs fixed, security fixes and major improvements in STIX support.

Thu, 16 Feb 2023 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.168 with bugs fixed and various security fixes.

It includes a rather substantial release of misp-stix, the core Python library for importing and exporting STIX (1, 2.0 and 2.1).

MISP 2.4.167 released with many improvements, bugs fixed and security fixes.

Mon, 26 Dec 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.167 with new features and fixes, bugs fixed and a security fix.

Training Video - MISP Best Practices for Encoding Threat Intelligence

Thu, 15 Dec 2022 00:00:00 +0000

MISP Training Video December Edition - Best Practices for Encoding Threat Intelligence and Leveraging the information in MISP to Make Threat Landscape Report

Content of Training Session

MISP data model introduction
Best practices - from evidences to actionable evidences
Leveraging the information in MISP to Make Threat Landscape Report

Jupyter notebook used during the training session.

Training Video - MISP Workflow

Thu, 15 Dec 2022 00:00:00 +0000

MISP Training Video December Edition - Workflow

MISP has been a widely used open source CTI platform for the past decade, with a long list of tools that allow users to customise the data models and contextualisation of the platform, yet true customisation of the actual workflows and processes had to be done externally using custom scripts.

MISP 2.4.166 released with many improvements, bugs fixed and security fixes.

Wed, 30 Nov 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.166 with new features and fixes, including two critical security fixes.

MISP 2.4.165 released with many improvements, bugs fixed and security fixes.

Mon, 21 Nov 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.165 with many improvements to the workflow subsystem along with various performance improvements.

Curate events with an organisation confidence level

Mon, 14 Nov 2022 00:00:00 +0000

Quality of threat intelligence

When you receive threat intelligence from different sources you quickly realise there is a big difference in the quality of the received information. Where some organisations go to great length to ensure their events are accurate, complete and contextualised, other organisations use different standards. Some of these differences are caused by particular use cases but can also be caused by human errors or maturity growing pains. Regardless of what’s causing these differences, as a consumer, it costs time to wade through events and manually curate them.

SACTI - Secure aggregation of cyber threat intelligence

Thu, 27 Oct 2022 00:00:00 +0000

SACTI: Secure aggregation of cyber threat intelligence

Overview

Communities can share cyber threat intelligence on platforms, such as MISP. In the H2020 project Prometheus TNO has developed a way to securely aggregate cyber threat intelligence and publish the result on MISP.

MISP 2.4.164 released with new tag relationship feature, improvements and a security fix

Mon, 10 Oct 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.164 with a new tag relationship features, many improvements and a security fix.

MISP 2.4.163 released with improved periodic notification system and many improvements

Mon, 26 Sep 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.163 with an updated periodic notification system and many improvements.

Updated periodic notification system

A new option has been added to set the number of days for the trending calculation.
New correlation are now showed in the periodic notification.
Only the top 10 MITRE ATT&CK techniques are displayed and sorted by number of occurrences.
Layout has been improved in the UI and also in the static email rendering.
Only show data in the chart for tags having changes over time.

For more information, check out the Periodic summaries - Visualize summaries of MISP data blog.

MISP 2.4.162 released with a new periodic notification system, workflow updates and many improvements

Tue, 13 Sep 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.162 with a new periodic notification system, workflow updates and many improvements.

MISP Guard

Tue, 13 Sep 2022 00:00:00 +0000

Let’s say that by no means should an attribute of type passport-number leave your MISP instance. Aside from the analyst following best practices when encoding the data, MISP does not have a built-in mechanism to prevent these leaks to happen, but now you can achieve this by using a third-party tool called misp-guard.

Periodic summaries - Visualize summaries of MISP data

Mon, 12 Sep 2022 00:00:00 +0000

Periodic summaries - Visualize summaries of MISP data

As of version 2.4.162, MISP includes a periodic summary feature allowing users to consult a summary based on a requested time-frame for data the user has access to.

MISP 2.4.161 released with small improvements and bugs fixed

Thu, 11 Aug 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.161.

Small improvements

A new option added to log the last API request of an API key. (Thanks to Tom King for the contribution)
Overcorrelation features have some new improvements such as:
- A new tool to generate occurrence counts (real numbers this time)
- A hook to truncate the over-correlating value table on recorrelation
- We no longer store the partial counts as occurrences when generating correlations
Performance improvements in event fetching
Various performance tuning in the new correlation engine including the full recorrelation

Bugs fixed

tlp:amber+strict and tlp:clear are now valid tags
[stix2 import] Better external_references parsing for attack patterns objects

Thanks to all the contributors and users reporting bugs to make the software better.

MISP 2.4.160 released with new workflow feature, new correlation engines and many major improvements

Mon, 08 Aug 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.160. With the August summer-holiday season kicking into high gear, we have a very special release for you all, containing a long list of major new features, improvements and general quality of life improvements.

MISP web scraper

Mon, 08 Aug 2022 00:00:00 +0000

MISP web scraper

There are a lot of websites that regularly publish reports on new threats, campaigns or actors with useful indicators, references and context information. Unfortunately only a few publish information in an easily accessible and structured format, such as a MISP-feed. As a result, we often find ourself manually scraping these sites, and then copy-pasting this information in new MISP events. These tedious tasks are time-consuming and certainly not the most interesting aspect of CTI-work.

MISP 2.4.159 released with many improvements including performance

Mon, 30 May 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.159. This releases includes many improvements, bug fixes and improvements concerning performance on large datasets.

MISP 2.4.158 security fix and general improvement release

Wed, 20 Apr 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.158. This release includes a series of security fixes and as such we highly encourage everyone to update to this version as soon as possible.

MISP 2.4.157 released including some usability fixes following the large changes of 2.4.156 along with some improvements

Fri, 25 Mar 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.157, following a series of bug fixes as a quick follow up to 2.4.156.

MISP 2.4.156 released including a new synchronisation event signing mechanism and many new features

Fri, 18 Mar 2022 00:00:00 +0000

We are pleased to announce the immediate availability of MISP v2.4.156 - a release bringing several new features and fixes two critical vulnerabilities. We highly encourage everyone to update to this version as soon as possible.

MISP 2.4.155 - quick bugfix release

Thu, 03 Mar 2022 00:00:00 +0000

This release is a rapid follow up to v2.4.154, addressing several rather annoying issues

Bugfixes

Various bugfixes to the sharing group blueprint system (especially to it being more restrictive than intended)
Updating the DB schema to avoid the diagnostics complaining
Fixed an issue with organisation meta fields defaulting to null rather than ’’ (causing the blueprint issue mentioned above)
Rework of the DB schema dumper
Fixes to the Kali Linux installer

Acknowledgement

We would like to thank all the contributors, reporters and users who have helped us in the past months to improve MISP and information sharing at large. This release includes multiple updates in misp-objects, misp-taxonomies and misp-galaxy.

MISP 2.4.154 released including tools for managing rapidly changing communities

Wed, 02 Mar 2022 00:00:00 +0000

MISP 2.4.154 released with a host of new features and fixes, including some new tools that help us navigate the current geo-political landscape when sharing information.

MISP 2.4.153 released with improvements and bugs fixes

Fri, 04 Feb 2022 00:00:00 +0000

MISP 2.4.153 released

MISP UI translation in Thai added.
Improved the debugging of the synchronisation, including more meaningful messages in debug logs.
Significant improvements in the misp-stix library, to support additional import coverage of files along with improvements to the STIX export.
Improved debugging in the TLS handshake for synchronisation.
Additional CLI tests for security.
Markdown-IT library updated to the latest version, including security fixes to version 12.3.2.
Improvements in the various MISP install scripts.

Many internal improvements and bug fixes.

MISP 2.4.152 released with timeline improvements, optional filtering on sync, LinOTP improvements and more.

Wed, 22 Dec 2021 00:00:00 +0000

MISP 2.4.152 released

MISP 2.4.152 released with timeline improvements, optional filtering on sync, LinOTP improvements and more.

The LinOTP authentication module has been improved to include a mixed mode where both OTP and MISP’s usual password authentication can be used together.

MISP 2.4.151 released (Black friday threat intel rush release)

Tue, 23 Nov 2021 00:00:00 +0000

MISP 2.4.151 released

MISP 2.4.151 released including a host of bug fixes and a bunch of new features

New features

New background processor by @righel
Improvements to the CLI tools
Bug fixes and improvements

New background processor

MISP has been using CakeResque for its background jobs for the better part of a decade. Whilst it has served us well, the library has been stale for a long time and carries a (for us) unnecessary complexity and is generally the most difficult part of the application to debug
Luciano “@righel” Righetti has implemented a completely new, compatible background processing engine using Supervisord
Queue and execute jobs the same way as you are used to from before, monitor worker progress via the tools provided by supervisord in addition to MISP
No scheduling capabilities, these were an unnecessary overhead for us before as we relied on corn jobs as our preferred scheduling mechanism anyway
Expect more improvements to this library over the course of the next months, but feel free to switch to using it already now
Currently it is completely optional and the old background processor will still be supported for a while
Be aware that manual setup steps are required to get the new processor working, refer to the upgrade guide on the procedure, if you decide to start using it already now

Various CLI changes

Jakub Onderka has been doing a fair bit of refactoring and improvement of the CLI libraries
additional administrative tools added to help monitor and manage your MISP instance (such as redis memory diagnostics, mysql table optimisation tool, etc)

Option to move the system settings to the database

Traditionally all system config settings were stored in the config.php file, with a new configuration thanks to Jakub Onderka’s implementation the settings can be moved to the database rather than the file.
This should help with persistence for containerised installations

Various improvements

The previous version introduced a new STIX library as a replacement for the old one. This change did end up causing some update issues for some installations, the built in updater is now aware of this change and should allow you to easily update via the UI/API updater, with the new STIX library working as intended
A long list of improvements, thanks to all contributors! For a detailed list of changes, head over to the changelog

MISP Modules

New Passive SSH expansion expansion module.
Updated Recorded Future expansion module included links and related data.
New CIRCL hashlookup expansion module added.

The MISP modules changelog is available.

MISP 2.4.150 released (The "Bloody PKI again" hotfix release)

Tue, 12 Oct 2021 00:00:00 +0000

MISP 2.4.150 released

MISP 2.4.150 released, including a new CA bundle to combat the issues with the Letsencrypt root CA expiration. This is a follow-up release to 2.4.149 and has no other major changes besides pointing to our own repository of the framework that includes the new CA bundle.

MISP 2.4.149 released (Autumn care-package - STIX 2.1 support and Cerebrate integration)

Mon, 11 Oct 2021 00:00:00 +0000

MISP 2.4.149 released

MISP 2.4.149 released including many bugs fixed along with some new and improved functionalities

New features

First stage of a massive rework of our STIX integration
Various improvements to the integration with Cerebrate

New STIX libraries

The first version of a long ongoing project to rework our entire STIX integration has finally been merged, thanks to the tireless work of @chrisr3d
Our converter libraries have embarked on a path of their own, becoming a standalone repository included by default in MISP, but also serving as a useful tool for anyone looking for a clean way of converting between the MISP standard format and various STIX versions (1.1.1, 1.2, 2.0, 2.1).
The libraries are still work in progress, but continuously improved, follow misp-stix
Included is also a detailed documentation, which also serves as a knowledge base for the mapping between the two formats, available under the documentation sub-directory
From this release on, you have more control over which STIX version is used when exporting STIX data from MISP, by specifying the “stix_version” to be returned (supported versions for STIX 1: 1.1.1 and 1.2. For STIX 2: 2.0 and 2.1)

Cerebrate integration

Allow the fetching of sharing group data from Cerebrate instances, our new open source tool in development aiming to solve a host of issues revolving around community management and orchestration. Our first official release of the tool is scheduled for the MISP summit coming up this month
To follow the cerebrate project, head over to its github page
For the MISP summit to be held on the 21st of October, don’t forget to watch the misp-summit. You can still apply for the Call-for-Presentation.

mail2misp release 1.0

First official release 1.0 of mail2misp, it’s a tool to connect your mail infrastructure to MISP to create events based on the information contained within mail. The solution can be also used to feed MISP instance with honeypot receiving emails.

MISP 2.4.148 released (summer time release)

Mon, 09 Aug 2021 00:00:00 +0000

MISP 2.4.148 released

MISP 2.4.148 released including many bugs fixed along with security fixes. This release fixes CVE-2021-37742 and CVE-2021-37743.

New feature

added option to block organisation changes at login on ApacheShibbAuth
Open data export has been refactored
Fix Suricata export concerning sticky buffers
ZMQ now includes misp_json_warninglist topic in the pub-sub channels

Acknowledgement

MISP 2.4.147 released (improvements and bug fixes release)

Tue, 27 Jul 2021 00:00:00 +0000

MISP 2.4.147 released

MISP 2.4.147 released including a massive number of small improvements, bug and security fixes. We strongly recommend all MISP users to upgrade as soon as possible. This release fixes CVE-2021-37534.

MISP 2.4.145 and 2.4.146 released (Improved warning-lists)

Mon, 05 Jul 2021 00:00:00 +0000

MISP 2.4.145 and 2.4.146 released

MISP 2.4.145 and 2.4.146 released including a massive update to the MISP warning-lists, various improvements and security fixes.

MISP 2.4.144 released (Document all the things!)

Mon, 07 Jun 2021 00:00:00 +0000

MISP 2.4.144 released

MISP 2.4.144 released including a massive update to the documentation along with CyCAT.org integration, improvements and fixes including security related fixes.

MISP 2.4.143 released (10 year anniversary edition)

Sat, 15 May 2021 00:00:00 +0000

MISP 2.4.143 released

MISP 2.4.143 released including a new audit subsystem, various quality of life improvements and bug fixes.

10 year anniversary

MISP has, as of the 15th of May, turned 10, to celebrate the occasion we have a celebratory MISP logo acting as a temporary replacement of the usual one for the duration of this release.

MISP 2.4.142 released (with new correlation features, UI sync functionality improved and new dashboard widgets)

Tue, 27 Apr 2021 00:00:00 +0000

MISP 2.4.142 released

MISP 2.4.142 released including many new features, a security fix and a long list of quality of life improvements.

MISP 2.4.141 released (Many improvements from email notification, UI, API and installation scripts)

Mon, 29 Mar 2021 00:00:00 +0000

MISP 2.4.141 released

MISP 2.4.141 released including many improvements from email notification, UI, API and installation scripts.

User-Interface

[UI] Render galaxy cluster description as markdown.
[UI] Show threat level icons on event index.
[eventgraph:viewPicture] Allow access to saved picture from the eventgraph history.
[eventGraph] Improved object coloring strategy.
[UI] fix debugon for debug = 1. fix #7131.
[UI] Show number of items in freetext feed.
[UI] Make feed event preview nicer.
[UI] It is 2021! Removed -moz and -webkit specific CSS properties.
[UI] Make some parts of MISP nicer.
[UI] Nicer pivots.
[UI] Simplify keyboard-shortcuts.js.
[UI] Use Page Visibility API.

and many more updates check the changelog for details.

Creating a MISP Object, 101

Wed, 17 Mar 2021 00:00:00 +0000

MISP Objects

MISP objects are containers around contextually linked attributes. They support analysts in grouping related attributes and describing the relations that exist between the data points in a threat event. Combining these objects and relations is something that can then be used to represent the story of what is being told in the threat event.

MISP 2.4.140 released (OpenID support, cross object references in extended events and many improvements)

Wed, 10 Mar 2021 00:00:00 +0000

MISP 2.4.140 released

We have released 2.4.140, the latest release for MISP, introducing a host of new features, including integrations with various authentication systems, various improvements to the handling of objects, CLI improvements as well as a package containing general bug fixes, along with the usual update of the JSON libraries.

MISP 2.4.139 released (Quality of life and bugfix release)

Tue, 16 Feb 2021 00:00:00 +0000

MISP 2.4.139 released

We have released 2.4.139, the latest release for MISP squashes a set of pretty annoying bugs, whilst also adding some shiny new features to play with, along with the usual update of the JSON libraries.

MISP 2.4.138 released (Many improvements including CISA.gov AIS dynamic marking functionality, RSIT galaxy added)

Wed, 10 Feb 2021 00:00:00 +0000

MISP 2.4.138 released

We have released 2.4.138, the latest release for MISP along with an update of the JSON libraries.

MISP 2.4.137 released (New exclusion module for the correlation engine, many improvements and security vulnerabilities resolved)

Wed, 20 Jan 2021 00:00:00 +0000

MISP 2.4.137 released

We have released 2.4.137, a security and bug fix release including a collection of fixes and improvements collected over the past month.

MISP 2.4.136 released (Cerebrate project integration)

Mon, 18 Jan 2021 00:00:00 +0000

MISP 2.4.136 released

Though we’re rather late with the release notes, we did have some goodies to share for the winter festivities, bundled neatly into the 2.4.136 release.

MISP 2.4.135 released (galaxy 2.0)

Wed, 16 Dec 2020 00:00:00 +0000

MISP 2.4.135 released

Don’t let the minor version number change fool you, this release is a game changer for MISP and information sharing in general. Galaxy 2.0 brings about the ability to customise Galaxy clusters (threat-actors, @MITREattack or any knowledge base element) as well as to extend and share it within your community. This release also includes many new improvements such as a new authkey system to better handle your API keys in MISP.

MISP 2.4.134 released (new import extractor for the event report, various improvements and fixes)

Tue, 10 Nov 2020 00:00:00 +0000

MISP 2.4.134 released

In the previous version of MISP, the new Event Report functionality has been introduced to edit, visualise and share reports in Markdown format, which includes the ability to reference elements from within a MISP event.

MISP 2.4.133 released (major improvements such as the markdown report feature and many UI improvements)

Fri, 16 Oct 2020 00:00:00 +0000

MISP 2.4.133 released with major improvements such as the markdown report feature and many UI improvements.

Unstructured/semi-structured report feature

MISP is widely known as a powerful tool to gather, correlate and share information. As a response to the growing information-sharing maturity of the community, more features have been introduced over the past few years to meet analyst skills and requirements.

Event Report - A convenient mechanism to edit, visualize and share reports

Thu, 08 Oct 2020 00:00:00 +0000

Create an import script for MISP , step-by-step tutorial

Wed, 30 Sep 2020 00:00:00 +0000

Create an import script for MISP in Python, step-by-step tutorial

Script description

Example add_github_user.py

Here the goal is to push to MISP information gathered on Github. The script add_github_user.py will be used as an example.

MISP 2.4.132 released (security fix CVE-2020-25766 and bugs fixed)

Mon, 21 Sep 2020 00:00:00 +0000

MISP 2.4.132 released

A new version of MISP (2.4.132) has been released with several bugs fixed including an important security fix CVE-2020-25766.

MISP 2.4.131 released (improvements, bug fixes and major update to JavaScript dependencies)

Tue, 08 Sep 2020 00:00:00 +0000

MISP 2.4.131 released

A new version of MISP (2.4.131) has been released with improvements, bug fixes and a major update to JavaScript libraries.

MISP service monitoring with Cacti

Sat, 22 Aug 2020 00:00:00 +0000

MISP service monitoring with Cacti

Introduction

A previous post covered how to do MISP service monitoring with OpenNSM. Because having different options is good, this post covers how to achieve similar results with Cacti. For those not familiar with Cacti: it is a network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality.

MISP 2.4.130 released (Various fixes, performance improvements and new features)

Fri, 21 Aug 2020 00:00:00 +0000

MISP 2.4.130 released

A new version of MISP (2.4.130) has been released with performance improvements, multiple bugs fixed and new features.

MISP service monitoring (and a bit of healing) with OpenNMS

Tue, 18 Aug 2020 00:00:00 +0000

MISP service monitoring (and a bit of healing) with OpenNMS

Introduction:

Many organisations adore how quick and easy MISP can be set up. Once it’s running, people start integrating it into their processes and begin to rely on it, for instance by exporting indicators and using them in security or network focused software. Usually this is the time when MISP becomes a fundamental part in the portfolio of fighting attacks, and the need for reliability grows rapidly.

Creating a MISP Galaxy, 101

Fri, 31 Jul 2020 00:00:00 +0000

MISP Galaxies

MISP Galaxies and Clusters are an easy way to add context to data. Compared to the relatively simple concept of tags and taxonomies, they allow you to add more complex data structures. There is already a large list of galaxies and clusters available as a community effort, and directly accessible within MISP, but it’s always possible these do not fully address your needs.

Publishing open data from MISP

Thu, 30 Jul 2020 00:00:00 +0000

Publish data on Open data portals with MISP

The Open data format

Open data defines the idea of making some data freely available for everyone to use with a possibility of redistribution in any form. The open data format provides metadata information describing the datasets along with resources stored within the portal.

MISP 2.4.129 released (merge event improved, event block rule system, security fixes and many bugs fixed)

Tue, 28 Jul 2020 00:00:00 +0000

MISP 2.4.129 released

A new version of MISP (2.4.129) has been released with an improved merge functionality, a new event block rule system, many security fixes and bugs fixed.

MISP 2.4.128 released (STIX import/export refactored release edition)

Wed, 24 Jun 2020 00:00:00 +0000

MISP 2.4.128 released

A new version of MISP (2.4.128) has been released with a significant refactoring of the STIX import/export along with many improvements and bugs fixed.

MISP 2.4.127 released (decay updates release edition)

Fri, 19 Jun 2020 00:00:00 +0000

MISP 2.4.127 released

A new version of MISP (2.4.127) has been released with an improved version of attributes decaying, new set of widgets, many improvements and bugs fixed.

MISP 2.4.126 released (Spring release edition)

Thu, 04 Jun 2020 00:00:00 +0000

MISP 2.4.126 released

A new version of MISP (2.4.126) has been released a while ago, though we have forgotten to publish a blog post about it - thanks to @coolacid for the reminder. This version includes a security fix and various quality of life improvements.

MISP 2.4.125 released (aka self-registration feature and feed improvements release)

Wed, 06 May 2020 00:00:00 +0000

MISP 2.4.125 released

A new version of MISP (2.4.125) has been released. This version includes various improvements including a major refactoring of the feed system, the addition of OTP, a new inbox system to allow for self-registration, sightings in the timeline visualisation and many more improvements.

MISP 2.4.124 released (aka the dashboard, auditing improvements)

Mon, 06 Apr 2020 00:00:00 +0000

MISP 2.4.124 released

A new version of MISP (2.4.124) has been released. This version includes various improvements including a new multiline widgets in the dashboard, auditing improvements and many bugs fixed.

Cogsec Collab MISP Community - sharing group dedicated to misinformation and information campaigns

Thu, 26 Mar 2020 00:00:00 +0000

We’re proud to announce the CogSec Collab MISP Community - the first public MISP sharing group dedicated to misinformation and information campaigns.

MISP 2.4.123 released (aka the dashboard and security fix release)

Tue, 10 Mar 2020 00:00:00 +0000

MISP 2.4.123 released

A new version of MISP (2.4.123) has been released. This version includes various security related fixed, and a new Dashboard system.

MISP 2.4.122 released (aka the bug fix release)

Tue, 18 Feb 2020 00:00:00 +0000

MISP 2.4.122 released

A new version of MISP (2.4.122) has been released. This version includes various fixes, minor new features and improvements.

MISP 2.4.121 released (aka the security release)

Wed, 12 Feb 2020 00:00:00 +0000

MISP 2.4.121 released

A new version of MISP (2.4.121) has been released. This version is a security/bug fix release and users are highly encouraged to update as soon as possible. Besides that several issues were resolved and some new functionalities were added.

MISP 2.4.120 released (aka the timeline release)

Tue, 21 Jan 2020 00:00:00 +0000

MISP 2.4.120 released

A new version of MISP (2.4.120) has been released, including an extension to the data-model adding the first_seen and last_seen values at the attribute and object levels. The user-interface has been extended with a timeline view/editor per event, allowing users to see all occurrences of attributes and objects based on time. A new quick object edit tool has been added, enabling users to easily add new attributes to already existing objects. A long list of bugs were fixed and various improvements were made in the existing features.

MISP 2.4.119 released (aka the quality of life release)

Wed, 04 Dec 2019 00:00:00 +0000

MISP 2.4.119 released

A new version of MISP (2.4.119) has been released, including several functionalities that should make the operation of a MISP instance more convenient.

MISP 2.4.118 released (aka the exclusivity tag release and SightingDB support)

Sun, 10 Nov 2019 00:00:00 +0000

MISP 2.4.118 released

A new version of MISP (2.4.118) has been release including a functionality that allows for tag exclusivity within taxonomies, the support for external Sighting sources via SightingDB and many fixes.

Visualising common patterns using MISP and ATT&CK data

Sun, 27 Oct 2019 00:00:00 +0000

Visualising common patterns using MISP and ATT&CK data

Having access to a large amount of Threat information through MISP Threat Sharing communities gives you outstanding opportunities to aggregate this information and take the process of trying to understand how all this data fits together telling a broader story to the next level. We are transforming technical data or indicators of compromise (IOCs) into cyber threat intelligence. This is where the analytical challenge begins.

MISP 2.4.117 released (aka the the pre-conference season release)

Fri, 11 Oct 2019 00:00:00 +0000

MISP 2.4.117 released

A new version of MISP (2.4.117) has been release including major performance improvements in MISP and PyMISP, publish filter emails, throttling restSearch (very useful when you want to limit some users using the API of your MISP instance) and many more improvements.

Benefits of running your own MISP instance

Wed, 25 Sep 2019 00:00:00 +0000

Benefits of running your own MISP instance

One topic that regularly pops up during trainings and users that are just getting started with MISP in general is the question of running your own MISP versus using a hosted MISP instance. We have seen a lot of great efforts by ISACs, organisations with national or sectorial responsibilities leading the charge and acting as a central sharing hub for communities.

MISP 2.4.116 released (aka the new decaying feature)

Tue, 17 Sep 2019 00:00:00 +0000

MISP 2.4.116 released

A new version of MISP (2.4.116) has been release, including a long awaited major new feature that deals with decaying indicators in addition to a new ATT&CK sightings export and a new sync priority capability.

Decaying of Indicators - MISP improved model to expire indicators based on custom models

Thu, 12 Sep 2019 00:00:00 +0000

An improved and flexible model to expire indicators

This blog post aims to give a thorough introduction of a new functionality added in MISP 2.4.116, allowing users and organisations to easily expire information depending on their personalised objectives and targets.

MISP 2.4.115 released (aka CVE-2019-16202 and sync speed improvement)

Tue, 10 Sep 2019 00:00:00 +0000

MISP 2.4.115 released

A new version of MISP (2.4.115) with a major security fix (CVE-2019-16202) and various small improvements has been released. We strongly recommend all MISP users update to this version.

MISP 2.4.114 released (aka the community care package release)

Sat, 31 Aug 2019 00:00:00 +0000

MISP 2.4.114 released

A new version of MISP (2.4.114) with some new features supporting collaboration and a list of fixes and small improvements. We strongly recommend to update to this version.

MISP 2.4.113 released (aka the bugs fixing marathon)

Mon, 19 Aug 2019 00:00:00 +0000

MISP 2.4.113 released

A new version of MISP (2.4.113) with tons of fixes and small improvements. We strongly recommend to update to this version.

MISP 2.4.112 released (aka summer fixes and improvement)

Thu, 01 Aug 2019 00:00:00 +0000

MISP 2.4.112 released

A new version of MISP (2.4.112) has been released with a host of API fixes, improvements and a security fix.

MISP 2.4.111 released (aka improved proposal sync)

Fri, 19 Jul 2019 00:00:00 +0000

MISP 2.4.111 released

A new version of MISP (2.4.111) has been released with an improved proposal sync, minor improvements and bugs fixed.

MISP 2.4.110 released (aka local-tags and new MISP modules supporting MISP standard format)

Mon, 08 Jul 2019 00:00:00 +0000

MISP 2.4.110 released

A new version of MISP (2.4.110) has been released with a host of new features, improvements, many bugs fixed and one security fix. Even under the searing summer sun, the MISP-project team is hard at work, whilst enjoying some cocktails (with or without booze).

MISP 2.4.109 released (aka cool-attributes-to-object)

Fri, 14 Jun 2019 00:00:00 +0000

MISP 2.4.109 released

A new version of MISP (2.4.109) has been released with a host of new features, improvements, bug fixes and a minor security fix. We strongly advise all users to update their MISP installations to this latest version.

MISP 2.4.108 released (aka copy-paste-and-sync feature)

Wed, 05 Jun 2019 00:00:00 +0000

A new version of MISP (2.4.108) has been released with a host of new features, improvements and bugs fixed. We strongly advise all users to update their MISP installations to this latest version.

MISP 2.4.107 released (aka similar objects review, yara native export)

Mon, 13 May 2019 00:00:00 +0000

A new version of MISP (2.4.107) has been released with a host of new features, improvements and security fixes. We strongly advise all users to update their MISP installation to this latest version.

MISP 2.4.106 released (aka Too many improvements)

Thu, 25 Apr 2019 00:00:00 +0000

A new version of MISP (2.4.106) has been released with a host of improvements, including new features such as a feed cache search, CLI tools to manage your MISP instance along with improved diagnostics.

MISP 2.4.105 released (aka security fix for CVE-2019-10254)

Thu, 28 Mar 2019 00:00:00 +0000

A new version of MISP (2.4.105) has been released to fix a security vulnerability (CVE-2019-10254) in addition to some minor improvements and a fix for the STIX 1.1 import, enabling the import of files with additional namespaces (such as CISCP).

MISP 2.4.104 released (aka too many new features)

Tue, 26 Mar 2019 00:00:00 +0000

A new version of MISP (2.4.104) has been released with a host of new features such as new overlap feed comparator, a new graph visualisation of event and attribute distributions, a history/bookmark system for the REST client and many others.

MISP 2.4.103 released (aka UI improvements)

Mon, 04 Mar 2019 00:00:00 +0000

A new version of MISP (2.4.103) has been released with significant UI improvements (including a new flexible attribute filtering tool at the event level), many bug fixes and a fix to a security vulnerability (CVE-2019-9482) which was affecting sighting visibility.

MISP 2.4.102 released (aka bug fixes and FOSDEM release)

Sat, 02 Feb 2019 00:00:00 +0000

A new version of MISP (2.4.102) has been released with several fixes, various UI improvements, new types and a praise to the open source community.

MISP 2.4.101 released (aka 3 features for free)

Sun, 20 Jan 2019 00:00:00 +0000

A new version of MISP (2.4.101) has been released with 3 main new features (tag collections, improved tag/galaxy selector and MISP instance caching), along with a host of improvements and bug fixes.

MISP 2.4.100 released (aka happy new year release)

Tue, 01 Jan 2019 00:00:00 +0000

Happy new year! We are so proud of our community which has supported us for the past year and we hope to do even better for 2019. Thanks a lot.

MISP 2.4.99 released (aka API/UI fixes and critical security vulnerability fixed)

Thu, 06 Dec 2018 00:00:00 +0000

A new version of MISP (2.4.99) has been released with improvements in the UI, API, STIX import and a fixed critical security vulnerability.

MISP 2.4.98 released (aka usability improvements and SleuthKit mactime import)

Mon, 26 Nov 2018 00:00:00 +0000

A new version of MISP (2.4.98) has been released with new features such as improved UI consistency (such as attributes search output), improved validation error messages, a new built-in experimental SleuthKit mactime import, new small features and many bugs fixed.

MISP 2.4.97 released (aka so many new features)

Tue, 30 Oct 2018 00:00:00 +0000

A new version of MISP (2.4.97) has been released with new features such as related tags, the sighting restSearch API, a new French localisation along with many improvements to the API and he import/export capabilities, such as improved support for DHS AIS STIX 1 files.

MISP 2.4.96 released (aka API everywhere release)

Tue, 09 Oct 2018 00:00:00 +0000

A new version of MISP (2.4.96) has been released with a complete rework, refactoring and simplification of the restSearch API, allowing for more flexibility, improved search capabilities, performance and extendability.

MISP 2.4.95 released (aka API search improvement)

Thu, 06 Sep 2018 00:00:00 +0000

A new version of MISP (2.4.95) has been released with the first stage of a complete rework and refactoring of the API exports, allowing for more flexibility, improved search capabilities, performance and extendability.

MISP 2.4.94 released (aka summer improvements)

Mon, 06 Aug 2018 00:00:00 +0000

A new version of MISP 2.4.94 has been released including an improved event graph interface, a new Elasticsearch plugin, various extensions and enhancements to the API, clean-ups and many improvements. Even though it’s summertime, we continuously work on the MISP project and a lot of changes were introduced.

MISP 2.4.93 released (aka ATT&CK integration)

Wed, 27 Jun 2018 00:00:00 +0000

A new version of MISP 2.4.93 has been released including a much improved and tightly integrated MITRE ATT&CK interface, a new event locking functionality, initial support for a multilingual interface, various fixes including a security fix (CVE-2018-12649).

MISP 2.4.92 released (aka performance improvement)

Thu, 07 Jun 2018 00:00:00 +0000

A new version of MISP 2.4.92 has been released including aggressive performance boosts, various improvements and bug fixes.

We received feedback from various users about the negative impact on performance when the MISP warning-lists are enabled (a feature allowing the detection and filtering of false positive attributes in MISP). The performance hit incurred by enabling warning-lists has been reduced to such an extend that enabling them will barely have any impact on performance when viewing or browsing events. We hope this performance gain will increase the overall adoption of the warning-lists.

MISP 2.4.91 released (aka distribution visualisation, galaxy at attribute level and privacy notice list)

Wed, 16 May 2018 00:00:00 +0000

A new version of MISP 2.4.91 has been released including new major features, improvements and bug fixes.

MISP 2.4.91 has a new visual aid in order to simply view the distribution and sharing model of all the attributes within an event. As events can become quite larger, with long lists of objects and attributes, analysts need to verify whether the proper distributions are applied. The new visualisation allows them to view the items per distribution level including the associated sharing groups. The visualisation is dynamic and can be used to filter the given attributes matching a specific distribution setting within the event.

MISP 2.4.90 released (aka Extended Events release)

Fri, 20 Apr 2018 00:00:00 +0000

A new version of MISP 2.4.90 has been released including the new extended events feature along with many updates in improvements in the API, user-interface (including many improvement in the graph editor) and many bug fixes.

Introducing The New Extended Events Feature in MISP

Thu, 19 Apr 2018 00:00:00 +0000

Introducing Extended Events

We have just released a new feature for MISP that allows users to build full blown events that extend an existing event, giving way to a combined event view that includes a sum total of the event along with all extending events.

MISP 2.4.89 released (aka Event graph viewer/editor)

Fri, 23 Mar 2018 00:00:00 +0000

A new version of MISP 2.4.89 has been released including a new MISP event graph viewer/editor, many API improvements and critical bug fixes (including security related bug fixes).

MISP 2.4.88 released (aka Fuzzy hashing correlation, STIX 1.1 import and many API improvements)

Wed, 21 Feb 2018 00:00:00 +0000

A new version of MISP 2.4.88 has been released including fuzzy hashing correlation (ssdeep), STIX 1.1 import functionality, various API improvements and many bug fixes

MISP 2.4.87 released (aka translate everything, improvements everywhere and more)

Sun, 28 Jan 2018 00:00:00 +0000

A new version of MISP 2.4.87 has been released including a massive contribution enabling support for internationalisation and localisation in the MISP UI (a huge thank to Steve Clement of CIRCL for the tedious work), as well as a host of improvements to the UI, feed and APIs, including bug fixes and speed improvements.

MISP 2.4.86 released (aka sharing groups improvement, large information sharing communities support and more)

Tue, 16 Jan 2018 00:00:00 +0000

A new version of MISP 2.4.86 has been released including improvements to the sharing groups and their respective APIs, granular access control of MISP-modules at an instance-level along with the usual set of bug fixes.

Using MISP to share vulnerability information efficiently

Tue, 09 Jan 2018 00:00:00 +0000

Software and hardware vulnerabilities are often discussed, shared, prepared, analysed and reviewed before publication. This process can be tedious as it often includes multiple exchanges between the parties involved, including reporters, proxy-reporters, coordinators, editors and even impacted parties. Some vulnerabilities might be shared and exchanged among trusted parties for months before being officially disclosed. This can generate a significant workload on the staff dealing with a security team, vulnerability assessment team or CNA (CVE Numbering Authorities).

MISP 2.4.85 released (aka feeds and warning-lists improvement and more)

Fri, 22 Dec 2017 00:00:00 +0000

A new version of MISP 2.4.85 has been released including improvements to the feed ingestion performance, warning-list handling and many bug fixes.

MISP 2.4.83 released (aka attributes-level tag filtering and more)

Wed, 06 Dec 2017 00:00:00 +0000

A new version of MISP 2.4.83 has been released including attribute level tag filtering on synchronisation, full audit logging via ZMQ or Syslog, user email domain restriction at the org level, many more improvements and bug fixes.

MISP 2.4.82 released (aka improved pub-sub ZMQ)

Fri, 10 Nov 2017 00:00:00 +0000

A new version of MISP 2.4.82 has been released including an improved publish-subscribe ZMQ format, improvements in the feeds system, sightings are now ingested and synchronised among MISP instances, many bug fixes and export improvements.

MISP 2.4.80 released (aka MISP objects release)

Mon, 18 Sep 2017 00:00:00 +0000

A new version of MISP 2.4.80 has been released including the most awaited MISP objects feature along with other new features, security fix CVE-2017-14337 and improvements.

MISP 2.4.81 released (aka new graphical visualisation and STIX 2.0 export)

Mon, 18 Sep 2017 00:00:00 +0000

A new version of MISP 2.4.81 has been released including a significant rework of the graphical visualisation, support for STIX 2.0 export, multiple bug-fixes and improvements for misp-objects.

MISP 2.4.79 released

Fri, 25 Aug 2017 00:00:00 +0000

A new version of MISP 2.4.79 has been released including an important security fix (persistent XSS on comment field), multiple bug fixes and new functionalities.

MISP 2.4.78 released

Sun, 06 Aug 2017 00:00:00 +0000

A new version of MISP 2.4.78 has been released including an important security fix (if you use sharing groups), multiple bug fixes and some new functionalities.

MISP 2.4.77 released

Wed, 12 Jul 2017 00:00:00 +0000

A new version of MISP 2.4.77 has been released including security fixes, bug fixes and various improvements.

This version includes multiple security fixes reported by cert.govt.nz including:

MISP 2.4.76 released

Wed, 21 Jun 2017 00:00:00 +0000

A new version of MISP 2.4.76 has been released including bug fixes and a set of performance improvements at the ingestion level.

MISP 2.4.75 released

Tue, 13 Jun 2017 00:00:00 +0000

A new version of MISP 2.4.75 has been released including bug fixes and a set of performance improvements.

In this release the most important improvement is performance tuning to improve the day-to-day life of the users. The performance improvements are most explicitly on:

MISP 2.4.74 released

Tue, 30 May 2017 00:00:00 +0000

A new version of MISP 2.4.74 has been released including new features, improvements and bug fixes.

The ZeroMQ pub-sub feature has been significantly improved in MISP to allow for a complete flexible notification scheme for a host of actions which take place within a MISP instance, such as:

MISP 2.4.73 released

Tue, 09 May 2017 00:00:00 +0000

A new version of MISP 2.4.73 has been released including new features, improvements and bug fixes.

A new module type Cortex has been introduced allowing for easy integration of MISP and Cortex. Cortex is the analysis engine part of the TheHive Project which supports expansion services from Cortex within MISP. A new setting has been added to support Cortex similarly to MISP expansion modules where you set the remote Cortex instance. MISP includes a new Cortex attribute type to allow for the raw analysis to be stored along with the event for subsequent analysis.

MISP 2.4.72 released

Fri, 14 Apr 2017 00:00:00 +0000

A new version of MISP 2.4.72 has been released including improvements and important bug fixes.

Improvements have been introduced to better support large MISP instances:

MISP 2.4.71 released

Tue, 11 Apr 2017 00:00:00 +0000

A new version of MISP 2.4.71 has been released including new features, improvements and important bug fixes.

Distribution can now be set in the free-text and modules import.
Password complexity default tightened to allow passphrase-like in addition to password.
Password regexp (can be considered a CTF-challenge for some users) is now available as a hint.
API restsearch has been significantly improved allowing to support alternate download types from the restsearch (currently OpenIOC is supported). OpenIOC export and CIDR tool refactored.
Organisation blacklist is now enabled by default and sample UUIDs/organisations are now blacklisted by default.
API The “proposal to delete flag” is now available in the API output.
Improved error handling when failing to add a tag.
API Event history is now available via the API.
Set comment field to an empty string in the attributes pre-validation (to avoid null comment field).
Correlation can now be disabled for site admin even if (s)he is not the owner.

Various bugs fixed in the sharing group synchronisation and delegation. Improvements to the UI popups when using low-resolution (aka potato displays).

MISP 2.4.70 released

Sun, 26 Mar 2017 00:00:00 +0000

A new version of MISP 2.4.70 has been released including new features, improvements and important bug fixes.

A significant improvement has been introduced to the MISP user-interface to make it more accessible especially for visually impaired users.
API improvements introduced to allow adding several attributes in one go.
API extended to support the functionality of adding and editing MISP servers.
A simple update feature from the user-interface was introduced to ease the update process of MISP.
New attribute types (hex, sigma and impfuzzy) have been introduced for new misp-objects and to improve the support of the new sigma format. Sigma is a generic signature format for SIEM Systems. This new attribute type will help the development of a sigma converter via misp-modules.
Test and diagnostic for the MISP server synchronisation has been significantly improved. The old legacy and mangle sync for very old MISP instances (2.3x) has been removed in an effort to make the code cleaner and improve the synchronisation process with recent MISP instances.

Many other bugs fixed and minor features added.

MISP 2.4.69 released

Fri, 10 Mar 2017 00:00:00 +0000

A new version of MISP 2.4.69 has been released including multiple security bug fixes and minor improvements.

Improvements added:

User creation now shows a warning if the encrypted notification cannot be send due to encryption issue.
Tagged properly added to Suricata rules.

Two security vulnerabilities (XSS) reported by Tien Phan and David Maciejak of Fortinet’s FortiGuard Labs were fixed. Thanks to them for reporting the vulnerabilities.

MISP 2.4.68 released

Wed, 08 Mar 2017 00:00:00 +0000

A new version of MISP 2.4.68 has been released including multiple bug fixes and improvements.

Improvements and features added:

Enable sync permissions for read-only accounts.
Upload org logo can now be performed via the org edit/view interface.
An option to disable cached export has been added for low disk space servers.

Blacklisting of deleted events is now enabled by default. This feature existed before but was not enabled by default. This feature allows MISP users to ensure that deleted events never propagate back to their instance. The blacklist can easily be managed from the MISP interface. As this feature is a default behaviour that a large majority of the MISP community needs, we have decided to enable this feature by default starting from version 2.4.68.

MISP 2.4.67 released

Fri, 24 Feb 2017 00:00:00 +0000

A new version of MISP 2.4.67 has been released, including improvements to the sighting feature, user management and activity visualisation.

Sighting activities over tags and galaxy clusters are now visualised using sparklines, giving us an interesting outlook of contextual activity:

Sighting the next level

Thu, 16 Feb 2017 00:00:00 +0000

Sighting is an endless topic of discussion. This is a required feature especially when information or indicators are regularly shared to gather feedback from users said shared data. Adequate sightings can be an incredible source of information in order to describe the life-time of an indicator, its evolution and especially to ensure the understanding of indicators among a group of users using the information to detect, mitigate or block malicious activities in their infrastructures. The potential is endless, potentially being a significant gain for organised communities of infosec professionals sharing information or even serve as a requirement for advanced algorithms ranging from machine learning to reinforcement learning. But to reach such a state of a feedback loop, you first require a functional model of sighting.

MISP 2.4.65 released

Thu, 09 Feb 2017 00:00:00 +0000

A new version of MISP 2.4.65 (and 2.4.64) has been released, including bug fixes and new features.

API access added to the MISP statistics providing additional statistics regarding information on contributions by organisation, attributes used and tags. The API can be also used by monitoring tools to monitor the state of a MISP instance.

MISP 2.4.63 released

Wed, 01 Feb 2017 00:00:00 +0000

A new version of MISP 2.4.63 has been released, including bug fixes and new features.

New features in the API:

Allowing fetching of full discussion threads via the API.
Add and remove tags from objects by uuid (in addition to the id).

Added a new setting to show post count on the event index including a notification if it has a post newer than 24 hours.

MISP 2.4.62 and PyMISP 2.4.62 released

Thu, 26 Jan 2017 00:00:00 +0000

A new version of MISP 2.4.62 has been released, including bug fixes and new features.

MISP feed has been expanded to support local feed allowing users to import feeds from local directories (if MISP format) or local files (like free-text or CSV import) in addition to the network feeds.

MISP 2.4.61 released

Sun, 22 Jan 2017 00:00:00 +0000

A new version of MISP 2.4.61 has been released, including a critical bug fix, new features and minor updates. We strongly recommend to update MISP to this latest version.

MISP 2.4.60 released

Tue, 17 Jan 2017 00:00:00 +0000

A new version of MISP 2.4.60 has been released, including bug fixes and the long awaited attribute-level tagging feature.

All tags (local or from taxonomies) can now be also applied at the attribute level. This allows analysts or users to easily classify attributes within an event. Many of the taxonomies have useful properties that can be applied to provide additional contextual information to attributes. The attribute level tagging feature introduces many new potential use-cases where MISP can be used to better the day-to-day tasks of incident handlers, analysts or security engineers.

Information Sharing Maturity Model

Mon, 16 Jan 2017 00:00:00 +0000

Here at the MISP project, we are practical oriented people. We create software (from MISP core to MISP workbench), develop data models (such as taxonomies, warning-lists and galaxies) and build practical standards to solve information sharing challenges and improve the general state of information sharing. That’s what we strive for. If we lack something, we build it. If we see a requirement, we fullfil it.

MISP 2.4.58 released

Thu, 22 Dec 2016 00:00:00 +0000

A new version of MISP 2.4.58 has been released, including bug fixes and a specific improvement to the correlation feature.

Correlation can be disabled at the instance level, or, if a new setting is enabled, at the event or at the attribute level by a site admin or the creator of the event. The latter is an optional feature that can be enabled or disabled system-wide in MISP. This allows for a flexible scheme, supporting situations where the correlations of certain events or attributes are not interesting for the analysts. This feature is also available via the API.

MISP 2.4.57 released

Mon, 19 Dec 2016 00:00:00 +0000

A new version of MISP 2.4.57 has been released, including bug fixes and improvements.

Two major new features were introduced in 2.4.57. One of them is the addition of new attribute types and categories to support the new use-cases in MISP, including the Person, Social network and Support tool categories. The new attribute types include additional email header types along with attributes describing a natural person and even an attribute type for describing mobile application identifiers. For a complete overview of the new types, you can have a look at the wiki page “New Attributes”.

MISP 2.4.56 released

Wed, 07 Dec 2016 00:00:00 +0000

A new version of MISP 2.4.56 has been released, including bug fixes and improvements.

This is the first version introducing the misp-galaxy. MISP galaxy is a simple method to express large objects called cluster that can be attached to MISP events or (in the near future) attributes. A cluster can be composed of one or more elements, which are expressed as key-value pairs. You can now directly benefit from the shared galaxy with threat actors and tools used by attackers in MISP.

MISP 2.4.55 released

Tue, 22 Nov 2016 00:00:00 +0000

A new version of MISP 2.4.55 has just been released, including bug fixes and improvements.

This release is a transient release before the galaxy release (TTP-like support) coming up soon.

Independence and Threat Intelligence Platforms

Wed, 16 Nov 2016 00:00:00 +0000

After the recent news of a Threat Intelligence Platform vendor stopping its activities, we have received some questions about our strategies as a Threat Intelligence Platform.

MISP 2.4.54 released

Fri, 04 Nov 2016 00:00:00 +0000

A new version 2.4.54 of MISP including new features, bug and security fixes.

We strongly recommend to update to this latest version.

MISP 2.4.53 released

Sat, 22 Oct 2016 00:00:00 +0000

A new version 2.4.53 of MISP including several security fixes has been released.

We strongly recommend to update to this latest version as soon as possible.

MISP Internet Drafts Published

Fri, 21 Oct 2016 00:00:00 +0000

We recently released two Internet-Drafts describing the MISP format:

misp-core-format - the core JSON format of MISP which describes the Event format including meta-information, attributes, shadow attributes. In addition, the Manifest format which bundles MISP events is described.
misp-taxonomy-format - The MISP taxonomy JSON format describes how to define the complete namespace of machine tags in a parseable format.

The misp-rfc project was started to better document and describe MISP formats. The specifications are based from the real implementation cases (code is law). As we received many requests of vendors or software developers willing to integrate MISP. The specifications were designed to support organizations willing to use and integrate MISP formats in their product or software.

MISP 2.4.52 released including new features and major improvements

Fri, 07 Oct 2016 00:00:00 +0000

We are glad to announce MISP 2.4.52 including new features, improvements and bug fixes.

The following new features were introduced:

MISP Upcoming Activities in October and November 2016

Sun, 02 Oct 2016 00:00:00 +0000

The next months for the MISP core team, it is full of interesting activities and upcoming events.

We will participate to the following events:

MISP 2.4.51 released including new features and many bug fixes.

Mon, 29 Aug 2016 00:00:00 +0000

A version of MISP has been released: 2.4.51 including many new features, bug fixes and improvements.

New Internal MISP sync mode to allow a set of MISP instances belonging to the same organisation to replicate data (useful when a single organisation has multiple MISP instances).
Enhanced internal STIX export to better handle bulk exports.
Added X.509 certificate authentication for MISP synchronisations.
Many fixes and improvement in misp-modules handling.
MISP Correlation has been sped-up.
warning-list loading improved.
Default role option added.
Inline screenshot functionality
Many other fixes.

We strongly recommend to also update your misp-modules installation.

Building an OCR import module in MISP

Fri, 12 Aug 2016 00:00:00 +0000

Building an Optical Character Recognition module in MISP

When collecting information from different places, analysts need sometime to perform OCR on documents (like report, faxes, images) to import and correlate the information in their MISP instance. As MISP 2.4.50 introduced a new modular framework for export and import modules, we decided to build a simple OCR service accessible to MISP user on a local instance. This shows how easy you can extend MISP with the new modules framework.

MISP training, “the Brussels Edition”, CIRCL in collaboration with CERT.EU - September 5th 2016

Thu, 11 Aug 2016 00:00:00 +0000

On September 5th 2016 and after 3 successful editions, the MISP (Malware Information and Threat Sharing Platform) training is traveling to Brussels. This workshop is organized by CIRCL in collaboration with CERT-EU and will take place at the European Economic and Social Committee’s premises.

MISP 2.4.50 released including new features, security and bug fixes.

Wed, 10 Aug 2016 00:00:00 +0000

A version of MISP has been released: 2.4.50 including many bug fixes, updates and improvements.

New export and import MISP module framework in MISP. You can now write your own Python modules for import and export without touching the MISP core software. Samples modules are available in misp-modules repository.
A XSS vulnerability has been fixed into the handling of the external feed.
New feature to view the public attributes of an event.
Multiple fixes in the caching exports (useful for large exports).
New SSO plug-in Shibboleth based.
Many other fixes.

Thanks to all the contributors and especially the new ones who joined us at our first hackathon.

MISP Hackathon 2016

Mon, 01 Aug 2016 00:00:00 +0000

MISP Hackathon 2016

The 4th August 2016, a MISP hackathon will take place in Luxembourg (at the local hackerspace) and also remotely. It’s a great opportunity to meet the team in a friendly atmosphere and work on your favourite information sharing software in order to improve it and make an even better tool.

MISP 2.4.49 released with many improvements and fixes

Fri, 22 Jul 2016 00:00:00 +0000

A version of MISP has been released: 2.4.49 including many bug fixes, updates and improvements.

Updates to the MISP module interface to allow a timeout on hover modules and allowing to timeout slow modules queries.
Tag restriction functionality added to limit the use of tag to a specific organization.
Important fixes in the sharing groups functionality including a new roaming setup.

For more details check the Changelog.

Contributing to MISP Project

Mon, 01 Jan 0001 00:00:00 +0000

Contributing to MISP Project

MISP project is a large free software project composed of multiple sub-projects which are contributed by different contributors who are generally active users of the MISP project. MISP project fully supports the Contributor Covenant Code of Conduct to foster an open and dynamic environment for contributing and the exchange in the threat intelligence and information exchange field.

COVID-19 MISP

Mon, 01 Jan 0001 00:00:00 +0000

COVID-19 MISP is a MISP instance retrofitted for a COVID-19 information sharing community, focusing on two areas of sharing:

Download

Mon, 01 Jan 0001 00:00:00 +0000

Download and Install MISP

MISP source code is available on GitHub including documentation and scripts for installation.

ChangeLog contains a detailed list of updates for each software release in the core of the MISP software.

Events around MISP - Next webinar with partners

Mon, 01 Jan 0001 00:00:00 +0000

CRAWL, WALK, RUN series – Farsight Security / MISP webinars

In this three-parts webinar series Farsight Security and CIRCL will provide an overview of Farsight’s Passive DNS data, how historical Passive DNS objective observations can be used to uncover malicious activities going back in time. Using practical use cases, we will then demonstrate how to gather the same evidence using Farsight passive DNS module from within MISP platform, and share the findings with the community. We will leave plenty of time for you to follow the steps we demonstrate, as well as ask questions.

Help, Support, and Forums

Mon, 01 Jan 0001 00:00:00 +0000

Help, Support, and Forums

Help and support for MISP is available from the documentation, GitHub issues, and Gitter rooms which are explained below. The MISP Project offers paid support services, and a number of 3rd party providers commercial support.

MISP Commercial Support

Mon, 01 Jan 0001 00:00:00 +0000

MISP Commercial Support is an overview of entities providing support for MISP.

MISP Professional Services (MPS)

MISP project also provides MISP Professional Services (MPS) if you want to directly support the MISP project and ensure its sustainability.

MISP Communities and MISP Feeds

Mon, 01 Jan 0001 00:00:00 +0000

MISP is an open source software and it is also a large community of MISP users creating, maintaining and operating communities of users or organizations sharing intelligence about threats or cyber security indicators worldwide. The MISP project doesn’t maintain an exhaustive list of all communities relying on MISP especially that some communities use MISP internally or privately.

MISP contributors per repository

Mon, 01 Jan 0001 00:00:00 +0000

565 Contributors (2026-02-19)

MISP data models - MISP core format - MISP taxonomies

Mon, 01 Jan 0001 00:00:00 +0000

MISP is not only a software but also a series of data models created by the MISP community. MISP includes a simple and practical information sharing format expressed in JSON that can be used with MISP software or by any other software. The MISP formats are now standards handled by the MISP standard body.

MISP Default Feeds

Mon, 01 Jan 0001 00:00:00 +0000

MISP includes a set of public OSINT feeds in its default configuration. The feeds can be used as a source of correlations for all of your events and attributes without the need to import them directly into your system. The MISP feed system allows for fast correlation but also a for quick comparisons of the feeds against one another.

MISP Documentation and Support

Mon, 01 Jan 0001 00:00:00 +0000

MISP Documentation

The MISP documentation is maintained in the misp-book project. The documentation is in git book format and we welcome contribution.

MISP features and functionalities

Mon, 01 Jan 0001 00:00:00 +0000

A threat intelligence platform for sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counter-terrorism information. Discover how MISP is used today in multiple organisations. Not only to store, share, collaborate on cyber security indicators, malware analysis, but also to use the IoCs and information to detect and prevent attacks, frauds or threats against ICT infrastructures, organisations or people.

MISP Model of Governance

Mon, 01 Jan 0001 00:00:00 +0000

MISP Model of Governance

MISP project is a large open source project with the goal to make viable tools and format to improve information sharing at large. In order to achieve our goals, the MISP project gathers feature requests, feedback and bug reports from different sources. As described in the graph below, we have various sources that we use, including MISP user-groups, direct community feedback via GitHub, MISP trainings and the yearly MISP summit.

MISP OpenAPI spec

Mon, 01 Jan 0001 00:00:00 +0000

MISP performance tuning

Mon, 01 Jan 0001 00:00:00 +0000

MISP performance tuning

Whilst starting out with MISP may be a simple task of simply installing the application or deploying a container, meaning that MISP for most users, MISP is a turnkey solution, for example when using the official Docker installation.

MISP Professional Services

Mon, 01 Jan 0001 00:00:00 +0000

MISP Professional Services (MPS) is a program handled by the lead developers of MISP Project, in order to offer highly skilled services around MISP and to support the sustainability of the MISP project. This initiative is meant to address the policy requirements of companies/organisations requiring commercial support contracts.

MISP-related events

Mon, 01 Jan 0001 00:00:00 +0000

MISP Events

Want to join us at an event, discuss opportunities or projects around the MISP project, share your experience about threat intelligence or discuss how MISP could be improved to support security professionals?

MISP, legal and policy compliance

Mon, 01 Jan 0001 00:00:00 +0000

The MISP project is a large open source project, aiming to support and improve information sharing and threat intelligence analysis at large.

MISP, Overview of the licenses used in the MISP Project (software, libraries and knowledge base)

Mon, 01 Jan 0001 00:00:00 +0000

MISP, Overview of the licenses used in the MISP Project (software, libraries and knowledge base)

The MISP project is a large open source project, aiming to support and improve information sharing and threat intelligence analysis at large.

MISP, press

Mon, 01 Jan 0001 00:00:00 +0000

Announcements and press releases

The general purpose announcements that we publish are available on the news page. Write us an email at info@misp-project.org if you have a press inquiry. You can also send press articles about MISP to this address, so we can add them to this page.

MISP, research projects

Mon, 01 Jan 0001 00:00:00 +0000

Contact for this research project: social-perspective@misp-project.org

Subject scope

Intelligence activity, a prevalent practice across various fields, has continually evolved in response to the changing dynamics of human societies. The shift from analog to digital has significantly transformed social practices and modes of communication.

MISP, research topics

Mon, 01 Jan 0001 00:00:00 +0000

MISP Research topics

Exploring New Horizons in Cyber security and threat intelligence with MISP: Research Opportunities

Welcome to the MISP Research Initiative! MISP is an essential open-source project at the forefront of the global cybersecurity landscape. Developed to empower organizations and security professionals in the battle against cyber threats, MISP serves as a distributed platform for sharing, storing, and analyzing threat intelligence data.

MISP, Sponsoring - Thanks Page

Mon, 01 Jan 0001 00:00:00 +0000

Thank you!

The MISP project owes its existence and continuous improvement to the invaluable support of numerous organizations and individuals. We are deeply grateful to the following organizations, whose ongoing contributions have helped us enhance the project and ensure its long-term sustainability.

Open Source Security hackathon - Monday 25th October 2021 and Tuesday 26th October 2021

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Security hackathon - Monday 25th October 2021 and Tuesday 26th October 2021

CIRCL in collaboration with the MISP Project is organising the 5th Open Source Security Software Hackathon, which will take place over two days, on Monday 25th October 2021 and Tuesday 26th October 2021.

Past MISP-related events

Mon, 01 Jan 0001 00:00:00 +0000

Past conferences

Past conferences featuring MISP core members talking about MISP and/or threat intelligence. Some links include video recordings.

2023

MISP Introduction and NIS 2 (3 hours - onsite at NISDUC conference)

When: 26th April 11:30-15:15 CET

Security Advisories and Reporting Security Vulnerabilities

Mon, 01 Jan 0001 00:00:00 +0000

Reporting security vulnerabilities is of great importance for us, as MISP is used in multiple critical infrastructures.

Sizing your MISP instance

Mon, 01 Jan 0001 00:00:00 +0000

Sizing your MISP instance

Sizing a MISP instance highly depends on how the instance will be used. The number of users, data ingested, data points used, number of events, number of correlations and API usage are all parameters which should be considered while sizing your instance.

Tools

Mon, 01 Jan 0001 00:00:00 +0000

Software and Tools

Many open source and proprietary tools integrate MISP support (MISP format or API) in order to extend their tools or MISP itself. A series of additional software are supported and handled by the MISP project. The additional software supported by the MISP project allow the community to rely on additional tools to support their day-to-day operations. The objective is also to explore new ideas, concepts or functionality which can be integrated in MISP core software later on.

Virtual MISP Summit 0x06 - 21st October 2021

Mon, 01 Jan 0001 00:00:00 +0000

Virtual MISP Summit 0x06 - Thursday 21st October 2021

On Thursday 21st October 2021, the 6th MISP summit will take place online. MISP Project is the leading Open Source Threat Intelligence Platform and in combination with an open standard for threat intelligence. The summit is an opportunity for all developers, contributors and users of the MISP project to share their experiences, learn new use-cases and improve their threat intelligence capabilities.

Who

Mon, 01 Jan 0001 00:00:00 +0000

Who is behind the MISP project?

The core team behind the MISP project is composed of motivated people who think that information sharing can be improved and supported by creating practical open source tools, open format and practises. The current team is composed of:

Who Uses MISP

Mon, 01 Jan 0001 00:00:00 +0000

Who Uses MISP?

(MISP) is an open-source platform and open standards ecosystem designed to support the sharing, storage, and correlation of threat intelligence, security information, and operational knowledge. Since its creation, MISP has evolved into a widely adopted framework used by diverse communities across the cybersecurity, public safety, research, and critical infrastructure sectors.

MISP Open Source Threat Intelligence Platform & Open Standards For Threat Intelligence Sharing

MISP v2.5.35: Decomposed Event Views, Overmind UI Enhancements, Security Hardening and MISP-STIX major update

Setting up UniqueSignal in MISP

VMRay UniqueSignal

MISP-STIX 2026.3.13 Released

MISP-STIX v2026.3.13: Improved Indicator-Observable Matching and Expanded STIX Coverage

Introduction

MISP Workbench `v1.0` (beta) Released

MISP Workbench – First Release v1.0 (beta)

Have You Ever Thought About Drones in MISP?

Have You Ever Thought About Drones in MISP?

The Drone Threat

The Economic Power of Federated Threat Intelligence

The Economic Power of Federated Threat Intelligence

Introduction: Why Policy Matters to Developers

MISP v2.5.33: Performance, Security, and the New Overmind Theme

MISP v2.5.33 Release Notes (2026-02-27)

🎨 A Fresh Look: The “Overmind” Evolution

FlowIntel 3.0.0 released and MISP integration

FlowIntel & MISP

FlowIntel in a Nutshell

MISP architecture choices

MISP architecture

MISP v2.5.32 released bringing new workflow capabilities, enhancement, security fix and various bugs fixed

NGSOTI: Building an Integrated Threat-Intelligence and Information Sharing Ecosystem for the Next Generation of SOC Analysts

Empowering the Ecosystem: MISP’s 2025 Progress and the Open Source Future

MISP v2.5.31 released - Stability, Synchronization Improvements & Year-End Knowledge Base Refresh

MISP v2.5.31 Release Notes

Stability, Synchronization Improvements & Year-End Knowledge Base Refresh

MISP v2.5.30 and v2.5.29 released: Beta UI/UX Mode, New Workflow modules and Performance Enhancements

MISP v2.5.28 Release: Security, Dashboard Upgrade, and Community Enhancements

MISP v2.5.28 Release Notes (2025-12-10)

MISP v2.5.27 - released with new features and various fixes

MISP v2.5.26 - released with performance improvements and interoperability fixes

MISP v2.5.25 - Performance Update

MISP v2.5.24 - Security & Stability Update

MISP 2.5.23 Released with Enhanced Benchmarking, Many Bug Fixes, and Documentation Updates

MISP 2.5.23 Release Notes - (2025-10-15)

Wazuh and MISP integration

Wazuh–MISP Integration: Real-Time Threat Detection with File Hashes

MISP 2.5.22 released with improvements and bugs fixes

MISP Synchronisation - Test and Validation Project

MISP Synchronisation - Test and Validation Project

Introduction

MISP 2.5.21 released with a new recorrelate feature, various fixes and updates.

MISP 2.5.21 released (2025-09-10)

MISP 2.5.19 brings important fixes, improvements to the on-demand correlation engine, refinements in the task scheduler, and better error handling.

MISP 2.5.19 Release Notes

MISP v2.5.18 released with new on-demand correlation engine, a new improved task scheduling system and many more updates

MISP v2.5.18 Release Notes

MISP Releases v2.5.16 & v2.4.214 - A Major Leap in Performance and Stability

MISP 2.4.213 & 2.5.15 Released - A Double Dose of Security, Search, and Stability

MISP 2.4.211 & 2.5.13 Released - A Double Dose of Security, Search, and Stability

MISP 2.4.210 / 2.5.12 released with many improvements, UI enhancement and various fixes

MISP v2.4.209 and v2.5.11 Released with new features, security fixes and improvements in workflow engine.

MISP reporting

MISP reporting

Introduction

MISP v2.4.208 and v2.5.10 Released with Many Bugs Fixed

MISP v2.4.207 and v2.5.9 Released with Many Bugs Fixed

Summary

MISP v2.4.206 and v2.5.8 Released - new workflow modules, improved graph object relationship management and many other improvements

Summary

MISP v2.4.205 and v2.5.7 Released - Enhancements, Fixes, and Improved Correlation Management

Combined Release Notes: MISP v2.5.7 & v2.4.205 (2025-02-24)

Latest misp-stix Release: Enhanced Support for Analyst Data

MISP Analyst Data Format: Enhancing STIX 2.1 Integration

MISP 2.4.204 and 2.5.6 released including new features, performance improvements and many other improvements.

Combined Release Notes: MISP v2.5.6 & v2.4.204 (2025-01-03)

MISP 2.4.203 and 2.5.5 released including new features, improvements and many security improvements.

MISP Software Release: Combined Updates for v2.4.203 and v2.5.5

Introduction

MISP 2.4.202 and 2.5.4 released with numerous enhancements including analyst data, bug fixes, and security improvements

Changes

Configuration

Settings

Updates

Analyst Data

UI

Attributes

MISP Workbench – First Release `v1.0` (beta)