MISP, Overview of the licenses used in the MISP Project (software, libraries and knowledge base)

MISP, Overview of the licenses used in the MISP Project (software, libraries and knowledge base)

The MISP project is a large open source project, aiming to support and improve information sharing and threat intelligence analysis at large.

As the MISP project is used in different geographical regions (Europe, North America, Asia-Pacific, South America and Africa) as well as different sectors of activities (spanning a wide selection such as cyber security, intelligence community, law enforcement and NGOs), we provide detailed information about the open source licenses used by the various parts of the project.

Open Source Licenses Used

The MISP sub-projects use different open source licenses depending on the various use-cases for the given software, library or knowledge base. All the open source licenses used are approved by the OSI and classified as Free/Libre by the Free Software Foundation.

MISP Repository License SPDX Identifier
MISP core software GNU Affero General Public License v3.0 or later AGPL-3.0-or-later
MISP objects Dual licensed: CC0 1.0 Universal (CC0 1.0) or BSD 2-Clause “Simplified” License - software: GNU Affero General Public License v3.0 or later AGPL-3.0-or-later
MISP taxonomies Dual licensed: CC0 1.0 Universal (CC0 1.0) or BSD 2-Clause “Simplified” License CC0-1.0 or BSD 2-Clause “Simplified” License
MISP galaxy Dual licensed: CC0 1.0 Universal (CC0 1.0) or BSD 2-Clause “Simplified” License CC0-1.0 or BSD 2-Clause “Simplified” License
MISP warning-lists Dual licensed: CC0 1.0 Universal (CC0 1.0) or BSD 2-Clause “Simplified” License CC0-1.0 or BSD 2-Clause “Simplified” License
MISP decaying models Dual licensed: CC0 1.0 Universal (CC0 1.0) or BSD 2-Clause “Simplified” License CC0-1.0 or BSD 2-Clause “Simplified” License
MISP modules GNU Affero General Public License v3.0 or later AGPL-3.0-or-later
PyMISP BSD 2-Clause “Simplified” License BSD 2-Clause “Simplified” License
MISP-Maltego GNU Affero General Public License v3.0 or later AGPL-3.0-or-later
misp-dashboard GNU Affero General Public License v3.0 or later AGPL-3.0-or-later

Contributing and copyright

We welcome contributions. All contributors collectively own the MISP project itself along with the various MISP sub-projects (software, libraries and knowledge bases alike), depending on which parts they have contributed to. The contributors also acknowledge the Developer Certificate of Origin.

AGPL Affero General Public License - MISP point of view

MISP core software is licensed under the Open Source approved AGPL license. The Affero GPL is a standard GNU GPL version 3 license with an additional clause which requires the ability to download the source code of the MISP core itself. This requirement only applies if the MISP core software has been modified, Meaning that you are free to bundle MISP with any software under different licenses. AGPL only applies to the MISP core software and not to any other software using the API of MISP.

Export control

The MISP Project is developed at an international scale and the core developers are located in Europe. This website is hosted in Belgium. Export restriction might apply (as MISP open source software can be classified as ECCN 5D002 or 5D992) for the users depending on their location if they wish to download MISP from the official GitHub repositories (hosted by GitHub, Inc.). If you are located in a region where downloading from GitHub is restricted, the MISP project provides an alternative git repository for each MISP sub-projects at the following location: https://eugit.opencloud.lu/MISP located in Luxembourg, Europe (hosted by opencloud.lu).