Turning a CVE into a vulnerability advisory with zsazsa and Flowintel

Turning a CVE into a vulnerability advisory with zsazsa and Flowintel

In the previous post we used zsazsa to build a daily threat briefing from the material you already collect in MISP. We stay with the same approach, creating products from the information you have, but this time we focus on one of the most routine jobs for a CTI team: turning a CVE into a vulnerability advisory.

Continue reading

Create a daily threat briefing with zsazsa and MISP

Create a daily threat briefing with zsazsa and MISP

Introduction

zsazsa is a small application that supports day-to-day CTI work, including stakeholder management, handling PIRs, GIRs and RFIs, data collection, and the creation of threat intelligence products. No external tooling is required, MISP acts as the back-end storage layer. Events, reports, and the final intelligence products are all stored in MISP. A nice side effect is that those products are not limited to the usual notification channels like Mattermost or Teams; they can also be shared through the standard MISP sharing and distribution model, in the same way as threat events. You can find zsazsa on GitHub: https://github.com/cudeso/zsazsa/.

Continue reading

MISP-STIX 2026.3.13 Released

MISP-STIX v2026.3.13: Improved Indicator-Observable Matching and Expanded STIX Coverage

Introduction

misp-stix is the Python library powering bidirectional conversion between MISP and STIX (versions 1.x, 2.0, and 2.1).
It is used by MISP core software, available as misp-stix on PyPI, and also available directly as a conversion service on cti-transmute.org.

Continue reading