MISP/MISP

Features

• Threat Intelligence Platforms - An open-source platform for collecting, storing, and sharing structured threat intelligence and indicators of compromise.
• Distribution Controls - Ships granular sharing group models with per-attribute visibility controls for distributing structured threat data.
• Programmatic Threat Intelligence Interfaces - Ships a documented REST API for programmatic query, creation, update, and deletion of threat data.
• REST APIs - Provides a documented REST API with OpenAPI specification for programmatic threat intelligence access.
• Threat Intelligence - Provides a REST API for programmatic querying, creation, and updating of threat intelligence data.
• Correlation Engines - Provides an attribute-based correlation engine that automatically links matching indicators across events to reveal hidden attack patterns.
• Threat Object Models - Provides a flexible object model for structuring and linking detailed threat intelligence data.
• Granular Content Sharing - Distributes events and attributes with per-attribute visibility settings and community controls across instances.
• Distributed Event Synchronization - Transfers published events to configured remote instances subject to distribution rules and push settings.
• Threat Data Stores - Persists structured threat data in a flexible object model with cross-referencing capabilities.
• REST APIs - Provides a full REST API with OpenAPI specification for programmatic interaction with the threat intelligence platform.
• Threat Intelligence - Provides a documented OpenAPI REST interface for automated threat data retrieval and submission.
• OpenAPI Specifications - Ships an OpenAPI specification that documents the entire REST API for programmatic threat intelligence access.
• Security Event Correlation - Ships an attribute-based correlation engine that links matching indicators across events to reveal hidden relationships.
• Threat Event Pushes - Ships a distributed synchronization protocol for pushing events to remote MISP instances.
• Threat Intelligence Synchronizers - Implements a distributed synchronization protocol for exchanging events and attributes between instances with advanced filtering.
• Threat Indicator Correlators - Links matching indicators across events using exact matches, fuzzy hashing, and CIDR blocks to reveal hidden relationships.
• Distributed Synchronization Protocols - Implements a distributed synchronization protocol for transferring published events between configured remote instances.
• Threat Intelligence REST APIs - Provides a programmatic OpenAPI interface to query, create, update, and delete threat data using standard HTTP methods.
• Workflow Automation Pipelines - Runs customizable workflows to qualify, analyze, and publish threat data without manual intervention.
• Threat Data Workflow Pipelines - Runs customizable pipelines that qualify, analyze, modify, and control publication of threat data automatically.
• TAXII Exchanges - Implements bidirectional TAXII exchange for receiving and pushing threat intelligence data.
• Threat - Runs customizable workflows that qualify, analyze, modify, and control publication of threat data automatically.
• Threat Data Pushes - Ships a scheduled push mechanism for distributing threat intelligence to TAXII servers.
• Threat Intelligence Format Integrations - Ships formal specifications for JSON, taxonomy, galaxy, and object template formats to enable tool compatibility.
• Security Tool Integration APIs - Exchanges threat data with NIDS, SIEMs, and other systems via STIX and REST API formats.
• Message Queue Workers - Processes scheduled tasks and data operations asynchronously through a dedicated background worker queue system.
• Threat Relationship Visualizations - Provides event graph visualizations for exploring events, correlations, and object relationships.
• Threat Intelligence Format Specifications - Publishes formal specifications for JSON, taxonomy, galaxy, and object template formats for tool interoperability.
• Threat Intelligence - Defines formal specifications for JSON, taxonomy, galaxy, and object template formats for threat intelligence exchange.
• File Format Plugin Support - Uses plugin-based architecture to support JSON, taxonomy, galaxy, and object template data formats.
• Threat Intelligence - Platform for sharing and collaborating on malware intelligence.
• Security Lab Environments - Platform for sharing indicators of compromise and threat intelligence.
• Development And Analysis Tools - Threat intelligence platform with YARA support.
• Malware Analysis - A platform for sharing threat intelligence and malware indicators.

Star history