MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing structured threat indicators and intelligence. At its core, it provides a distributed synchronization protocol for transferring events between instances, an attribute-based correlation engine that links matching indicators across events, and a REST API with an OpenAPI specification for programmatic access to threat data. The platform uses formal data formats for JSON, taxonomy, galaxy, and object templates to enable compatibility across tools and communities.
The platform distinguishes itself through granular sharing group models that allow per-attribute visibility controls, a workflow automation pipeline for qualifying and publishing threat data, and support for multiple deployment methods including Ansible, Docker, Puppet, and RPM packages. It offers bidirectional TAXII exchange, scheduled push capabilities, and a reverse proxy compatibility layer for large event synchronization. The platform also includes background worker queues for asynchronous processing and plugin-based data format support.
Beyond its core sharing and correlation functions, MISP provides capabilities for importing indicators from PDF reports, managing feed duplication and correlation bloat, and navigating threat data graphically through event graph visualizations. It includes administrative tools for resetting credentials and wiping all data, as well as security hardening measures such as authentication bypass configuration and certificate trust store management. The platform ships with comprehensive documentation in multiple formats and training materials for learning its capabilities.