# MISP: Collect and Share Cyber Threat Intelligence This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/misp-misp Generated for open source discovery and AI-assisted research. MISP is an open-source platform for collecting, analyzing, storing, and sharing structured cyber threat intelligence. Security teams can collaborate across MISP instances and connect intelligence to detection and analysis tools. GitHub: https://github.com/MISP/MISP OSRepos URL: https://osrepos.com/repo/misp-misp ## Summary MISP is an open-source platform for collecting, analyzing, storing, and sharing structured cyber threat intelligence. Security teams can collaborate across MISP instances and connect intelligence to detection and analysis tools. ## Topics - cybersecurity - security - php - self-hosted - threat-intelligence - threat-sharing - indicator-management ## Repository Information Last analyzed by OSRepos: Tue Nov 10 2026 02:39:23 GMT+0000 (Western European Standard Time) Detail views: 5 GitHub clicks: 0 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview MISP is an open-source threat intelligence sharing platform for collecting, storing, distributing, and sharing indicators and information about cybersecurity incidents and malware. It helps incident analysts, security teams, and ICT professionals turn threat observations into structured intelligence that can be analyzed and exchanged with trusted communities. Organizations can run MISP on-premises, in the cloud, or as a service. Its sharing controls and synchronization support collaboration between separate instances, while its API and export formats let other security tools consume the data. ## Key Features - Store structured indicators, reports, objects, and other technical or non-technical intelligence. - Correlate matching attributes and indicators, including through fuzzy-hash and CIDR matching. - Share and synchronize events and intelligence between instances with configurable distribution rules and sharing groups. - Import and export data in formats including MISP JSON, STIX, CSV, OpenIOC, and NIDS formats such as Suricata and Snort. - Use a REST API, documented with OpenAPI, and the accompanying PyMISP Python library to integrate with other systems. - Enrich and classify intelligence with taxonomies, MISP Galaxy vocabularies, and optional Python expansion modules. - Automate data handling and publication through configurable workflows, and publish changes through ZMQ or Kafka. ## Use Cases - A security operations or incident response team can collect indicators from investigations and share them with trusted partner organizations. - A threat intelligence team can connect indicators, reports, malware, and campaigns, then provide machine-readable outputs to detection tools. - A group operating multiple MISP instances can synchronize intelligence while applying different sharing rules to different partners or data. - Fraud and information-security teams can structure and exchange indicators relevant to their own investigations. ## Our Take MISP is an actively maintained, integration-oriented platform for teams that need structured threat intelligence sharing, with regular releases and contributions from a broad contributor base. **Good fit if:** - Your organization needs to collect, correlate, and share cyber threat intelligence with control over distribution. - You want a platform with APIs, standard data formats, and integrations for security tools. - Your team can operate a self-hosted platform and comply with the AGPL-3.0 license. **Look elsewhere if:** - You need a ready-to-use threat feed rather than software for managing and sharing intelligence. - Your team cannot take on operating and maintaining a MISP instance. - AGPL-3.0 obligations do not fit your distribution or integration model. ## Project Health | Signal | Value | |---|---| | Status | **Active**: regular commits and releases | | Last commit | 2026-11-01 (8 days ago) | | Commits, last 90 days | 100+ | | Releases, last 12 months | 26 (latest v2.5.50, 2026-10-10) | | Contributors | 100+ (top contributor: 38% of commits) | | Issues closed, last 90 days | 13+ (typically closed in 1 day) | | Pull requests merged, last 90 days | 35 (typically merged in 0 days) | | Project age | 13 years | Checked on 2026-11-10 with the GitHub API. ## Project Facts - Language: PHP - License: AGPL-3.0 - Stars: 6.7k - Forks: 1.7k - Topics: cti, cybersecurity, fraud-detection, fraud-management, fraud-prevention, information-exchange, information-security, information-sharing - Website: https://www.misp-project.org/ - Archived: no ## What You Need Detected in the repository: - Python (from requirements.txt) - A test suite and automated checks on GitHub Actions ## Getting Started For test or production installations, start with the [MISP installation options](https://www.misp-project.org/download/). See the [README](https://github.com/MISP/MISP) and [MISP user guide](https://www.circl.lu/doc/misp/) for setup and operating details. ## License in Plain Words **AGPL-3.0** (network copyleft). - Commercial use: yes - Modify and redistribute: yes - You must keep: the license notice - Share your changes: yes, the full source, also when people only use it over a network (e.g. as a hosted service) - Includes an explicit patent grant from the contributors A summary, not legal advice: the LICENSE file is what applies. ## Considerations MISP is a substantial platform intended to be operated by an organization or service provider, rather than a standalone indicator feed. Plan for deployment, configuration, access controls, and ongoing operations. The repository identifies PHP as its primary language and lists Python in its requirements; consult the installation documentation for the full environment needed for your deployment. The project is actively maintained, with recent commits and frequent releases, and its contributor base is not concentrated in one person. The AGPL-3.0 license should be reviewed when deploying or modifying the software, especially if you distribute modified versions or offer them as a network service.