MISP

MISP is an open-source threat intelligence and sharing platform for storing, correlating, and exchanging indicators of compromise (IOCs). It supports sharing of threat data between organizations, feeds into detection systems, and provides a rich API for automation.

Centralizing and sharing threat intelligence IOCs across security teams and partner organizations.

• +Adopted by CERTs such as CERT-EU, and used to run sharing communities between organizations.
• +Supports standardized sharing formats including STIX, OpenIOC, and custom MISP objects.
• +Exports indicators for SIEMs and network IDS (Suricata, Snort, Zeek), plus DNS RPZ zones, for automated detection deployment.

• +Web application and database setup require dedicated Linux server infrastructure.
• +Effective use requires active curation of threat feeds and community sharing relationships.

Centralizing threat intelligence, distributing IOCs to detection systems, and enabling collaborative threat analysis.