MISP

MISP is an open-source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information such as fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, while separate instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, along with signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Imports and exports cover STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. It can run on-premise, in the cloud, or as SaaS; the project recommends Ubuntu 24.04 or misp-docker. The software is free under AGPL, with paid support and training options also listed.

MISP combines threat information analysis with granular sharing, synchronization, and automation tools. Its core software is free, while prioritized support and custom development have separate terms and costs.

MISP is suited to incident analysts, security and ICT professionals, and malware reversers who need to analyze and share threat information. Teams can use its sharing controls to set distribution at the attribute level.

MISP is an open-source platform for collecting, analyzing, and sharing cybersecurity indicators and threat information. It is best suited to incident analysts, security and ICT professionals, and malware reversers who need to coordinate analysis and exchange intelligence across teams. Its strongest case is the combination of granular sharing controls and automation; it is less compelling for organizations seeking a service that avoids deployment and policy-management work.

Overview

MISP brings indicator collection, storage, distribution, and sharing into a platform built for incident and malware analysis. Teams can run it on-premise, in the cloud, or as SaaS, with Ubuntu 24.04 or misp-docker recommended for deployment; it can also be installed on standard GNU/Linux distributions. That range gives organizations control over where intelligence lives, but choosing and operating an environment is part of the commitment.

Key features

Correlation supports fuzzy hashes and CIDR overlaps, while comments, sightings, opinions, proposals, and counter-analysis let analysts add context or challenge an assessment. This is useful for teams that need to refine intelligence collaboratively rather than simply collect indicators.

Distribution levels and custom sharing groups can control access down to individual attributes, and MISP instances can synchronize intelligence in real time. Notifications can be signed and encrypted with GnuPG or S/MIME, and shared information can be signed and validated. These are meaningful safeguards for exchanges between organizations, though teams still need to set and maintain appropriate sharing policies.

Automation includes an OpenAPI-described REST API, the PyMISP library, Python enrichment modules, and ZMQ or Kafka streaming channels. Imports and exports cover STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek; modules and APIs connect MISP to external services. Routing rules and alert enrichment extend its role beyond analysis into operational workflows. The breadth favors teams able to integrate and automate their processes, rather than users looking for a narrowly focused indicator viewer.

Pricing

The core MISP software is free, released as open-source software under AGPL. This is the clearest fit for teams prepared to deploy and support the platform themselves.

• Yearly support contract: €7.31 a year, billed per year. It covers business-hours ticket support and fast-tracked resolution of five issues; custom features are usually project-based. This suits teams that can run MISP but want a defined route for prioritized help.
• Sustainability support: €10.97 a year, billed per year, with a logo in the project website’s supporter section. It supports the project but does not include the issue-resolution terms of the support contract.
• Support contract with sustainability support: €18.28 a year, billed per year. It includes business-hours ticket support, fast-tracked resolution of six issues, and a supporter-section logo.
• On-site closed training: €365,618, paid once, billed per training day plus additional expenses, for up to 30–50 attendees depending on location conditions.
• Closed training in Luxembourg: €426,605, paid once, billed per training day, for up to 30 attendees, with food and beverages included.

Virtual hosting lists one managed organization and 100 GB of HDD space; dedicated hosting lists unlimited managed organizations and 500 GB. Paid professional services provide prioritized support, while new custom features are usually project-based. The core software remains free, but hosting and services are distinct from that self-managed option.

Platforms

MISP supports API, Linux, self-hosted, and web use. Deployment can be on-premise, in the cloud, or as SaaS, giving organizations options to match infrastructure and operating preferences.

Who it's for

MISP is a strong fit for incident analysts, security and ICT professionals, and malware reversers who need to correlate indicators, add analytical context, and control how intelligence is shared. It also suits organizations that can take responsibility for deployment and integration. Teams that want an out-of-the-box hosted workflow with minimal operational ownership should look elsewhere.

Pros and cons

• Pros: Attribute-level sharing controls and real-time synchronization support carefully governed exchange across teams and organizations.
• Pros: Correlation, collaborative analysis, APIs, streaming, and common security formats cover a broad intelligence workflow.
• Pros: The core software is free and can be deployed in several environments, including self-hosted and SaaS.
• Cons: Self-hosting requires an operating environment and ongoing administration; the deployment recommendations point to Linux-based setup.
• Cons: The support contract caps fast-tracked issues at five, or six with sustainability support, and support is limited to business hours.
• Cons: The training options are billed per day and the on-site option adds expenses, so they are not a simple extension of the free software.

Alternatives

Choose Kaspersky Threat Intelligence Portal if a web or API service with free access to curated features is a better fit; its free access limits suspicious files and URLs for Cloud Sandbox.

IBM X-Force Exchange is another web and API option with a free tier, but that tier provides limited portal access and no X-Force API access.

For attack simulation and tabletop exercises rather than MISP’s threat-information exchange focus, consider OpenAEV, whose Community Edition is free forever, on-premise, and includes community support.

Pulse Intelligence is a free, open-source self-hosted option when its listed prerequisites—Node.js 20.9+, PostgreSQL 17, and a Redis-compatible server—fit your environment.

ThreatForge offers a free, open-source Community Edition under AGPL-3.0-or-later.

IntelOwl is a free, open-source self-hosted alternative for teams looking for that deployment model.

Threat Intelligence Platform may suit users who prefer a web and API service with a credit-based free subscription: it starts with 100 credits, with web analysis costing 10 credits per request and API requests costing 1–3 credits each.

For paid dark-web monitoring plans with stated monthly seat and domain counts, consider SOCRadar Extended Threat Intelligence Platform.

Browse more options in Threat Intelligence Platforms or Alert Management Software.

Verdict

Choose MISP if your team needs detailed control over intelligence sharing, collaborative analysis, and automation, and can manage its deployment or arrange hosting. Its free open-source core is a substantial advantage; the main reason to look elsewhere is a preference for a simpler hosted service or a workflow centered on a different use case.