项目说明
MISP - Threat Intelligence Sharing Platform
-------------------------------------------
<img align="right" alt="MISP logo" src="./INSTALL/logos/misp-2-verti.png"/>
MISP is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and ICT professionals or malware re to support their day-to-day operations to share structured information efficiently.
The objective of MISP is to foster the sharing of structured information within the security community and abroad. MISP provides functionalities to support the exchange of information but also the consumption of said information by Network Intrusion Detection Systems (NIDS), LIDS but also log analysis tools, SIEMs.
● <a href="#core-functions">Core functions</a>
● <a href="#website--support">Website / Support</a>
● <a href="#installation">Installation</a>
● <a href="#documentation">Documentation</a>
● <a href="#contributing">Contributing</a><br>
● <a href="#privacy">Privacy</a>
● <a href="#license">License</a>
<table>
<tr>
<td>Latest Release</td>
<td><a href=" src=" alt="GitHub " height="25"></a></td>
</tr><tr>
<td>CI</td>
<td><a href=" src=" height="25" /></a></td>
</tr>
<tr>
<td>Gitter</td>
<td><a href=" src=" height="25" /></a></td>
</tr>
<tr>
<td>Mastodon</td>
<td><a href=" src=" height="25" /></a></td>
</tr><tr>
<tr>
<td>Twitter</td>
<td><a href=" src=" height="25" /></a></td>
</tr><tr>
<td>Localization</td>
<td><a href=" src=" height="25" /></a></td>
</tr>
<tr>
<td>Contributors</td>
<td><img src=" height="25" /></td>
</tr><tr>
<td>License</td>
<td><img src=" height="25" /></td>
</tr><tr>
<td>Software Heritage ID</td>
<td> <a href="
<img src=" alt="Archived |
</a> </td>
</tr>
</table>
![CLA FREE initiative]()
Core functions
------------------
A complete and robust threat intelligence sharing platform that can be deployed on-premise, in the cloud, or as a SaaS solution, suitable for organizations of all sizes. Threat intelligence, ranging from indicators, through techniques to tactics, can be easily described in MISP, from machine-readable actionable data to detailed reports in Markdown format.A flexible reporting system is integrated into MISP, enabling the description of threat intelligence with cross-references to the machine-readable components, including objects and attributes.A fast and efficient database for atomic data points, indicators to complex objects and selectors, enabling the storage of both technical and non-technical information related to cybersecurity intelligence as well as broader intelligence contexts.Automatic correlation engine, re relationships between attributes and indicators of malware, attack campaigns, analyses or other described threats. The correlation engine handles the interlinking of matching attributes as well as more ad correlation patterns such as fuzzy hashing o (e.g. ssdeep) and CIDR block matching. Correlations can also be enabled or event disabled at different levels of granularity.A flexible data model, where complex objects can be expressed and linked together to express threat intelligence, incidents or connected elements.Built-in sharing functionality to ease information exchange, using different, customisable, models of distribution. MISP can automatically synchronize events and attributes as well as higher le intelligence among different MISP instances. Ad filtering functionalities can be used to meet each organization's sharing policy including a flexible sharing group capability and granularity up to the atomic attribute level.An intuiti for end-users to create, update and collaborate on events and attributes/indicators, in addition to a graphical interface to na seamlessly between events and their correlations as well as an event graph functionality to create and view relationships between objects and attributes. Ad filtering functionalities and warning lists to help the analysts to contribute events and attributes and limit the risk of false-positives.A comprehensive workflow system to facilitate automatic, customisable data pipelines in MISP, including data qualification, automated analysis, modification, and publication control.Storing data in a structured format, enabling automated use of the database for purposes, with extensi for cybersecurity indicators, fraud indicators (e.g., in the financial sector), and broader intelligence contexts.All intelligence and information stored in MISP is accessible via the UI but also an extensive ReST API described as OpenAPI.Export: Generate outputs in formats, including native IDS formats, OpenIOC, plain text, CSV, MISP JSON, STIX (XML and JSON) 1 and 2, NIDS exports (Suricata, Snort, and Bro/Zeek), RPZ zones, and cache formats for forensic tools. Additional formats, such as PDF, can be easily added and are a via the misp-modules or customised as built in export modules.Import: Support for free-text import, URL import, bulk import, batch import, and importing from formats a long list of formats, including MISP's own standard format, STIX 1.x/2.0, CSV, or proprietary formats. Additional formats can be easily added via the misp-modules system.Flexible free-text import tool to simplify the integration of unstructured reports into MISP, with automatic detection and con of external reports URLs and text reports with an automatic con into MISP reports, objects, and attributes.A user-friendly system to collaborate on events and attributes allowing MISP users to propose changes or updates to attributes/indicators or provide own perspectives or counter-analyses to shared information.An extensive data analyst feature allowing analysts to add opinions, relationships, or comments to any intelligence in MISP, which can be shared using MISP's sharing mechanisms.Data sharing: Automatically exchange and synchronize information in real-time with other parties and trust groups using MISP, with support for granular sharing levels and custom sharing groups.delegating of sharing: allows for a simple, pseudo-anonymous mechanism to delegate the publication of MISP data to communities.Flexible API to integrate MISP with your own solutions. MISP is bundled with PyMISP which is a flexible Python Library to fetch, add or update events attributes, handle malware samples or search for attributes. An exhausti API to easily search for indicators in MISP and exports those in all the format supported by MISP.Built in tooling to build, test and analyse complex queries directly in the MISP GUI using a highly context aware, templated API client.Adjustable taxonomy to classify and tag events following your own classification schemes or existing classification. The taxonomy can be local to your MISP but also shareable among MISP instances.Intelligence called MISP galaxy and bundled with existing threat actors, malware, RAT, ransomware or MITRE ATT&CK which can be easily linked with events, reports and attributes in MISP.Expansion modules in Python to expand MISP with your own services or activate already a misp-modules.Sighting support to get obser from organizations concerning shared indicators and attributes. Sighting can be contributed via the MISP user-interface and the API as MISP data or STIX sighting documents.MISP Standard Format support is integrated into MISP and used by a long list of tools and organisations worldwide. The MISP standard format is stable and backward compatible with older datasets.STIX support: Import and export data in STIX 1 and 2 formats, le the powerful misp-stix library.Integrated encryption and signing of the notifications and/or S/MIME depending on the user's preferences.Dashboard feature: Integrated into MISP, allowing users and organizations to create and share custom composited dashboard configurations as well as build bespoke monitoring solutions directly in a drag and drop interface.Real-time publish-subscribe channel within MISP to automatically get all changes (e.g. new events, indicators, sightings or tagging) in ZMQ (e.g. SkillAegis) or Kafka publishing.Flexible logging subsystems to help with the auditing of the system as well as the user-base's actions on the system, with output formats supported as well as a wide range of transport mechanisms for centralised logging needs.Customisable RBAC, allowing configurations of MISP to be run both as a permissi tool as well as tightly regulated community instances.Information signing and for more diverse and sensiti sharing communities.Batteries included: A long list of tooling for backups, integration with identity pro and authentication systems, information leakage pre safety nets (such as MISP-Guard) as well as system monitoring tools.Open-source commitment: MISP and its copyright is fully owned by an interlocked license among all contributors, ensuring that no single organisation or company can e the license or model of MISP. Users of MISP can rely on the tool ne into a closed source / proprietary / semi-open multi-tier model tool.Main ad
The main benefit of using MISP is its ability to serve as a comprehensive and robust platform for threat intelligence sharing and collaboration, enabling organizations of all sizes to:
Centralize and manage intelligence: Store, structure, and analyze both technical and non-technical threat intelligence efficiently.Enhance collaboration: Share information securely and flexibly with trust groups, le granular sharing mechanisms and real-time synchronization.Impro and response: Correlate indicators, enrich intelligence, and automate workflows to enhance detection, analysis, and response capabilities.Foster integration and interoperability: Seamlessly integrate with existing tools and systems using APIs, modular extensions, and support for standard formats like STIX and MISP's own standardized format.Enable actionable insights: Provide actionable, machine-readable intelligence while also supporting detailed reporting for strategic and operational decision-making.MISP empowers cybersecurity teams with a scalable, flexible, and user-friendly platform to streamline their threat intelligence processes and impro collecti capabilities.
!MISP 2.5 o
A sample event encoded in MISP:
!MISP event view
Website / Support
------------------
Checkout the website for more information about MISP software, standards, tools and communities.
Information, news and updates are also regularly posted on the MISP project Mastodon account, twitter account and news page.
Installation
-------------
For test- or production-installations we recommend you check out the possible options on misp-project.org/download.
Documentation
-------------
MISP user-guide (MISP-book) is a online or as PDF or as EPUB or as MOBI/Kindle.
It is also recommended to read the FAQ
Privacy
-------
MISP is software that organisations operate in their own en. Privacy
and data-protection responsibilities therefore depend on the relevant instance,
operator, processing activity, and applicable jurisdiction or sector. The GDPR
guidance is relevant only where the GDPR applies; other legal or regulatory
frameworks may apply instead of, or in addition to, it. See the
MISP privacy statement for details and a reference to the
project's GDPR guidance.
Contributing
------------
If you are interested to contribute to the MISP project, review our contributing page. There are many ways to contribute
and participate to the project.
Please see our Code of conduct.
Feel free to fork the code, play with it, make some patches and send us the pull requests via the issues.
Feel free to contact us, create issues, if you ha, remarks or bug reports.
There is one main branch (2.5) and one stable branch for 2.4:
2.5 (current stable ): what we consider as stable with frequent updates as hot-fixes.2.4 (legacy stable ): what we consider as stable with frequent updates as hot-fixes until April 2025.Along with two de branches:
develop (main de): The branch containing all ongoing work, to be merged into 2.5 at each release2.4-develop (2.4 de): The branch containing ongoing work to be merged into 2.4 on each legacy release along with frequent merges into develop. We consider this the main entry point for new de for 2.x until the 6 months grace period is up.License
-------
This software is licensed under GNU Affero General Public License 3
* Copyright (C) 2012-2026 Christophe
* Copyright (C) 2012 Belgian Defence
* Copyright (C) 2012 NATO / NCIRC
* Copyright (C) 2013-2026 Andras Iklody
* Copyright (C) 2015-2026 CIRCL - Computer Incident Response Center Luxembourg
* Copyright (C) 2016 Andreas Ziegler
* Copyright (C) 2018-2026 Sami Mokaddem
* Copyright (C) 2018-2026 Christian Studer
* Copyright (C) 2015-2026 Alexandre Dulaunoy
* Copyright (C) 2018-2022 Ste
* Copyright (C) 2020-2026 Jakub Onderka
For more information, the list of authors and contributors is a.
项目信息
开发语言：PHP
Star 数：6568
技术要点
该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MISP (core software) - Open Source Threat Intelligence and Sharing Platform展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。