MISP: Share Threat Indicators With Trusted Partners (GitHub, Scanned)

MISP is a database and web app for indicators of compromise and the events they belong to. You record an incident or a malware campaign as an event, add attributes such as IPs, domains, hashes, email addresses and YARA rules, and MISP correlates every value against everything else it holds, including fuzzy hash and CIDR matches. Its real strength is sharing: instances sync with each other, and distribution levels and sharing groups decide down to a single attribute who sees what. Exports cover Suricata, Snort and Zeek rules, STIX 1 and 2, OpenIOC, CSV and RPZ zones, so the data can feed firewalls and SIEMs directly.

It is the reference tool for this job. MISP has run since 2011 and on GitHub since 2013, is led by CIRCL, Luxembourg's national CERT, and is used by CERTs, ISACs, militaries and companies worldwide; its JSON format is a de facto standard that other tools, OpenCTI included, read. The repository has about 6,600 stars, 371 contributors and more than 31,000 commits. v2.5.50 came out on 10 October 2026 and the last push was on 28 October.

It is AGPL-3.0 licensed, with copyright held jointly by all contributors, which the project points out means no single company can ever close it. The core is PHP on CakePHP with MySQL or MariaDB and Redis; misp-modules, a separate Python service, adds enrichment, import and export modules.

• Repository: github.com/MISP/MISP
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: PHP. Stars: 6,626. Forks: 1,659. Last push: Oct 28, 2026.
• Scan: safe, Oct 28, 2026, commit fc99c9e

Who it is for

CERTs and CSIRTs, ISACs and sector sharing communities, SOC teams that want to receive and contribute indicators, and malware researchers who need a structured store that talks to the rest of the security community.

Getting started

1. Clone the official Docker setup (needs Docker Engine 25+ and Compose 2.17+)

git clone https://github.com/MISP/misp-docker.git && cd misp-docker

2. Create your settings file, then edit BASE_URL and the passwords in it

cp template.env .env

3. Pull the prebuilt images and start MISP in the background

docker compose pull && docker compose up -d

4. Open http://localhost and log in as admin@admin.test with password admin, then change it

open http://localhost

Change the default admin password straight away. For a bare-metal install, INSTALL/ in the main repository holds about 750-line scripts for Debian 12 and 13 and Ubuntu 24.04 that run with sudo, install packages and enable services; read them before running one on a server that does anything else.

Safety scan

We cloned MISP/MISP at commit fc99c9e on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no committed binaries flagged across 3,233 files and about 550,000 lines of PHP, JavaScript and Python. The bare-IP URLs are in app/Test/UrlEgressValidatorTest.php, tests proving MISP refuses to fetch from internal or reserved addresses, which is a good sign.
• The three persistence hits are the install scripts running systemctl enable for Redis and Apache, which is what a server install is supposed to do. The installer scripts fetch from getcomposer.org, GitHub and misp.github.io only, and none pipes a download to a shell. The very long line is a vendored copy of markdown-it.
• Only 4 packages could be checked: the two advisories rated high are in urllib3, pinned by tools/misp-delegation, a standalone script that pushes events to another MISP and requests delegation there, not part of the web app. The PHP dependencies in app/composer.json have no lockfile, so Composer picks current versions when you install, and app/composer.phar is a committed copy of Composer itself. The JavaScript libraries under app/webroot/js are vendored files the scanner does not version-check.
• Two workflows, CI and CodeQL, no pull_request_target; the one third-party action is pinned to a tag. Security policy, Dependabot, CodeQL, contributing guide and code of conduct are present. There are about 2,700 open issues, a reflection of a large, long-lived user base rather than neglect: commits land daily.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: PHP 245.3K, JavaScript 100.2K, Markdown 82.8K, CSS 50.5K, JSON 32.2K, Python 18.2K.

Questions

Is MISP free?

Yes. MISP is AGPL-3.0 licensed and free to self-host for any purpose. If you modify it and make it available to others over a network, the AGPL asks you to share the changes. Some sharing communities charge membership, and a few companies sell hosted MISP, but the software costs nothing.

What should I check before sharing data through MISP?

Sharing indicators of compromise is legal and routine, but follow the community's rules: respect Traffic Light Protocol tags, set each event's distribution level deliberately, and remember that indicators can contain personal data such as email addresses. MISP's own PRIVACY.md and GDPR guidance explain the operator's obligations.

Do I need MISP if I already use OpenCTI?

Often both. MISP is built to exchange and sync indicators between organisations, and most sharing communities run on it. OpenCTI is built to analyse and model threats as a knowledge graph. Many teams join communities through MISP and feed those events into OpenCTI with its MISP connector.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.