MISP (Malware Information Sharing Platform) is the leading open-source threat intelligence platform. Originally developed by CIRCL (Luxembourg CERT), it is now the backbone of many ISAC and national CSIRT sharing communities.

Core concepts to know:

• Events containing Attributes (IP, hash, URL, file, etc.).
• Galaxies and Clusters mapping IOCs to MITRE ATT&CK, threat actor groups, malware families.
• Sharing groups with fine-grained distribution rules.
• Sightings to record that an IOC was seen in your environment.
• MISP feeds and the TAXII server module for automated distribution.

• Centralised IOC management for a SOC
• Sharing intel with sector ISACs and partners
• Feeding SIEM/EDR with curated indicators via API