As developers of the MISP project, we spend most of our time thinking about UUIDs, JSON schemas, and API synchronization performance. However, every so often, a piece of academic research comes along that reminds us why this work matters beyond the code.
The UI is undergoing its most significant transformation in years. With the introduction of the Overmind theme, MISP is transitioning to a modern stack.
FlowIntel is an open-source platform built for handling security investigations in a structured way. It combines case management, task tracking, documentation, and collaboration in one place.
Getting your MISP architecture right from the start makes all the difference. A well-designed deployment keeps your threat intelligence platform running smoothly, protects your data, and ensures your analysts have what they need when they need it. Poor choices lead to performance bottlenecks, security gaps, and maintenance headaches that only get worse as your data grows.
We are pleased to announce the release of MISP v2.5.32, bringing new workflow capabilities, improvements to attachment handling, security fixes, and multiple dependency updates.
The Next Generation Security Operator Training Infrastructure (NGSOTI) initiative was created to address a growing gap in cybersecurity education: the need to train analysts not only on tools, but on real-world workflows, collaboration models, and operational constraints. Rather than focusing on isolated technologies, NGSOTI brings together a coherent ecosystem of open-source projects designed to reflect how modern Security Operations Centers (SOCs) actually function.
In 2025, the MISP project hit its stride with the transition to the 2.5 branch, delivering a major UI/UX overhaul and modernized background processing to enhance platform performance. This progress was bolstered by significant updates to satellite projects, including taxonomies, objects, galaxy, misp-modules, misp-guard, and SkillAegis, ensuring that 2026 will be full of new surprises for both contributors and users as the ecosystem evolves.
📅 Release date: 2025-12-23
We are happy to announce the release of MISP v2.5.31, a maintenance-focused update bringing refreshed knowledge bases, UI refinements, improved synchronization behavior, and several important fixes.
This release introduces a foundational beta UI/UX mode (which will be the foundation for the next versions, feedback is more than welcome), new workflow modules, improvements to the Event Index, and important security updates.
MISP v2.5.28 delivers critical security fixes, a major dashboard upgrade to Gridstack 12, and significant platform stability enhancements. This release includes extensive XSS vulnerability patching, refined tag filtering logic, and better support for Meta Communities.
This release delivers important new modules, major internal performance optimisations, updates to validation logic, and several security fixes. A large amount of work focused on improving JSON handling, filter pipelines, encoding performance, and overall system robustness.
This release brings new features focused on performance improvements, logging enhancements, and data standardisation with the introduction of the UUID attribute type. It also includes several important bug fixes and dependency updates.
This release introduces a security fix, significant performance improvements for REST searches, new default feeds, and several important bug fixes.
This release focuses on security enhancements, bug fixes, and minor improvements to stability and functionality.
Thanks to Raphael Lob and Jeroen Pinoy from NATO Cyber Security Center for the security evaluation and report.
We’re rolling out MISP 2.5.23! This release is another step in our continuous effort to keep MISP running smoothly and effectively for the entire threat intelligence community. We know how crucial it is to have a reliable platform for sharing and analyzing threat data, and we’re committed to delivering regular updates that bring you solid improvements and quick fixes.
The goal of this tutorial is to integrate MISP with Wazuh, enabling automated threat intelligence correlation. When a new file is created on a monitored endpoint, Wazuh will query its hash against indicators stored in the MISP instance. If a match is found, Wazuh will automatically generate an alert, enhancing detection and response capabilities.
We are pleased to announce the release of MISP v2.5.22.
This release brings new features, improvements, fixes, and important updates to keep MISP stable and up to date.
To ensure effective threat intelligence sharing, MISP allows data synchronisation between different instances. The administrators of each instance can decide whether they want to send or receive data with the instances they want. In addition, synchronization also allows filtering between the data you want between public and private internal instances. However, this synchronisation mechanism must follow strict rules that define how and to what extent information can be shared.
We are pleased to announce the release of MISP v2.5.21.
This version introduces new features affecting the various correlation tools, important fixes, and various updates to objects, taxonomies, and galaxy.
Release date: 2025-08-20
MISP 2.5.19 brings important fixes, improvements to the on-demand correlation engine, refinements in the task scheduler, and better error handling.
© MISP project. Software released under approved open source licenses and content of this website released as CC BY-SA 3.0.
Template by Bootstrapious. Ported to Hugo by DevCows.
