Help, Support, and Forums

Help and support for MISP is available from the documentation, GitHub issues, and Gitter rooms which are explained below. The MISP Project offers paid support services, and a number of 3rd party providers commercial support.

If you’re looking for known issues or would like to file a bug report, please see the issue tracker. These issues are constantly being updated and may contain workarounds for problems that you’re experiencing, so it’s worth searching the issue tracker as a first step.

Staying safe

The Gitter rooms are open to the public and their contents are crawled by search engines and archived by third-party services outside of our control. Therefore, do not post anything that you are not comfortable seeing discussed in public. If confidentiality is a concern, send an email to info@circ.lu, encrypted with our GPG fingerprint (22BD 4CD5).

The MISP community includes people from all walks of life and from around the world. Individuals differ in areas of experience and technical expertise. You will come into contact with others whose views and agendas differ from your own. Everyone is free to write what they please, as long as it doesn’t violate our Code of Conduct. Be friendly and open, but do not believe everything you read. Use good judgment, and be especially careful when following instructions (e.g., sharing files) given by others on the lists.

Discussion guidelines

MISP discussions mainly take place on the MISP/MISP, MISP/Support, MISP/Docker, MISP/misp-cloud and MISP/Sharing Gitter rooms, all of which are explained below. Most questions should be directed to the MISP/Support room. Discussions also take place on GitHub issues.

Please do not send questions to individual MISP developers. By sending messages to the appropriate rooms, you are not only giving others a chance to help you, but you may also be helping others by starting a public discussion about a shared problem or interest.

These discussion venues are open places where people freely come together to discuss MISP and voluntarily help each other out of mutual interest and goodwill. They are not your personal, paid support service. No one owes you a reply or is obliged to help you solve your problems. Nonetheless, there are many things you can do to make it more likely that you will receive a reply. The MISP community is fortunate to have a lot of friendly and knowledgeable people who enjoy corresponding on these discussion channels The vast majority of them will be happy to help you if you follow these simple guidelines:

• Be polite and respectful: Remember, no one here is obliged to reply to you. If you are rude and disrespectful, you are very likely to be ignored.
• Be concise: Include only essential information. If you ramble, it will be easier to skip over you and help someone else who gets right to the point.
• Help us help you: Tell us what you’ve already tried, and which documentation pages you’ve already read. Think of your readers. What essential information would they require to be able to help you? Make sure to include that information in your message. Read this article: Ask questions the smart way.
• Be patient: If it seems like your messages to the rooms are consistently being ignored, ensure you’re following the guidelines above. If you’re already doing so but still not getting any replies, then it’s likely that no one who knows the answer has had time to reply yet. Remember that the developers are very busy working on MISP, and can not answer every question.
• Be a good community member: As with any social community, members earn different reputations for themselves over time. Those who have shown themselves to be good community members through their past contributions have earned our goodwill, and we will be especially eager to help them and collaborate with them. If you are new to the community, you should understand that it may take time for you to earn the goodwill of others. This does not mean that you will not receive help. On the contrary, we are lucky to have a community that helps strangers, including many who post anonymously.
• Report issues and submit changes in the right places: The Gitter rooms are good places to ask questions and discuss things. However, if you’re submitting a more formal report, we’d prefer that you submit it to the appropriate GitHub issue tracker so that it doesn’t get overlooked. Likewise, if you see that something in the documentation should be changed, don’t simply point it out in a discussion venue. Instead, submit the change.
• Moderation: The moderation team aims to enforce our Code of Conduct. Beyond this, users should not expect any specific action from the moderation team. Specifically, users should not request that posts or messages be deleted or edited by a moderator. Users are reminded that, in most venues, anything posted will be sent out as an email to others, and these emails cannot be deleted from others’ inboxes.
• Suggestions: We are generally open to hearing suggestions for new features. Our roadmap is based on requests from people who use MISP. However, it is rather unlikely that we will change our schedule in order to accommodate an individual request. If there’s a particular feature you’d like to see in MISP, a much more effective way to make it happen is to contribute a patch that implements it. We happily accept such contributions, provided they meet our standards. Please note, however, that it’s always a good idea to field a discussion of your idea on the MISP/MISP Gitter room or by creating a GitHub issue before putting in a lot of hard work on something that we may not be able or willing to accept.

Gitter

This section covers each of our rooms, with details about the purpose of each list and how to use it. To join a room on Gitter, click the “Join” button at the bottom of the page. If you prefer, you can view all these rooms on Matrix by clicking the [m] button on the navigation bar.

• MISP/MISP: This room is meant for general MISP discussions, particularly for MISP developers and development-related questions. This room is primarily intended for people who are interested in contributing to MISP or who are willing to learn more about its implementation. Examples of topics and questions suitable for this room include:
  • Questions about why we made certain implementation decisions. For example: “Why did you implement XYZ this way and not the other way?”
  • Questions about code layout and where code is for certain functionality.
  • Discussions about proposed new features and patches. For example: “I would like to implement feature XYZ.”
  • Security discussions that are relevant to MISP in some way.
• MISP/Support: This room is for helping users solve various daily problems with MISP. This is the ultimate support channel for all things MISP. Come prepared with log files if appropriate. Please try searching the archives of the channel before sending a question. Also, please make sure that you have read and understood the documentation before posting it to the room. Examples of topics or questions suitable for this list include:
  • Installation problems
  • Questions of the form: “How do I…?”
• MISP/Sharing: This channel is for general discussions on threat intelligence sharing topics.
• MISP/Docker: This room is for conversations related to MISP Docker or using MISP on Docker.
• MISP/misp-cloud: This room is meant for convos about MISP Cloud or using MISP on a cloud environment.

GitHub issues

You can also ask questions by creating an issue on the appropriate GitHub repo. In the MISP core repository, use the Support issue template when seeking support.

To be clear, GitHub issues is not a replacement for the MISP/Support room. This is simply an additional place for discussion. Certain types of discussions naturally lend themselves more to GitHub issues or forums, and different types of users prefer different venues. We’ve heard from some users who find the Gitter to be a bit intimidating or who may feel that their message may get lost in the thousands of messages. Others want more selective control over topic notifications. Whatever your reasons, it’s up to you to decide where and how you want to join the conversation.

Social media

MISP Project has a presence on Twitter (@MISPProject).

Generally speaking, this is not intended to be a primary support venue. (Those would be MISP/Support Gitter room and the issue tracker.) Rather, these are primarily intended to be a way to more widely disseminate news related to MISP. If you use Twitter, you may find it convenient to follow the MISP Project there as a way of receiving MISP

MISP is also present in the fediverse at @misp@misp-community.org.

Email

Please use the previously mentioned channels if you need technical support.

If you have any other enquiries or are willing to contribute or support the project, don’t hesitate to contact the team at info@misp-project.org.