IntelMQ
Feed automation · Austria
Read the tool profileDocumented support
MISP bots collect events, look up matching source IPs, create MISP feeds and create events through the MISP API.
MISP integrations, in detail.
A documented integration with MISP. Check direction, connector requirements and the linked upstream instructions.
Filter these toolsCheck the actual function
Each entry describes the documented operation and links to its source. A format reference, an optional connector and built-in execution are different capabilities. Check the note before shortlisting.
Before you connect it
Confirm your product version, edition, connector and access requirements in the upstream instructions. These listings record documentation, not a tested configuration. Read the evidence standard.
14 tools with documented MISP integration evidence.
n6
Feed automation · Poland
Read the tool profileDocumented support
Includes a configurable MISP collector that fetches events and attached samples through PyMISP and publishes them to n6 queues. This is ingestion into n6, not a bidirectional connector.
OpenCTI
Threat intelligence · France
Read the tool profileDocumented support
Optional external-import connector pulls MISP events and attributes into OpenCTI as STIX 2.1 objects. It requires MISP API access; this connector imports in one direction.
TheHive
Response coordination · France
Read the tool profileDocumented support
Imports MISP events as alerts and exports case observables marked as IOCs to MISP. Connecting multiple MISP servers requires a paid TheHive license.
AIL Framework
Threat intelligence · Luxembourg
Read the tool profileDocumented support
Exports AIL objects and investigations in MISP formats, with automatic exports configurable for selected detections and tags.
Cerebrate
Response coordination · Luxembourg
Read the tool profileDocumented support
Orchestrates connected MISP communities and can push sharing groups for restricted information exchange.
CrowdSec Security Engine
Detection and monitoring · France
Read the tool profileDocumented support
The optional MISP Feed Generator polls CrowdSec decisions and exposes them as a MISP feed over HTTP(S). Requires a CrowdSec Local API key and a separately configured feed subscription in MISP.
DFIR-IRIS
Response coordination · France
Read the tool profileDocumented support
The bundled IrisMISP module enriches supported IOC types using one configured MISP instance. It needs configuration before use; automatic lookups on IOC creation or update are opt-in.
Flowintel
Response coordination · Luxembourg
Read the tool profileDocumented support
Provides export modules for MISP and enrichment using misp-modules, alongside MISP taxonomies and galaxies for case context.
IntelOwl
Threat intelligence · Italy
Read the tool profileDocumented support
MISP analyzers look up observables and hashes; a configured connector creates a MISP event linking an IntelOwl analysis.
Lookyloo
Threat intelligence · Luxembourg
Read the tool profileDocumented support
Optional modules look up captured indicators in MISP and push captures as events. Both are disabled by default and require a MISP API key; publish and lookup actions require an authenticated Lookyloo user.
Suspicious
Malware analysis · France
Read the tool profileDocumented support
Optional integration pushes indicators to one or more configured MISP instances, with configurable classification tags and API credentials per instance.
VMRay Platform
Malware analysis · Germany
Read the tool profileDocumented support
VMRay's separately deployed vmray-misp-feed script periodically converts platform analysis results to MISP events. Requires VMRay API access and MISP access to the generated feed; report attachments, tags and IOC-only export are configurable.
Watcher
Threat intelligence · France
Read the tool profileDocumented support
Exports monitored domains from Website Monitoring and DNS Threats Monitored to MISP. Requires a configured MISP instance and API key; the UI tracks whether a domain has already been exported.
A missing tool may support this feature without having been checked in this research pass.
Send a source or correction