Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

MISP

Free#34 of 36 in Alert Management SoftwareThreat Intelligence Platforms

MISP: A threat-intelligence platform for collecting, correlating, analyzing, and sharing indicators. Ranked #34 of 36 in Alert Management Software by our editors (6.0/10); pricing: Free plan; best for threat-intelligence analysts.

6.0/10Editor score
Visit MISP
MISP6.0 Visit MISP

At a glance

  • Editor score
    6.0 / 10
  • Pricing
    Free plan
  • Best for
    Threat-intelligence analysts
  • Free plan
    Yes
  • Paid from
    Free
  • Facts checked
    19 Sep 2026
MISP screenshot

  • Where it wins

    • Correlates shared indicator values across events automatically
    • Supports customizable enrichment, tagging, publication, and webhook workflows
    • Offers feeds, APIs, synchronization, and structured threat-intelligence formats

  • Where it doesn't

    • Designed for threat intelligence, not conventional alert management
    • Does not provide verified alert deduplication or suppression rules
    • Requires deployment on organizational infrastructure

Our verdict on MISP

MISP is an open-source platform for collecting, storing, correlating, analyzing, and sharing cyber-threat intelligence. It is intended for incident analysts, security and ICT professionals, malware reversers, and organizations coordinating threat information. The web interface brings together event and attribute management, structured data models, feeds, visualization, and analyst collaboration. MISP is a better fit for teams working with threat indicators than for organizations seeking a conventional alert-management product.

Its strongest capabilities center on organizing and exchanging intelligence. MISP automatically correlates shared indicator values across events and supports customizable workflows for enrichment, tagging, publication, webhooks, and blocking operations. Feeds are supported in MISP, CSV, and freetext formats, while taxonomies, galaxies, and objects provide structured ways to represent data. Warning lists can help identify potential false positives and exclude matching attributes from exports. Dashboards, event graphs, and collaboration features support analysis within the platform.

MISP can run on an organization’s own infrastructure, including standard GNU/Linux distributions and Docker-based environments. Synchronization and granular distribution controls support sharing between MISP instances, and a REST API plus PyMISP enable automation. Import and export options include STIX, OpenIOC, CSV, and IDS formats, with SIEM and NIDS among the listed integrations. MISP is free and open source, with no paid tiers described. Choose it when intelligence correlation and controlled sharing are central to the work; teams needing alert routing, verified deduplication, or suppression rules should consider a purpose-built alert-management tool instead.

Your product? Our editors can test MISP in depth and publish a review, labelled as paid · from $149/mo →

MISP pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on misp-project.org

MISP fact sheet

Free planYes
Paid fromFree
Alert deduplicationNot verified
Routing rulesYes
Alert enrichmentYes
Suppression rulesNot verified
Included alert volumeNot verified
Alert retentionNot verified
DeploymentCloud, Desktop, Self-hosted
PlatformsWeb, Linux
Integrations6 integrations: STIX, OpenIOC, SIEM, NIDS, PyMISP, MISP instances
PricingFree plan
Websitemisp-project.org
Facts checked19 Sep 2026

MISP integrations

MISP lists 6 integrations on its own site.

  • STIX
  • OpenIOC
  • SIEM
  • NIDS
  • PyMISP
  • MISP instances

Alternatives to MISP

See all MISP alternatives →

Also Ranked In

MISP is ranked in 2 of our directories.

Used MISP? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used MISP for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — MISP 6.0/10

MISP is listed in our Alert Management Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/misp/"><img src="https://www.itechguides.com/best/badge/misp.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update