MISP Updates

Andras Iklody gives a yearly recap of the MISP threat-intelligence sharing platform, covering development since the previous CTI Summit. He reports a steady monthly release cadence, a large volume of commits from many contributors, and ongoing work toward a new framework generation called MISP 3. Much of the effort has gone into bug fixes, minor improvements and internal refactoring meant to ease the later port.

The middle of the talk walks through notable features. Workflows now offer many new actions and filters, with a worked example from a hackathon. A one-way push of filtered data to external sharing servers is available in the sync actions menu. Native OTP can be mandatory or optional, with single-use fallback tokens. Tags can now carry a verb describing their relationship, timelines were reworked for large events, and enrichment works on whole objects. Dashboard widgets are configurable, and admins gain better logging and API keys bound to IP ranges.

The closing section covers security: thirteen CVEs in the past year, and a fuzzing tool from a firm contracted by the Luxembourg army that found issues the team would otherwise have missed. The MISP 3 effort aims for full API compatibility with MISP 2 and a more analyst-centric interface, and contributions are welcome. Practitioners should update to current releases and review the features they may have missed.