AppBreakup
Submit an app
MISP logo

MISP

Open-source platform for storing, correlating and sharing threat intelligence and indicators of compromise.

Open sourceSelf-hostableThreat intelligence platforms

Updated · AppBreakup editorial · Self-hosted, Linux

Visit MISPSee 3 alternatives

Is MISP free?

Yes, free and open source

License:
AGPL-3.0

Checked on MISP's site Nov 8, 2026

Switch from MISP to

All 3
Verified facts
5 of 5
Alternatives ranked
3
Approved reviews
0
Visits sent from here
0

About MISP

MISP is a free, open-source threat intelligence and sharing platform used by CERTs, SOC teams, security researchers and malware analysts. Analysts store indicators of compromise and related context as structured events, and MISP automatically correlates attributes across events so links between incidents surface quickly. Data can be tagged with shared taxonomies and galaxy clusters such as MITRE ATT&CK, enriched through Python modules, filtered with warning lists and exported in formats like STIX and OpenIOC or as rules for IDS and SIEM tools. Its main strength is sharing: MISP instances synchronise with each other, which is how many national and sector communities exchange intelligence. The project began in the CERT world and its lead developer works at CIRCL in Luxembourg. It runs self-hosted on Linux, with an installer for Ubuntu 24.04 and production-ready Docker images. There is no paid licence; costs come from hosting, training and the time to operate it, and the interface is aimed at specialists rather than casual users.

Best for: CERTs and SOC teams that want a free, self-hosted way to store and share threat indicators.

MISP pricing (checked Nov 8, 2026)

Each line is quoted from MISP's own site, with the page it came from.

Plan or termWhat it saysCheckedSource
PriceFree to useNov 8, 2026misp-project.org

Pros and cons

What works

  • Free and open source under AGPL-3.0
  • Instance-to-instance sync suits trusted sharing communities
  • Automatic correlation across events and attributes
  • Exports to STIX, OpenIOC and IDS or SIEM formats

Why people leave

  • Self-hosted only; you run and secure the server yourself
  • Interface and data model take time to learn for non-specialists
  • No vendor-curated commercial feeds bundled in like paid platforms

MISP vs Anomali, Recorded Future and GreyNoise

From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.

AttributeMISPAnomaliRecorded FutureGreyNoise
PricingOpen sourcePaidPaidFree plan + paid
Verified price————
Free planFree appNoNoCommunity tier for IP lookups
Open sourceYesNoNoNo
Self-hostableYesNoNoNo
PlatformsSelf-hosted, LinuxWebWeb, Browser extensionWeb

Top MISP alternatives

See all 3
  1. 1Anomali logo
    Anomali

    Commercial platform that adds managed feeds, analytics and SIEM-scale matching.

    64.8
  2. 2Recorded Future logo
    Recorded Future

    Commercial intelligence service with broad curated collection and analyst reporting.

    61.8
  3. 3GreyNoise logo
    GreyNoise

    Focused on internet scanner and IP noise context rather than full IOC case management.

    59.4

Why people left MISP

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from MISP, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of MISP
Your rating of MISP

Never shown publicly. A work email helps us verify you.

What did you use it for, and what was good or bad? At least 40 characters.

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

MISP: common questions

What is MISP?

MISP: Open-source platform for storing, correlating and sharing threat intelligence and indicators of compromise. Best for CERTs and SOC teams that want a free, self-hosted way to store and share threat indicators. Available for Linux, and you can host it yourself.

Is MISP free?

Yes. MISP is free, open-source software that you can host yourself.

How much does MISP cost?

MISP is free and open source. Price: Free to use. Checked on MISP's own site, November 2026.

Is MISP open source?

Yes. The source code is on GitHub at MISP/MISP. You can also run it on your own server.

What platforms does MISP run on?

MISP is available for Self-hosted and Linux.

What are the best alternatives to MISP?

The highest-ranked MISP alternatives right now are Anomali, Recorded Future and GreyNoise. See the full ranked list for pricing, platforms and verified facts.

MISP vs Anomali: what's the difference?

MISP is free and open source; Anomali is a paid product. MISP is open source and Anomali is not. Only MISP runs on Linux. Only Anomali runs on Web.

See all 3 MISP alternatives