MISP integration for Security Operations
MISP integration enables you to investigate security incidents by supporting capabilities like sightings search, observable enrichment, event search, along with the ability to create and update events in MISP.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-09-09 | 0 | - |
| 134 days of no change | ||
| 2026-04-27 | 29 | -29 |
| 263 days of no change | ||
| 2025-08-06 | 28 | +1 |
| 83 days of no change | ||
| 2025-05-14 | 27 | +1 |
| 1 days of no change | ||
| 2025-05-12 | 26 | +1 |
| 1 days of no change | ||
| 2025-05-10 | 25 | +1 |
| 191 days of no change | ||
| 2024-10-30 | 24 | +1 |
About
MISP integration enables you to investigate security incidents by supporting capabilities like sightings search, observable enrichment, and the ability to create and update events in MISP.
Key Features
This integration contains the following key features:
- Connect to private and public MISP instances.
- Supports manual and automatic sighting search of observables.
- Run sighting search from case management.
- Report or update sightings to an attribute:
- Report an observable as a sighting (Global).
- Report an observable as a false positive (Global).
- Report an observable as expired.
- Supports manual and automatic observable enrichment. Results include the MISP attribute and event information associated with the observables.
- Attribute enrichment in MISP (Bi-directional capability):
- Add or update tags, galaxies, or comments.
- Event creation in MISP from SIR:
- Supports manual and automatic creation of events in MISP from SIR.
- Update a MISP event from SIR:
- Add or update tags, galaxies, or attributes.
- Add SIR-associated observables as attributes to a MISP event.
- Auto-extract MITRE-ATT&CK™ information from MISP events and associate the information to SIR security incidents.
- Automatically add SIR MITRE-ATT&CK™ information as galaxies to a MISP event.