The MISP project is pleased to announce misp-modules v3.1.1, one of our largest recent expansions of the module ecosystem. This release brings 33 new expansion modules, new integrations for security controls and automation, and a broad set of fixes to existing connectors.
MISP v3.0 is here in Early Access. It is the biggest change to the way you work in MISP in years: a complete new interface, a page for every value you hold, analyst profiles that decide what matters to you, and graphs you can pivot through, keep and share. The data model, the API and sync stay what you know, so your tools, your scripts and your sharing partners keep working.
Release date: 14 October 2026
We are pleased to announce MISP Modules v3.0.12, a significant release focusing on richer threat intelligence enrichment, improved interoperability with MISP objects, new enrichment capabilities, and increased reliability across existing modules.
MISP 2.5.50 brings a substantial set of security fixes, continued development of the Overmind user interface, and the consolidation of several legacy features into their modern replacements. The release also improves TAXII connectivity, object handling, event graphs, statistics, and day-to-day administration.
This is mainly a security release. It closes a large batch of findings from the autumn 2026 review round, and every instance should be updated. Alongside the security work it brings a new XLSX export, tag removal from misp-module results, and a set of sync, ACL and correlation bug fixes.
MISP 2.5.47 is the outcome of the most intensive security review the project has gone through in a long time, and it ships alongside three larger pieces of work: a ledger-based database migration system that also brings PostgreSQL support, the first release of the AI-assisted analysis integration, and another big batch of Overmind improvements. It also closes a background-job regression introduced in 2.5.45 and a set of CSRF regressions from the 2.5.46 hardening.
MISP 2.5.46 is out, and the project continues to move at a very active development pace.
This release brings together a large security review, significant performance improvements, major updates to the MISP knowledge bases and submodules, many fixes contributed by the community, and another substantial round of work on Overmind, the evolving MISP user interface.
A large six-week cycle (herding kids, pets, bots is tiring in the heat, especially without an HVAC). Three themes dominate: the continued Overmind (Bootstrap 5) UI migration, a full revamp of LDAP authentication, and a concentrated security and correctness hardening pass.
CTI-Transmute is an open-source service for converting threat intelligence between formats - MISP and STIX today, more to come - with a catalogue on top to store, share, comment on and evaluate the results. It wraps the misp-stix library behind a web UI and a public API.
This is a hotfix release, primarily addressing a bug in the pull synchronisation mechanism that could cause failures when pulling events without any tags. It also ships a large batch of Bootstrap 5 views for the Overmind theme along with a couple of smaller fixes.
This MISP release 2.5.42 and is primarily a security hardening release, alongside a large iteration on the new Overmind UI, new TAXII scheduled-push capability, and the usual data-library refreshes.
A sizeable feature release headlined by collection synchronisation between instances, continued rollout of the Overmind (Bootstrap 5) UI, the first cut of the Pivotick pivot explorer, environment-variable-based settings, and a batch of security and sync hardening fixes.
In the previous post we used zsazsa to build a daily threat briefing from the material you already collect in MISP. We stay with the same approach, creating products from the information you have, but this time we focus on one of the most routine jobs for a CTI team: turning a CVE into a vulnerability advisory.
zsazsa is a small application that supports day-to-day CTI work, including stakeholder management, handling PIRs, GIRs and RFIs, data collection, and the creation of threat intelligence products. No external tooling is required, MISP acts as the back-end storage layer. Events, reports, and the final intelligence products are all stored in MISP. A nice side effect is that those products are not limited to the usual notification channels like Mattermost or Teams; they can also be shared through the standard MISP sharing and distribution model, in the same way as threat events. You can find zsazsa on GitHub: https://github.com/cudeso/zsazsa/.
MISP 2.5.39 is now available. This release includes a large set of improvements around the new dashboard experience, analyst-focused dashboard widgets, STIX interoperability, security fixes, and operational stability.
A focused release with two security fixes, a new workflow action module, continued Overmind UI migration of the Sync tab, TAXII 2 conformance work, and the usual round of community-contributed bug fixes.
We are happy to announce the release of MISP v2.5.37, headlined by the brand-new Event Templating system — a complete redesign that replaces the legacy templating engine. This release also introduces a dedicated suricata attribute type, continues the Overmind UI migration, switches the STIX 2 stack to the upstream library bundled with misp-stix, ships several security fixes, and brings new performance tooling for large instances.
The MISP v2.5.35 release introduces significant architectural improvements to the Event View, massive performance optimizations for attribute searching, and critical security hardening for installers. This version marks a major step forward in the “Overmind” UI project, transitioning toward a more modern, responsive user experience.
Note: This post also appeared on the VMRay website: Setting up UniqueSignal in MISP.
Last year VMRay announced UniqueSignal, a threat intelligence feed that includes:
misp-stix is the Python library powering bidirectional conversion between MISP and STIX (versions 1.x, 2.0, and 2.1).
It is used by MISP core software, available as misp-stix on PyPI, and also available directly as a conversion service on cti-transmute.org.
© MISP project. Software released under approved open source licenses and content of this website released as CC BY-SA 3.0.
Template by Bootstrapious. Ported to Hugo by DevCows.
