## MISP (Malware Information Sharing Platform)

**MISP** is the de-facto standard for sharing threat intelligence. It is free, open source, and used by NATO, Governments, and 6,000+ organizations.

### The MISP Data Model
Understanding MISP requires understanding its hierarchy:

1.  **Event**: The "Folder".
    *   *Example*: "Emotet Phishing Campaign - Dec 2024".
    *   Contains metadata: Date, Org, TLP Level.
2.  **Attribute**: The "File".
    *   *Example*: `192.168.1.1` (ip-dst), `malware.exe` (filename).
    *   **IDS Flag**: If checked, this attribute is exported to NIDS/SIEM.
3.  **Object**: A template for complex data.
    *   *Example*: A "File" object links `filename`, `md5`, `sha1`, and `size` together so context isn't lost.
4.  **Galaxy (Tags)**: High level context.
    *   *Threat Actor*: "APT29".
    *   *Mitre technique*: "T1566 - Phishing".

### The Sharing Graph
MISP instances synchronize.
*   **Pull**: You connect to `CIRCL.lu` (The main European node) and download 50,000 events.
*   **Push**: You create an event about a new threat and "Publish" it. It replicates to all your partners instantly.
*   **Filter**: You can say "Pull everything EXCEPT events marked TLP:RED."

### Why use MISP?
*   **Cost**: Free.
*   **Community**: It is where the community lives.
*   **Formats**: Exports to STIX, CSV, Snort, Suricata, Bro/Zeek automatically.