MISP

No entries match these filters. Clear filters

1. v2.5.50 Oct 10, 2026 · issue 101

   MISP 2.5.50 adds phishunt.io feed, object-relation usage stats, Overmind UI overhaul, and migrates legacy discussions/templates to modern replacements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.50 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.50

   • Adds objectRelationUsage statistics operation reporting how frequently relations are populated across MISP objects, grouped by the latest version of each object template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds MISP.redis_host, Plugin.ZeroMQ_redis_host, and SimpleBackgroundJobs.redis_host settings as CLI-only — these can no longer be changed through the web interface or API, reducing risk from a compromised admin session.
   • Restricts download_attachments_on_load setting to CLI-only configuration, removing it from the web interface and API.
   • Adds the phishunt.io feed of active phishing URLs as a new built-in feed.
   • Migrates legacy event discussions (Thread/Post) to analyst notes, preserving author organisation, timestamps, and visibility information.

   +5 more show less

   • Migrates legacy signature allowedlists into an enabled custom regular-expression warninglist covering all attribute types; filtering now applies only when enforceWarninglist is enabled.
   • Replaces the legacy template system with event templates, converting organisation-authored templates to active event templates.
   • Adds bulk actions in the Overmind event attribute index.
   • Adds warninglist match indicators next to attributes in Overmind views.
   • Adds PDF downloads from event report quick actions in Overmind.
   • Adds objectRelationUsage statistics operation reporting how frequently relations are populated across MISP objects, grouped by the latest version of each object template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds the phishunt.io feed of active phishing URLs as a new built-in feed.
   • Migrates legacy event discussions (Thread/Post) to analyst notes, preserving author organisation, timestamps, and visibility information.
   • Migrates legacy signature allowedlists into an enabled custom regular-expression warninglist covering all attribute types; filtering now applies only when enforceWarninglist is enabled.
   • Replaces the legacy template system with event templates, converting organisation-authored templates to active event templates.

   +3 more show less

   • Adds bulk actions in the Overmind event attribute index.
   • Adds warninglist match indicators next to attributes in Overmind views.
   • Adds PDF downloads from event report quick actions in Overmind.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host, and download_attachments_on_load settings can no longer be changed via the web interface or API — they must be managed through server configuration or CLI.
   • !The legacy Thread/Post discussion workflow trigger is removed; workflows that relied on it are logged during migration and will no longer fire.
   • !Signature allowedlist filtering no longer unconditionally removes matching values from restSearch, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. push, OpenIOC, and Bro exports — exclusion now applies only when enforceWarninglist is enabled.
   • !The legacy ability to populate an existing event from a template is removed; event templates now only create new events.
   • !Legacy discussion, template, and allowedlist routes are removed; integrations using those routes must be updated.
2. v2.5.48 Sep 29, 2026 · issue 089

   MISP v2.5.48 adds XLSX export for events/attributes/sightings and tag removal from misp-module enrichment results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.48 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.48

   ⤢
   └──▷ TRY IT
   Export all attributes matching a network indicator search as an Excel workbook for analyst review — avoiding CSV formula-injection warnings in Excel.
   copy

   $ curl -s -H 'Authorization: <api-key>' -H 'Accept: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' 'https://<misp-host>/attributes/restSearch/returnFormat:xlsx/type:ip-dst' -o results.xlsx

   Export attributes as XLSX with formula cells written as literal apostrophe-prefixed strings, for workflows that re-export the workbook back to CSV without preserving quotePrefix styling.
   copy

   $ curl -s -H 'Authorization: <api-key>' -H 'Accept: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' 'https://<misp-host>/attributes/restSearch/returnFormat:xlsx/escape_formulas_literal:1' -o results_literal.xlsx

   • Adds XLSX export for events, attributes, and sightings via restSearch and the per-event and mass export pickers, with escape_formulas_literal:1 to switch formula-safe cells to literal apostrophe form instead of quotePrefix cell style.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds remove_tags list support in enrichment and import module result rows, letting modules strip tags from existing attributes instead of creating duplicates, with removed tags surfaced in the resolution screen and EventShell enrichment output.

   2 details in Everything

3. v2.5.47 Sep 17, 2026 · issue 077

   MISP v2.5.47 adds PostgreSQL support, AI-assisted analysis, a ledger-based migration system, and major Overmind UI improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.47 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.47

   ⤢
   └──▷ TRY IT
   Check which database migrations are pending or failed before or after an upgrade, to verify schema state across a fleet.
   copy

   $ cake Admin migrationStatus

   Preview the exact SQL a pending migration will execute without applying it, useful for change-control review before touching production.
   copy

   $ cake Admin migrationApply --dry-run

   Enable AI-assisted analysis for analysts by configuring the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. endpoint and granting the required role permission via the AI tab in server settings.
   📍In MISP, go to Administration › Server Settings & Maintenance › AI, set the Plugin.AI_* values for your LLM endpoint and model, then use the Test LLM button to verify connectivity. Grant the perm_ai_tools permission to the relevant roles under Administration › Roles.
   • Adds Plugin.AI_* settings under a new AI tab in server settings to configure the AI-assisted analysis integration, gated by the new perm_ai_tools role permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds cake Admin migrationStatus, cake Admin migrationApply (with --dry-run to preview SQL), and cake Admin migrationCreate console commands for the new ledger-based migration system.
   • Adds INSTALL/POSTGRESQL.sql and a PostgresObserverExtended datasource to support fresh installs on PostgreSQL 16, with install steps documented in docs/CONFIG.postgresql.md.
   • Adds four AI-assisted analysis actions — summarise event, summarise report, recommend tags, and extract indicators — via the ai_connector misp-module; all AI-derived content is tagged with ai-computer-assisted provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. tags.
   • Adds two workflow action modules: Summarise report with AI and Extract indicators with AI.

   +11 more show less

   • Migrates database schema management from a single db_version integer to a schema_migrations ledger under app/Lib/Migration/Migrations/, with pending and failed migrations now exposed as migrations_pending and migrations_failed fields in the diagnostic payload.
   • Adds elastic-detection-rule, kql-analytics-rule, kunai-rule, and splunk-rule MISP objects for detection rule sharing.
   • Adds a new More filters expandable section to the users, servers, organisations, workflows, logs, galaxy clusters, collections, and event attribute indexes in Overmind.
   • Adds a new MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling. Case Study galaxy and updates MITRE ATLAS to the 2026.08 release in misp-galaxy.
   • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. D3FEND techniques and relations, and moves the MITRE Fraud Framework (F3) to version 1.1 with relationships in misp-galaxy.
   • Adds TweetFeed and several Threatbase feeds to the default MISP feed list.
   • Adds a collection card and *add to collection* action to the Overmind event view.
   • Adds a JSON field component to Overmind forms, used by the decaying model modal.
   • Adds an add button on the Overmind event reports tab and an improved markdown editor for event report previews.
   • Unregisters the phar stream wrapper in both entry points as a defence-in-depth hardening measure.
   • Adds docs/dev/ai_integration.md documenting the AI integration contract and actions, and includes a fake module server for testing without an LLM.
   • Adds Plugin.AI_* settings under a new AI tab in server settings to configure the AI-assisted analysis integration, gated by the new perm_ai_tools role permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds cake Admin migrationStatus, cake Admin migrationApply (with --dry-run to preview SQL), and cake Admin migrationCreate console commands for the new ledger-based migration system.
   • Adds INSTALL/POSTGRESQL.sql and a PostgresObserverExtended datasource to support fresh installs on PostgreSQL 16, with install steps documented in docs/CONFIG.postgresql.md.
   • Adds four AI-assisted analysis actions — summarise event, summarise report, recommend tags, and extract indicators — via the ai_connector misp-module; all AI-derived content is tagged with ai-computer-assisted provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. tags.
   • Adds two workflow action modules: Summarise report with AI and Extract indicators with AI.

   +3 more show less

   • Migrates database schema management from a single db_version integer to a schema_migrations ledger under app/Lib/Migration/Migrations/, with pending and failed migrations now exposed as migrations_pending and migrations_failed fields in the diagnostic payload.
   • Adds elastic-detection-rule, kql-analytics-rule, kunai-rule, and splunk-rule MISP objects for detection rule sharing.
   • Adds docs/dev/ai_integration.md documenting the AI integration contract and actions, and includes a fake module server for testing without an LLM.

   8 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Fleet monitoring that alerted on actual_db_version differing from expected_db_version must move to the new migrations_pending and migrations_failed diagnostic fields; the version pair can no longer diverge as the db_version counter is frozen at 159.
   • !runUpdates (and site-admin login) now stops on the first migration failure instead of marking the failure as done and continuing.
   • !The earlier CTIInfoExtractor endpoint and its settings are removed and replaced by the new Plugin.AI_* AI integration.
   • !Tag names that collide under the new case-insensitive collation on tags.name are merged into the oldest tag, with every reference repointed — instances with such collisions will have tags merged automatically on upgrade.
4. v2.5.46 Sep 10, 2026 · issue 070

   MISP v2.5.46 adds SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. hardening with UrlEgressValidator, 50x sightings query speedup, and expanded Overmind UI workflows including a first MISP Tutorial.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.46 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.46

   ⤢
   • Introduces a shared UrlEgressValidator that enforces a common outbound URL policy — validating schemes and resolved addresses and blocking loopback, link-local, and private destinations across all remote-resource retrieval paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends CurlClient with host pinning, controlled and validated redirects, response size limits, and TLS peer verification enabled by default.
   • Reduces event report count queries from one per event to one or two grouped queries per page — delivering roughly 19× to 35× improvements for that operation.
   • Batches sightings retrieval inside MispAttribute::fetchAttributes() instead of querying per attribute, reducing a 5,000-attribute case from 8.1 seconds / 10,661 queries to 0.149 seconds / 6 queries — more than a 50× improvement.
   • Updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. galaxies in misp-galaxy to include Detection Strategies and Analytics concepts alongside refreshed tactics, techniques, and sub-techniques.

   +7 more show less

   • Expands Overmind event quick-action cards with merge attributes, enrich event, contact reporter, delegate publishing, execute ad-hoc workflows, and recorrelate events operations.
   • Adds warning-list filtering in Overmind correlation graphs.
   • Adds Galaxy support inside Tag Collections in Overmind.
   • Ships the first version of the MISP Tutorial inside Overmind.
   • Adds card views for additional indexes, server-specific card views, and multiple cards per row in Overmind.
   • Adds responsive correlation graph timelines and collapses correlated events by default in Overmind.
   • Refreshes misp-warninglists with new sources including network and security scanners, Network Telescope-derived scanner ranges, Cortex/Xpanse infrastructure, and Telegram-related infrastructure.
   • Introduces a shared UrlEgressValidator that enforces a common outbound URL policy — validating schemes and resolved addresses and blocking loopback, link-local, and private destinations across all remote-resource retrieval paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds warning-list filtering in Overmind correlation graphs.
   • Adds Galaxy support inside Tag Collections in Overmind.
   • Ships the first version of the MISP Tutorial inside Overmind.

   8 more in Everything

5. v2.5.45 Aug 25, 2026 · issue 057

   MISP v2.5.45 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. revamp with nested groups and proxy-header auth, a /gpg.asc endpoint, and CLI worker management.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.45 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.45

   ⤢
   └──▷ TRY IT
   Fetch the instance public GPG key from a MISP server — useful for verifying signed exports or configuring encrypted sharing.
   copy

   $ curl https://<misp-instance>/gpg.asc

   • Adds ldapNestedGroups setting to resolve nested LDAP group membership for role and org mapping.
   • Adds ldapOrgGroupMapping and ldapRoleGroupMapping settings whose precedence follows settings order, supporting role and organisation mapping via directory field or group membership.
   • Adds LDAP sync of MISP accounts via the User check_validity task, schedulable as an admin task.
   • Adds authentication against a header asserted by a trusted proxy as an LDAP auth option.
   • Adds a setting to disable MISP accounts for users flagged ACCOUNTDISABLE in userAccountControl.

   +11 more show less

   • Adds a pytest suite under tests/ldapauth/ with an OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. service running in CI for LDAP authentication coverage.
   • Serves the instance GPG key at /gpg.asc with caching.
   • Enables managing Supervisor-backed workers directly from the CLI.
   • Adds an organisation merge feature in the UI.
   • Adds an import action on the event index and server preview views.
   • Adds a freetext feed preview index and import modals; feed migration to Bootstrap 5 (Overmind) is now complete.
   • Migrates Server settings, Workflow indexes (ad-hoc, triggers, modules), workflow editor, Decaying Model index, misp-module enrichment, and registration/user settings/password flows to the Bootstrap 5 Overmind UI.
   • Adds new Bootstrap 5 views for Jobs, Tasks, AnalystData, Feeds, TaxiiServers, CryptographicKeys, and GalaxyClusterRelations.
   • Enforces per-org module restrictions on all getEnabledModule() paths.
   • Enforces Event modify ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. on attribute enrichment requests.
   • Enforces distribution=0 filter in REST search fetchEvent.

   16 details in Everything

6. v2.5.43 Jul 13, 2026 · issue 015

   MISP 2.5.43 adds collection sync between instances, environment-variable settings, Pivotick pivot explorer, and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. Bearer auth.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.43 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.43

   ⤢
   └──▷ HOW TO FIND IT
   Enable collection push to a remote peer so newly created collections are automatically synchronised to that instance.
   📍In the MISP UI, go to Sync Actions › List Servers, edit the target server, and enable the push_collections and pull_collections toggles under the synchronisation options.
   • Adds collection synchronisation between MISP instances in both pull and push directions, with per-server pull_collections / push_collections toggles, feature negotiation with pagination, and a collections.locked origin-protection flag.
   • Supports environment variables as a third settings source alongside config file and database, enabling cleaner containerised and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. deployments.
   • Introduces Pivotick as an initial drop-in replacement for the legacy event graph, including a draft drag-and-drop reference editor.
   • Adds Bearer authentication for TAXII servers and a streamlined add flow for basic auth; the TAXII API key field is renamed to Token and obfuscated in the server view.
   • Extends the Overmind (Bootstrap 5) UI to user index, categories & types, application/audit/access logs, galaxies/galaxy clusters/galaxy relationships, and proposals screens, plus inline tag/galaxy addition from event view.

   +2 more show less

   • Adds HoneyLabs default feeds covering active exploiters and malware infrastructure.
   • Adds zeromq supervisor setting and status check.

   7 details in Everything

7. v2.5.42 Jun 22, 2026 · release notes

   MISP v2.5.42 adds scheduled TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. push, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. PAR toggle, Overmind UI advances, and a new SiberKapan threat-intel feed.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.42 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.42

   └──▷ HOW TO FIND IT
   Enable and run a scheduled TAXII push to all enabled servers without waiting for the next cron window.
   📍In the MISP UI, go to Server Settings › Scheduled Tasks, locate the TAXII push task, set the push mode to all-enabled, toggle the server's enabled flag on, then trigger the task manually.
   Disable OIDC PAR for an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. that does not support the Pushed Authorization Request endpoint.
   📍In the MISP UI, go to Server Settings › Plugin › Authentication, find the OIDC settings section, and set the Disable PAR option to true.
   • Adds scheduled TAXII push as a new task type, with single-server and all-enabled push modes, a per-server enabled flag, and proxy support.
   • New option to disable OIDC Pushed Authorization Requests (PAR) for environments that cannot support it.
   • Overmind UI: tags and galaxy clusters can now be added directly from the Event View.
   • Overmind UI: correlation graph integrated into the Insight UI.
   • Overmind UI: object index and event-report views/forms migrated, including attachment add and event-report add form.

   +2 more show less

   • Overmind UI: new colour scheme, bolder MISP element icons, item-count badges in index views, and clickable breadcrumbs.
   • Adds SiberKapan (Turkey-focused threat-intel platform) to the default feeds.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The rdkafka config file path/name is now strictly validated and the setting is restricted to CLI-only configuration — any site-admin web-based rdkafka config path will no longer be accepted.
8. v2.5.42 Jun 22, 2026 · issue 001

   MISP v2.5.42 adds scheduled TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. push, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. PAR toggle, Overmind UI advances, and a new SiberKapan feed.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.42 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.42

   ⤢
   └──▷ HOW TO FIND IT
   Enable scheduled TAXII push to all active servers so fresh MISP events are automatically pushed on a recurring schedule without manual intervention.
   📍In the console, go to Server Settings & Maintenance › Scheduled Tasks, add a new task of type TAXII push, set push mode to all-enabled, and confirm the enabled flag is set to true for each target TAXII server under Sync › TAXII Servers.
   Route TAXII push traffic through a corporate proxy so air-gapped or egress-controlled environments can still push threat intel to external TAXII collections.
   📍In the console, go to Sync › TAXII Servers, open the target server's settings, and enter your proxy host and port in the Proxy fields before saving.
   Disable OIDC PAR for an IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. that does not support Pushed Authorization Requests, preventing login failures in those environments.
   📍In the console, go to Server Settings & Maintenance › Plugin Settings › OIDC and set the disable PAR option to true.
   • Adds scheduled TAXII push as a task type, supporting single-server and all-enabled push modes with a per-server enabled flag and blocking of pushes for disabled servers.
   • Adds proxy support for TAXII push operations.
   • Adds an option to disable OIDC Pushed Authorization Requests (PAR) for deployments where PAR is unsupported or unwanted.
   • Adds SiberKapan (Turkey-focused threat-intelligence platform) to the default MISP feeds list.
   • Integrates the correlation graph into the Overmind/Insight UI.

   +3 more show less

   • Enables adding tags and galaxy clusters directly from the Event View in the Overmind UI.
   • Migrates object index, event-report views and forms (including attachment add and event-report add) into the Overmind UI.
   • Introduces a new colour scheme, bolder MISP element icons, item-count badges in index views, and clickable breadcrumbs across the Overmind UI.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The rdkafka config file path/name is now strictly validated and the setting is restricted to CLI-only configuration, meaning rdkafka config paths can no longer be set via non-CLI means.
   • !The unique_ips field on authkeys is now derive-only and can no longer be seeded on key creation; any tooling or scripts that set unique_ips at key-creation time will have that value ignored or rejected.
9. v2.5.41 Jun 17, 2026 · release notes

   MISP v2.5.41 adds event index mass tagging, async server updates, new threat intel feeds, and a reworked Overmind UI.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.41 https://github.com/MISP/MISP.git
   # already have the repo? check out this version:
   $ git checkout v2.5.41

   └──▷ USE IT
   Set a custom OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login button label so users see your organisation's identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. name instead of a generic button.
   yaml copy

   # In app/Config/config.php or equivalent OIDC config block:
   'OidcAuth' => [
       'button_text' => 'Login with CorpSSO',
       ...
   ]

   • Adds mass tagging and galaxy cluster attachment to multiple selected events at once from the event index.
   • Major rework of the Overmind (Beta) UI Event View, Collections, and List pages.
   • Supports configurable login button text for OIDC authentication.
   • Surfaces hidden server setting behaviours (CLI-only, file-only, redacted) in the server settings view.
   • Enables async background-job updates via /servers/updateJSON.

   +2 more show less

   • Adds PrecisionSec OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. Threat Intelligence and Rectifyq MISP Feeds as default feeds.
   • Shows current server time when adding a scheduled task.

   7 details in Everything

10. v2.5.41 Jun 17, 2026 · issue 001

    MISP 2.5.41 adds event-index mass tagging, async server updates, new threat feeds, and a major Overmind UI rework.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.41 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.41

    └──▷ TRY IT
    Trigger a background async update of MISP's JSON definitions without blocking the request — useful for automation pipelines.
    copy

    $ curl -s -H 'Authorization: <your-api-key>' -H 'Accept: application/json' -H 'Content-Type: application/json' -X POST https://<misp-instance>/servers/updateJSON -d '{"background": true}'

    Mass-tag a selection of events from the Event index to rapidly apply a new campaign tag across multiple incidents.
    📍In the Event index, check the checkboxes next to the target events, then choose Mass Actions › Tag Events and select or type the tag to apply across all selected events.
    • Adds mass-action tagging and galaxy-cluster attachment to multiple selected events at once from the Event index.
    • Major rework of Event View, Collections, and List views in the Beta (Overmind) UI.
    • Enables configurable login button text for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication.
    • Surfaces hidden server setting behaviours (CLI-only, file-only, redacted) in the Server Settings UI.
    • Adds async background-job support to the /servers/updateJSON endpoint.

    +3 more show less

    • Adds two new default threat intelligence feeds: PrecisionSec OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. Threat Intelligence and Rectifyq MISP Feeds.
    • Displays the current server time when scheduling a new scheduled task.
    • Reduces sync overhead by requesting only the event-tags fingerprint instead of the full tag list.

    8 details in Everything

11. v2.5.40 Jun 11, 2026 · issue 001

    MISP 2.5.40 adds Overmind UI migration for Event views, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.-aware ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. widget, and admin upgrade-error surfacing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.40 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.40

    └──▷ HOW TO FIND IT
    Check whether your instance is flagging the dangerous default — navigate to the admin diagnostics page to see the new warning about check_sec_fetch_site_header.
    📍In the MISP admin console, go to Administration › Server Settings & Maintenance › Diagnostics and look for the new warning banner about check_sec_fetch_site_header being unset.
    • Begins migration of Event View and Event Report views to the new Overmind UI (work in progress).
    • ATT&CK dashboard widget (AttackWidget) now counts techniques via an ACL-aware Event find, ensuring results respect user permissions.
    • Adds a supervisor-configuration scheduler during upgrade and surfaces upgrade errors directly to admins.
    • Warns admins when the check_sec_fetch_site_header setting is unset, flagging elevated risk on multi-homed/multi-tenant instances.

    4 details in Everything

12. v2.5.39 Jun 5, 2026 · release notes

    MISP 2.5.39 adds analyst dashboard widgets, WebGL globe visualizations, ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmap redesign, and expanded STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. interoperability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.39 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.39

    └──▷ HOW TO FIND IT
    Enable the 'overlap with my org' correlation widget to surface events sharing indicators with your organisation's data.
    📍In the dashboard, go to the widget picker, select Overlap with my org, configure country/sector filters and exclude_own_org as needed, then save the layout.
    Switch the dashboard between light and dark themes without a page reload to match analyst environment preferences.
    📍In the MISP dashboard, click the theme toggle control; the dashboard and all charts retheme live and the preference is persisted for your user account.
    • New analyst-focused dashboard widgets: trending vulnerabilities, threat actors, and ATT&CK techniques; new-data KPI cards; event cards; recent event reports; recent analyst notes and opinions; recent local galaxy clusters; and 'overlap with my org' correlation-based views.
    • WebGL globe support for attack-flow visualizations, with selectable globe skins and idle auto-rotation.
    • Live light/dark dashboard theme switching — including chart retheming — with persisted user preference and no-flash boot.
    • ATT&CK heatmap redesigned with parent/sub-technique aggregation, inactive technique hiding, readable labels, and a clearer red intensity ramp.
    • Dashboard widgets gain typed configuration controls for dimensions, country/sector filters, exclude_own_org, event stream filters, and galaxy type filtering.

    +5 more show less

    • Save as template now saves via AJAX in the dashboard slide-in panel, keeping users on the current board.
    • New misp-iconify icon set used for dashboard stat glyphs.
    • Updated misp-stix 2026.6.1 brings full TLP marking support shared across import and export paths, expanded patterning-language support, more deterministic byte-stable conversions, and regenerated mapping documentation.
    • Supports EM SPACE (U+2003) in FreeText import for broader indicator parsing coverage.
    • Required publish permission enforced for publishing galaxy clusters.

    10 details in Everything

13. v2.5.39 Jun 5, 2026 · issue 001

    MISP 2.5.39 ships a redesigned analyst dashboard, new threat-intel widgets, STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. TLP/patterning expansions, and a WebGL attack-flow globe.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.39 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.39

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable a trending threat actors widget on your analyst dashboard to surface the most-referenced actors across recent events.
    📍In the MISP dashboard, click Add Widget › select Trending threat actors › configure the country/sector filters and exclude_own_org toggle › click Save.
    Switch your dashboard to dark theme so SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts working night shifts get a low-glare view that persists across sessions.
    📍In the MISP dashboard header, click the theme toggle (sun/moon icon) to switch between light and dark mode — the preference is saved to your user profile and charts retheme live.
    • Adds light/dark dashboard theme switching with persisted user preference, no-flash boot, and live chart retheming.
    • Adds WebGL globe visualization for attack-flow data, with selectable globe skins and idle auto-rotation.
    • New analyst dashboard widgets: trending vulnerabilities, threat actors, and ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques; new-data KPI cards; event cards; recent event reports; recent analyst notes and opinions; recent local galaxy clusters; and 'overlap with my org' correlation views.
    • Redesigned ATT&CK heatmap with parent/sub-technique aggregation, inactive technique hiding, readable labels, and a clearer red intensity ramp.
    • Dashboard widgets gain typed configuration controls for dimensions, country/sector filters, exclude_own_org, event stream filters, and galaxy type filtering.

    +5 more show less

    • Save as template now operates via AJAX in the slide-in panel, keeping users on the current board.
    • New misp-iconify icon set introduced for dashboard stat glyphs.
    • Updated STIX engine (misp-stix 2026.6.1) adds full TLP marking support across import and export paths, expanded patterning-language support, more deterministic byte-stable conversions, and regenerated mapping documentation.
    • Adds support for EM SPACE (U+2003) in FreeText import, broadening freetext attribute parsing.
    • Requires publish permission to publish galaxy clusters, enforcing stricter access control on cluster publication.

    10 details in Everything

14. v2.5.38 May 20, 2026 · release notes

    MISP 2.5.38 adds a workflow blocklist action module, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2 spec conformance, and Overmind UI Sync tab migration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.38 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.38

    └──▷ HOW TO FIND IT
    Enable the new Blocklist action module in a workflow to automatically write matched event attributes to a blocklist file, grouped by tag.
    📍In the MISP UI, go to Event Actions › Workflows, open or create a workflow, and add the Blocklist action module from the module palette. Configure the output file path, enable removal-by-tag, and optionally enable rolling filesystem snapshots in the module settings.
    • New Workflows Blocklist action module writes event attributes to a blocklist file, with removal-by-tag, atomic writes with one-generation backup, and optional rolling filesystem snapshots.
    • TAXII 2 updated to spec and schema v148 conformance.
    • Overmind UI Sync tab migration: Servers, SharingGroup, SharingGroupBlueprints, Sightingdb, TaxiiServers, Communities, and Cerebrate views ported to the Overmind theme.

    3 details in Everything

15. advisory CVE-2026-44381 Apr 29, 2026 · issue 128
    • CVE-2026-44381: MISP - SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. via unvalidated ordering parameters in event and shadow attribute listings (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
16. advisory CVE-2026-44380 Apr 29, 2026 · issue 128
    • CVE-2026-44380: MISP - Improper access control in auth key reset allows privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. to site administrator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. advisory CVE-2026-44379 Apr 29, 2026 · issue 128
    • CVE-2026-44379: Improper UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. validation in MISP Collections (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
18. v2.5.37 Apr 29, 2026 · release notes

    MISP v2.5.37 ships a ground-up Event Templating system, a new suricata attribute type, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. defaults, new workflow triggers, and expanded galaxy/taxonomy coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.37 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.37

    └──▷ TRY IT
    Migrate all legacy templates to the new event-template format in bulk after upgrading.
    copy

    $ app/Console/cake Admin migrateOldTemplates

    Enable the Overmind UI development preview to access the new migrated views including Event Templates and Correlation Graph.
    📍In the MISP web UI, go to Administration › Server Settings & Maintenance › Simple Settings, find the theme selector, and set it to Overmind.
    • Introduces a completely redesigned Event Templating system with JSON-schema-backed templates (event-template-v1), a drag-to-reorder builder UI, inline validation via /event_templates/validate_definition, and REST import/export with full object-template dependency tracking.
    • New misp-event-templates submodule provides a managed library catalogue with ten starter templates (e.g. ransomware-incident, credential-exposure, supply-chain-compromise) and first-touch auto-update.
    • Migration helper app/Console/cake Admin migrateOldTemplates converts legacy templates to the new event-template format, including handling for complex File / CnC objects.
    • Adds a dedicated suricata attribute type alongside snort, enabling first-class modeling and validation of Suricata IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. rules, with corresponding support in PyMISP.
    • STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2 export now defaults to version 2.1 and adds a new library entry point for exporting MISP Object collections to STIX 2.x, switching from MISP's custom cti-python-stix2 fork to the upstream library bundled with misp-stix.

    +9 more show less

    • Ad-hoc workflows now support passing in environment variables and capturing module-returned data under _env.misp_module_results for use by downstream nodes.
    • New analyst-data:after-save workflow trigger added.
    • New search performance diagnostics tool to profile attribute search behaviour on large datasets; performance shell updated to use approximations for usability on very large instances.
    • Overmind UI gains full coverage for Tags, Tag Collections, Taxonomies, Templates, Object Templates, Object Relationships, REST Client, Automation & Export Views, Correlation Graph (rewritten in vanilla JS), and Event Templates.
    • New cloud-sovereignty and ai-computer-assisted taxonomies added to misp-taxonomies.
    • New misp-galaxy galaxies added: SPARTA, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Fraud Framework, VERIS framework, RMM tools, operating systems, IT-equipment types, software vendors, and taxonomy of fraud.
    • New misp-objects templates added: rulezet-bundle, ruleset-metadata, dga-domain, drone-RID-observation, contact-list, fbi-most-wanted, terminal-output, malicious-website, exif, software, service, container, physical-object, item, mfa-auth.
    • New misp-warninglists script to fetch Windows binary hashes and generate a warninglist from them.
    • LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. plugin gains support for memberOf queries.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The custom cti-python-stix2 submodule has been removed; MISP now uses the upstream stix2 library bundled with misp-stix, and STIX 2 export defaults to version 2.1 instead of 2.0.
    • !All menu entry points to the legacy /templates/* controller have been removed from the global menu, navbar helper, and side menus on both default and Overmind themes; the controller and view stack will be fully removed in 2.5.38.
19. advisory CVE-2026-39962 Apr 8, 2026 · issue 128
    • CVE-2026-39962: LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects 2.5.35)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
20. v2.5.36 Apr 3, 2026 · release notes

    MISP v2.5.36 adds interactive map geolocation visualisation, a terminal REPL shell, and expanded Overmind UI coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.36 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.36

    └──▷ TRY IT
    Enable geolocation map visualisation for events containing geographic objects, pointing to a self-hosted tile server.
    copy

    $ app/Console/cake Admin setSetting Plugin.Geolocation_enabled true
    app/Console/cake Admin setSetting Plugin.Geolocation_url "https://tiles.example.com"

    Launch the interactive terminal REPL to browse and manage MISP data without a browser.
    copy

    $ app/Console/cake CLI 1

    • Adds interactive geolocation map rendering for objects with geographic coordinates directly in the event view, enabled via Plugin.Geolocation_enabled.
    • Adds accuracy-radius visualisation for geolocation objects, displayed as a toggleable circle on the map.
    • Adds native GeoJSON rendering, enabling complex geographic shapes and features to be displayed on maps.
    • Adds GPX track support so UAV and other GPS Exchange Format tracking data can be plotted as tracks on the map.
    • Adds configurable tile server support via Plugin.Geolocation_url (defaults to https://geo.circl.lu).

    +6 more show less

    • Adds a new interactive CLI REPL shell (app/Console/cake CLI <user_id>) for browsing and managing events, attributes, objects, tags, users, organisations, and roles from the terminal.
    • Adds Warninglists, Noticelists, Collections, Correlation Exclusions, Allowedlists, and Regexp modules to the Overmind Bootstrap 5 UI.
    • Adds full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. support with modal-based add/edit/delete for Collections and Collection Elements in the Overmind UI.
    • Adds global action buttons for the attribute index in the Overmind UI.
    • Adds sticky table headers across all Overmind index views.
    • Adds support for environment variable overrides for configuration values in the MISP installer.

    11 details in Everything

21. v2.5.35 Mar 19, 2026 · release notes

    MISP v2.5.35 adds decomposed AJAX event view endpoints, cursor-based attribute search pagination, and Overmind UI mass-select actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.35 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.35

    └──▷ HOW TO FIND IT
    Use the new decomposed event view endpoints and mass-select actions in the Event Index via the Overmind UI.
    📍In the console, go to Administration › Server Settings › MISP › enable theming, set the theme to the Overmind/EventTest theme, then navigate to an event to load attributes, objects, related events, and warninglist hits as separate AJAX panels. In the Event Index, use the mass-select checkboxes to bulk publish, delete, or export events.
    • Adds new AJAX endpoints (view2(), viewAttributes(), viewObjects(), viewRelatedEvents(), viewWarninglistHits()) that decompose the monolithic event view into asynchronously loaded components for faster rendering.
    • Introduces a new correlation dispatcher enabling per-page correlation loading instead of loading all correlations for an entire event at once.
    • Adds a new EventTest reference UI theme demonstrating the decomposed endpoints with paginated attributes, quick filters, and a flatten toggle.
    • Switches restsearch to cursor-based pagination, eliminating performance degradation on deep pagination of large attribute datasets.
    • Adds a benchmark suite and comparison tool for tracking and documenting attribute search pipeline performance.

    +4 more show less

    • Adds mass-select actions for publication, deletion, and export within the Event Index in the Overmind UI.
    • Transitions Overmind UI from jQuery to Vanilla JS and integrates Tom Select for improved dropdown and selection interactions.
    • Hardens Debian 12/13 and RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.4 installer scripts following SC3 audit: credentials stored at /root/misp_settings.txt with 600 permissions, mktemp used for API key capture, and hard-fail on Composer checksum mismatch.
    • Updates MISP-STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. to include indicator and observable fingerprinting capabilities.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default ordering for restsearch has changed to accommodate the new cursor-based pagination logic (can be overridden if a specific order is required).
    • !MISP-STIX minimum version requirement has been updated; instances must upgrade MISP-STIX to remain compatible with the new search pipeline.
22. v2.5.34 Mar 6, 2026 · release notes

    MISP v2.5.34 adds a visual debug mode section in the Overmind theme.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.34 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.34

    └──▷ HOW TO FIND IT
    Enable debug mode in MISP and use the new Overmind theme visual section to inspect debug output directly in the UI.
    📍In the MISP console, go to Administration › Server Settings & Maintenance, enable Debug mode, then switch your theme to Overmind to see the new visual debug section.
23. v2.5.33 Mar 2, 2026 · release notes

    MISP v2.5.33 adds a new theme system with Overmind UI, faster sync caching endpoint, sightings-free pull sync, and a new attribute lookup API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.33 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.33

    └──▷ TRY IT
    Enable the new theme system so users can switch to Overmind or BetaUI in their profile settings.
    copy

    $ /var/www/MISP/app/Console/cake Admin setSetting "MISP.enable_themes" 1

    Enable themes on a Docker-based MISP installation to let users experiment with the new UIs.
    copy

    $ docker exec -it misp-docker-misp-core-1 /var/www/MISP/app/Console/cake Admin setSetting "MISP.enable_themes" 1

    • New theme system (MISP.enable_themes) lets users opt into the modern Overmind development UI or the gradual BetaUI redesign, both built on Bootstrap 5 and Font Awesome 7.
    • New client-side caching endpoint for synchronization bypasses heavy restSearch logic, reducing memory footprint and speeding up large-instance sync.
    • New /attributes/getAttributeByB64Value endpoint enables efficient attribute lookups by Base64 value.
    • New settings to gate arbitrary URLs in event reports and workflows, controlling SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Freetext extraction now supports Chrome and Edge browser extension IDs.

    +1 more show less

    • Workflow modules threat-level-if and aggregate-if receive new enhancements.

    6 details in Everything

24. v2.5.32 Jan 14, 2026 · release notes

    MISP v2.5.32 adds three new workflow modules/triggers, bucketed attachment storage, and configurable password-reset emails.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.32 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.32

    └──▷ HOW TO FIND IT
    Act on event deletions in a workflow — e.g., to notify an external system or log deletions before they occur.
    📍In the MISP console, go to Event Actions › Workflows, create a new workflow, and add the trigger-event-before-delete trigger as the starting node.
    Customize the forgot-password email body to match your organization's branding or include SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. contact details.
    📍In the MISP console, go to Administration › Server Settings & Maintenance › MISP Settings and update the forgot password email text field.
    • New Aggregate Comparator workflow module to aggregate and compare field values for use in IF conditions.
    • New Timestamp Filter workflow module enabling filtering of events based on timestamp values.
    • New Event Deletion Trigger (trigger-event-before-delete) to act on event deletion in workflows.
    • New bucketed storage system for file attachments to prevent filesystem issues caused by too many files in a single directory.
    • Forgot password email text is now configurable via the server settings interface.

    +2 more show less

    • New OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth setting to skip or enforce global MISP proxy settings.
    • Faster JSON decoding from files via simdjson_decode_from_stream.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The toggle field is renamed to enable in the ids-operation workflow module — any workflow using the old toggle field will need to be updated.
25. v2.5.31 Dec 23, 2025 · release notes

    MISP v2.5.31 adds NOCACTI threat feeds, refreshed knowledge bases, and widens the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec for galaxy cluster exports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.31 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.31

    └──▷ HOW TO FIND IT
    Pull in the new NOCACTI feeds via the MISP UI after upgrading to start ingesting adversary infrastructure and intrusion indicators.
    📍In the console, go to Sync Actions › Feeds, find the NOCACTI Adversary Infrastructure and NOCACTI Intrusion feeds in the feed list, enable them, then click Fetch and store all feed data.
    Fetch galaxy clusters via the API passing distribution as an array — now officially supported by the updated OpenAPI spec.
    copy

    $ curl -s -H 'Authorization: <your-api-key>' -H 'Accept: application/json' -H 'Content-Type: application/json' -X POST https://<misp-host>/galaxies/exportGalaxyClusters -d '{"default": true, "custom": true, "distribution": [0, 1, 2]}'

    • Adds NOCACTI Adversary Infrastructure / Intrusion feeds as new built-in threat intelligence sources.
    • Updates taxonomies, galaxies, object templates, warning lists, and GeoOpen to latest versions.
    • Expands OpenAPI spec for exportGalaxyClusters: documents additive default/custom inclusion behavior and allows distribution to be passed as an array.
    • Changes default sighting visibility to Everyone (previously Event Owner).
    • Sync users can now update sharing groups they can see and push updates via different sync connections than the original source.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Default sighting visibility is now set to Everyone instead of Event Owner — instances relying on the previous default to restrict sighting visibility to the event owner will expose sightings more broadly after upgrade.
26. v2.5.30 Dec 13, 2025 · release notes

    MISP v2.5.30 ships an opt-in beta UI/UX mode, faster org-logo loading, and new MMDBMMDBA binary database file format designed for fast IP-address lookups, maintained by MaxMind, used by cyber tools to resolve IPs to geolocation or ASN data without external API calls./vulnerability-lookup workflow action modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.30 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.30

    └──▷ HOW TO FIND IT
    Enable the new beta UI/UX mode to get the redesigned Event Index and navigation — useful for evaluating the next-generation interface before it becomes the default.
    📍In the MISP UI, go to your User Settings and enable the beta UI / UX mode option.
    • Adds opt-in beta UI/UX mode (via user settings) with a redesigned Event Index featuring responsive layout, distribution widgets, humanized timestamps, and consolidated action dropdowns.
    • Redesigns top navigation bar with reorganized clustering and fly-out menus in the new beta mode.
    • New dedicated endpoint for organization logo loading uses cached images instead of live base64 decoding, significantly speeding up Event Index rendering.
    • New workflow Action modules enable automatic tag enrichment from MMDB geolocation data and vulnerability information from vulnerability-lookup.org.

    4 details in Everything

27. v2.5.29 Dec 13, 2025 · release notes

    MISP v2.5.29 ships a beta UI/UX mode with redesigned Event Index and new MMDBMMDBA binary database file format designed for fast IP-address lookups, maintained by MaxMind, used by cyber tools to resolve IPs to geolocation or ASN data without external API calls./vulnerability-lookup workflow action modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.29 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.29

    └──▷ HOW TO FIND IT
    Enable the beta UI/UX mode for your account to get the redesigned Event Index and new navigation.
    📍In the MISP console, go to your User Settings and enable the beta UI / UX mode option.
    • New opt-in beta UI/UX mode available via user settings, featuring a redesigned Event Index with responsive layout, distribution widgets, humanized timestamps, consolidated action dropdowns, and a reorganized fly-out navigation bar.
    • New dedicated endpoint for organization logo loading in the Event Index uses cached images instead of live base64 decoding, significantly faster rendering.
    • New Action modules for Workflows enable automatic tag enrichment based on MMDB geolocation data and vulnerability information from vulnerability-lookup.org.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The url field in Bookmarks has been renamed to text; any integration or script referencing the url field by name will break.
28. v2.5.28 Dec 11, 2025 · release notes

    MISP v2.5.28 adds MISP version to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, Gridstack 12 dashboard, and an OpenBSD 7.8 installation guide.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.28 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.28

    • Adds MISP version field to the OpenAPI specification.
    • Migrates the dashboard to Gridstack 12.
    • Adds installation guide for OpenBSD 7.8.
    • Adds CSIRT.SK to the Slovak MISP Community defaults and meta community vetting process.
    • Redacts creator user information in Collections data for non-site administrators.

    +1 more show less

    • Optimizes tag filtering logic by dynamically choosing between EXISTS and UNION query strategies based on attribute filter weight.

    6 details in Everything

29. v2.5.27 Nov 27, 2025 · release notes

    MISP v2.5.27 adds a flowintel case-creation workflow module and zstd-compressed request support with SimdJSON encoding.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.27 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.27

    └──▷ HOW TO FIND IT
    Automatically open a flowintel case when a MISP event meets a trigger condition — wire the new module into an existing workflow.
    📍In the MISP console, go to Event Actions › Workflows, open or create a workflow, search for the module flowintel-create-case in the module palette, drag it onto the canvas, configure the flowintel connection parameters, and save.
    • New flowintel-create-case workflow module enables automated case creation in flowintel directly from MISP workflows.
    • Supports zstd-compressed requests, expanding compression options for high-volume data ingestion.
    • Adds SimdJSON-accelerated encoding (simdjson_encode, simdjson_encode_to_stream, SimdJsonBase64Encode) for events and large arrays when simdjson_php is available, unlocking faster throughput at scale.
    • New attribute fetcher pipeline with early query optimisation for more efficient attribute retrieval.
    • JSON schema updated to reflect latest MISP 2.5 features, enabling validation of new event structures.

    5 details in Everything

30. v2.5.26 Nov 20, 2025 · release notes

    MISP v2.5.26 adds a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. attribute type, JSON syslog output, UUID-based event linking, and new DB indices for performance.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.26 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.26

    • Adds a dedicated UUID attribute type to satisfy FlowIntel and object template requirements, replacing ad-hoc text fields for unique identifiers.
    • New option to prioritize UUID-based event linking over traditional IDs, improving consistency across distributed MISP instances.
    • New option to emit syslog messages in JSON format for structured logging and easier downstream processing.
    • Introduces new database indices to significantly improve overall MISP performance.
    • Updates misp-stix with better STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2 input handling to tolerate invalid STIX 2 output from non-compliant TIP platforms.

    5 details in Everything

31. v2.5.25 Nov 16, 2025 · release notes

    MISP v2.5.25 adds three new hideNseek LAB threat intelligence feeds and improved screen-reader accessibility for server settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.25 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.25

    • Adds three new hideNseek LAB Threat Intelligence Feeds: JSON, CSV, and IP Blocklist formats available as default feeds.
    • Enables screen-reader users to switch server-setting cells to edit mode via an ARIA button, removing the requirement to double-click.

    2 details in Everything

32. v2.4.216 Nov 4, 2025 · release notes

    MISP v2.4.216 adds a 2.5 upgrade script and tightens access controls for sharing group blueprints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.216 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.216

33. v2.5.23 Oct 15, 2025 · release notes

    MISP 2.5.23 adds first-publication tracking, SQL EXPLAIN/ANALYZE endpoints, and a new preRelease admin shell function.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.23 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.23

    └──▷ TRY IT
    Dump the current DB schema and describeTypes.json ahead of a release or migration using the new admin shell function.
    copy

    $ /var/www/MISP/app/Console/cake Admin preRelease

    • Extends the /benchmarks/sqlMetrics endpoint with /explain and /analyze path parameters to run SQL EXPLAIN or ANALYZE on slow queries.
    • Adds a preRelease function to the admin shell for dumping the current DB schema and describeTypes.json.
    • Adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation for sharing group blueprints and sharing group blueprints viewOrgs.

    3 details in Everything

34. v2.5.22 Oct 2, 2025 · release notes

    MISP v2.5.22 adds locked-event creation on feed pulls and expands Event Report View to show full event family trees.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.22 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.22

    • Supports creating locked events on feed pulls, giving analysts control over event mutability when ingesting threat feeds.
    • Event Report View now surfaces all children of the current event and all children of the parent event, enabling full visibility into extended event hierarchies.

    2 details in Everything

35. v2.5.21 Sep 11, 2025 · release notes

    MISP v2.5.21 adds on-demand event recorrelation for site admins, available via UI and API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.21 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.21

    └──▷ TRY IT
    Trigger a fresh recorrelation of a specific event after bulk-importing new attributes, without waiting for a scheduled run.
    copy

    $ curl -X POST https://<misp-instance>/events/recorrelate/<event_id> -H 'Authorization: <api_key>' -H 'Accept: application/json'

    • Adds on-demand recorrelation of any event for site admins, accessible through the UI or via the API endpoint /events/recorrelate/{event_id}.
    • Expands AttributeValidationTool to support more vulnerability ID types.
    • Updates misp-galaxy, misp-objects, taxonomies, and misp-stix to their latest versions.

    3 details in Everything

36. v2.5.19 Aug 29, 2025 · release notes

    MISP 2.5.19 adds top correlations support to the on-demand correlation engine.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.19 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.19

37. v2.5.18 Aug 20, 2025 · release notes

    MISP v2.5.18 adds an on-demand correlation engine, a built-in task scheduler, and high-performance indexing for No-ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. correlations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.18 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.18

    └──▷ HOW TO FIND IT
    Set up a recurring feed-fetch task so MISP automatically pulls all feeds on a schedule without external cron jobs.
    📍Navigate to https://YOUR_MISP_HOST/tasks, click Add Task, select action type Fetch under Feeds, choose All feeds, set your recurrence interval, save, then enable the task.
    • New OnDemand Correlation Engine fetches correlating values live without persistent storage, reducing disk usage and eliminating the need to re-run correlation jobs.
    • New built-in Task Scheduler (site-admin only) lets administrators create and manage recurring actions for feeds, servers, workflows, and summaries — accessible at /tasks — replacing external cron-based scheduling.
    • Scheduler tasks support manual on-demand triggering via a play button, per-task execution logs, and per-user run context.
    • High-performance indexing support added for No-ACL correlations, with a CLI tool available to apply the required indexes.
    • Adds a new last_run_at column on tasks and improved job status handling in the task scheduler.

    +2 more show less

    • Adds a periodic user summary scheduled task for generating regular reports.
    • Forgejo CI integration added with a dedicated worker file and Forgejo-compatible YAML workflow.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The process_id field in task/job handling is replaced with last_job_id.
38. v2.4.214 Jul 19, 2025 · release notes

    MISP v2.4.214 adds highPerformance and indexLogs DB script options, NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. error logs, and a SQL slow log endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.214 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.214

    └──▷ USE IT
    Apply high-performance database indexes to events and attributes to speed up queries on large instances.
    shell copy

    cake Admin runDBScript highPerformance

    View slow SQL queries from the Diagnostic controller to identify performance bottlenecks.
    copy

    $ GET /diagnostic/slowSql

    • Adds cake Admin runDBScript with highPerformance and indexLogs options to apply performance-enhancing database indexes
    • Generates error logs in NDJSON format for easier parsing and integration with modern logging systems
    • Adds a new SQL slow log endpoint for benchmarking, allowing filtering by controller/action and pagination

    3 details in Everything

39. v2.5.16 Jul 16, 2025 · release notes

    MISP v2.5.16 adds a performance toolkit with new DB index scripts, NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. error logs, and a SQL slow-query benchmarking endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.16 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.16

    └──▷ TRY IT
    Apply high-performance database indexes on a large MISP instance to speed up event/attribute queries and correlations.
    copy

    $ cake Admin runDBScript highPerformance

    Add indexes to the log table so audit log searches return results quickly on busy instances.
    copy

    $ cake Admin runDBScript indexLogs

    • New cake Admin runDBScript highPerformance command re-indexes events, attributes, objects, and default correlations for faster queries on large instances.
    • New cake Admin runDBScript indexLogs command adds indexes to the log table for rapid log searching and auditing.
    • New SQL Slow Log endpoint enables benchmarking by identifying slow SQL queries, filterable by controller/action with pagination and configurable slow-query threshold.
    • New purge function clears old SQL benchmark logs to keep logging data manageable.
    • Error logs can now be generated in NDJSON format for easier parsing and integration with modern logging pipelines.

    +3 more show less

    • Error log entries now include the user that caused the exception and the exact codebase location where it occurred.
    • New default OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feed from phish.co.za (Phishing.Database) added for phishing indicator coverage.
    • Updated misp-galaxy, misp-object, and warning-lists components to their latest versions.

    8 details in Everything

40. v2.5.15 Jun 24, 2025 · release notes

    MISP v2.5.15 delivers bi-directional correlation rules, role-based API result limits, and faster object restSearch queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.15 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.15

    └──▷ HOW TO FIND IT
    Set a per-role API result cap to prevent high-volume users from overwhelming the instance during bulk exports.
    📍In the Admin console, go to Administration › Roles, edit the target role, and set the maximum number of results per API request in the role configuration.
    • Bi-directional correlation rule exclusions: existing data now avoids correlating against newly added data when exclusion rules apply, ensuring consistent suppression in both directions.
    • Role-based API result limits: administrators can configure a maximum number of results returned per API request at the role level for granular resource control.
    • Filter attributes by object_relation field in search queries, adding a new dimension to attribute lookups.
    • Galaxy view now displays the count of attributes linked to each galaxy cluster.
    • New Import Choice button surfaced above the attribute list directly on the event view page.

    +2 more show less

    • Significant speed-up for object restSearch queries via optimized query builder prioritizing event table lookups and new caps on object lookups.
    • Database schema updated to support larger TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server API keys.

    7 details in Everything

41. v2.4.213 Jun 22, 2025 · release notes

    MISP v2.4.213 adds bi-directional correlation rules, role-based API result limits, and object_relation attribute filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.213 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.213

    └──▷ HOW TO FIND IT
    Cap how many results a high-volume analyst role can pull per API call to protect server resources.
    📍In the console, go to Administration › List Roles, edit the target role, and set the maximum API result limit field to the desired value (e.g. 10000).
    Narrow a restSearch query to attributes that share a specific object relation, such as all ip-dst relations across objects.
    copy

    $ curl -H 'Authorization: <api_key>' -H 'Accept: application/json' 'https://<misp>/attributes/restSearch' -d '{"object_relation": "ip-dst"}'

    • Bi-directional correlation rule exclusions: existing data now correctly avoids correlating against newly added information when exclusion rules apply, not just the reverse.
    • Role-based API result limits: administrators can now configure a maximum number of results returned per API request at the role level for granular resource control.
    • New attribute filter on object_relation: attributes can now be searched and filtered by their object_relation field.
    • Import Choice button added directly above the attribute list on the event view page for faster import access.
    • Galaxy view now displays a count of attributes linked to each galaxy cluster.

    +1 more show less

    • TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server API key field enlarged in the database schema to support longer key values.

    6 details in Everything

42. v2.5.13 Jun 6, 2025 · release notes

    MISP v2.5.13 revamps search with POST/token-based pagination and adds new event-filtering and warninglist API capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.13 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.13

    └──▷ TRY IT
    Search attributes while suppressing hits that match warning-list entries, reducing noise in bulk hunts.
    copy

    $ curl -s -X POST -H 'Authorization: <your-api-key>' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"value": "<ioc-value>", "warninglist": 1}' 'https://<misp-instance>/attributes/search'

    • Searches now use POST requests backed by a Redis token-based system, enabling flawless pagination on complex queries and independent concurrent search tabs.
    • New event index and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. filtering by whether an event is extending or extended by another event.
    • Warninglist filtering now supported on the /attributes/search endpoint.
    • API accepts desired response format via the Accept header, removing the need to hard-code content negotiation in requests.
    • Attachments can now be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object.

    +1 more show less

    • Event reports can now be looked up by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The extend[ing/ed] parameter for merging data has been renamed to the include_* syntax; existing API calls using extending or extended for merge operations must be updated.
43. v2.4.211 Jun 6, 2025 · release notes

    MISP v2.4.211 revamps search with POST/token pagination, adds event filtering by extend relationships, and warninglist filtering in attribute search.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.211 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.211

    • Attribute and log searches now use POST requests backed by a Redis token system, enabling pagination on complex queries and multiple independent search tabs simultaneously.
    • New event index and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. filtering by whether an event is extending or extended by another event.
    • Warninglist filtering now supported in the /attributes/search endpoint.
    • API now respects the Accept header to set the desired response format.
    • Attachments can be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object.

    +1 more show less

    • Event reports can now be looked up by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The extend[ing/ed] parameter for merging data has been renamed to include_* syntax; existing API calls using extending or extended for merging must be updated.
44. v2.5.12 May 14, 2025 · release notes

    MISP v2.5.12 adds extended vulnerability validation, split event indicators, and optional extended-event index display.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.12 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.12

    • Extends validation for vulnerability attributes across all supported ID formats via vulnerability-lookup integration.
    • Splits Known Identifier from False Positive indicators in the event view for clearer analyst workflows.
    • Introduces optional display of extended events in the event index.
    • Adds a default value for extendedEvents in the event index to prevent undefined behavior.
    • Updates misp-stix, misp-galaxy, and warning-list components to their latest versions.

    +2 more show less

    • Improves support for combining multiple authentication methods (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.).
    • Switches OpenPhish feed to a stable, officially supported GitHub-based URL.

    7 details in Everything

45. v2.4.210 May 14, 2025 · release notes

    MISP 2.4.210 adds split Known Identifier/False Positive indicators, extended vulnerability validation, and optional extended-event index display.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.210 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.210

    • Splits Known Identifier from False Positive indicators in the event view for clearer analyst triage.
    • Extends vulnerability attribute validation to cover all supported ID formats via vulnerability-lookup.
    • Adds optional display of extended events in the event index.
    • Updates misp-stix, misp-galaxy, and warning-list components to their latest versions.
    • Improves support for combining multiple authentication methods (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.).

    5 details in Everything

46. v2.5.11 May 14, 2025 · release notes

    MISP v2.5.11 adds ad-hoc workflow debugging, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. selection, user IP tools, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based collection management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.11 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.11

    └──▷ TRY IT
    Manage a collection by UUID — useful when you don't have the numeric ID available (e.g., cross-instance references).
    copy

    $ GET /collections/view/<uuid>

    • Adds ability to run debugged ad-hoc workflows on specific event IDs directly from the Workflow Editor.
    • Introduces _env dictionary in Jinja rendering to expose environmental context (e.g., base_url) within workflow templates.
    • Supports filtered/unfiltered overrides in workflow execution.
    • Adds OIDC identity provider selection and mixedAuth configuration for flexible authentication setups.
    • Adds new userIP and IPUser tools to the user controller for IP-based user lookups.

    +4 more show less

    • Enables editing, viewing, and deletion of Collections by UUID.
    • Extends OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation coverage for Collections.
    • Makes event.info collation case-insensitive at the database level.
    • Adds PUT method support to CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. add components.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The event.info column collation is now case-insensitive, which may affect existing queries or indexes that relied on case-sensitive matching.
47. v2.4.209 May 14, 2025 · release notes

    MISP v2.4.209 adds ad-hoc workflow debugging on events, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. selection, and new user IP lookup tools.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.209 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.209

    └──▷ HOW TO FIND IT
    Enable mixedAuth so users can authenticate via either OIDC or local credentials, with identity provider selection at login.
    📍In the MISP admin console, go to Administration › Server Settings › OIDC and enable mixedAuth along with configuring the identity provider selection.
    • Adds ability to run debugged ad-hoc workflows directly on specific event IDs in the Workflow Editor.
    • Introduces _env dictionary in Jinja rendering to expose environmental context (e.g., base_url) within workflows.
    • Supports filtered/unfiltered overrides in workflow execution.
    • Adds OIDC identity provider selection and mixedAuth configuration for flexible authentication setups.
    • Introduces userIP and IPUser tools in the user controller for IP-based user lookups.

    +4 more show less

    • Enables editing, viewing, and deletion of Collections by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
    • Extends OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation for Collections.
    • Adds missing PUT method support in CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. add components.
    • Makes event.info collation case-insensitive at the database level.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The event.info field collation is now case-insensitive, which may affect queries or integrations that relied on case-sensitive matching of event titles.
48. v2.4.208 May 14, 2025 · release notes

    MISP v2.4.208 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. filter escaping config, auth plugin loading from config, and updated threat-intel content packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.208 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.208

    • Adds a new configuration option to escape LDAP filters in LdapAuth, hardening directory-based authentication.
    • Introduces support for loading authentication plugins (e.g., OidcAuth) based on configuration settings rather than requiring manual bootstrap code.
    • Updates bundled content packages: misp-stix, misp-objects, warning-lists, and misp-galaxy.

    3 details in Everything

49. v2.5.10 May 14, 2025 · release notes

    MISP v2.5.10 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. filter escaping, auth plugin config loading, and S3 prefix validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.10 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.10

    • Adds a new configuration option to escape LDAP filters in LdapAuth, hardening directory-based authentication.
    • Introduces support for loading authentication plugins dynamically based on configuration settings.
    • Adds validation for S3 bucket prefix when deleting events.
    • Adds warning logging for remote server version mismatches during sync.
    • Updates bundled threat-intelligence components: misp-stix, misp-objects, warning-lists, and misp-galaxy.

    5 details in Everything

50. v2.5.8 Mar 19, 2025 · release notes

    MISP v2.5.8 adds new workflow modules, reworked attribute search with query-string support, and smarter event sync distribution handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.8 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.8

    └──▷ HOW TO FIND IT
    Allow a remote MISP instance's internal-distribution events to be pulled without distribution downgrade, by granting the remote sync user the perm_sync_internal permission.
    📍In the MISP UI, go to Administration › List Users, edit the remote sync user, and enable the perm_sync_internal permission under Role settings.
    • Adds filter-tag workflow module to filter data based on tags.
    • Adds notify_user_toast workflow module to create in-app notification toasts for users.
    • Adds add_analyst_data workflow module to create analyst data directly from workflows.
    • Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and highlighting support for relationship_types in object relationships.
    • Adds a new default distribution setting for galaxies.

    +7 more show less

    • Adds remove_missing_tags support on the Event level during pull synchronisation.
    • Adds perm_sync_internal flag so internal-instance pulls no longer downgrade distribution — the remote instance now controls distribution decisions.
    • Major rework of attribute search: parameters now passable as query strings, search form converted to GET, results easily downloadable, pagination improved, and behaviour made consistent with restsearch.
    • Adds event-report filtering support to the if-tag workflow module.
    • Adds display of the number of events to be synced when testing sync rules on the server index.
    • Adds support for the highlighted field in object-relationship /add and /edit endpoints.
    • Adds support for more HTML attributes in workflow editor form inputs.

    12 details in Everything

51. v2.4.206 Mar 19, 2025 · release notes

    MISP v2.4.206 adds new workflow modules, reworked attribute search, and improved sync permission controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.206 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.206

    └──▷ HOW TO FIND IT
    Test a sync connection and immediately see how many events would be pulled, helping you validate sync rules before committing.
    📍In the MISP UI, go to Administration › Servers, select a remote server, and click Test — the result now includes the count of events that would be synced under the current sync rules.
    Pull events from a remote instance marked as an internal instance without having their distribution level downgraded, provided the remote user has perm_sync_internal.
    📍In the MISP UI, go to Administration › Servers, edit the remote server, and ensure the remote sync user has the perm_sync_internal permission — the pulling instance will then preserve distribution levels as determined by the remote.
    • New filter-tag workflow module enables filtering pipeline data based on tags.
    • New notify_user_toast workflow module creates in-app notification toasts for users.
    • New add_analyst_data workflow module lets workflows create analyst data entries.
    • Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and visual highlighting support for relationship_types in object relationships.
    • New perm_sync_internal permission flag allows internal pulls without distribution downgrade, letting the remote instance control downgrade logic.

    +7 more show less

    • Adds remove_missing_tags support at the Event level during event pull/sync.
    • Reworked attribute search now accepts parameters as query strings, uses a GET form, supports direct downloading of results, improves pagination, and aligns with restsearch behavior.
    • Adds new default distribution setting for galaxies.
    • The if-tag workflow module now supports filtering on event reports.
    • Server sync test now shows the number of events to be synced when testing sync rules.
    • Workflow editor adds support for more HTML attributes in form inputs.
    • Object relationship /add and /edit endpoints now support the highlighted field.

    12 details in Everything

52. v2.4.205 Feb 21, 2025 · release notes

    MISP v2.4.205 adds quick overcorrelation search, a sync-rule test widget, and org-UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based sync filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.205 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.205

    └──▷ HOW TO FIND IT
    Evaluate how many events would be filtered by your current sync rules before pushing to a remote instance — use the new Test Sync Rules widget in the MISP UI.
    📍In the MISP console, go to Sync Actions › Servers, select a remote server, and open the Test Sync Rules widget to see the count of events matched or filtered by the current synchronization filtering rules.
    • Adds quick search for overcorrelations to speed up data investigation and correlation management.
    • New Test Sync Rules widget lets users evaluate how many events are filtered under current synchronization rules before applying them.
    • Sync filtering now uses organization UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. instead of names, reducing ambiguity in event propagation rules.
    • Expands Galaxy Cluster search scope to include fields beyond synonyms, improving search flexibility.

    4 details in Everything

53. v2.5.7 Feb 21, 2025 · release notes

    MISP v2.5.7 adds quick overcorrelation search, a sync-rule test widget, and org-UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based sync filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.7 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.7

    └──▷ HOW TO FIND IT
    Validate how many events your current sync rules would filter before pushing to a remote MISP instance — navigate to the sync server settings and use the new widget.
    📍In the MISP UI, go to Sync Actions › List Servers, open a server entry, and use the new Test Sync Rules widget to see the count of events that would be filtered by the configured synchronization rules.
    • Adds quick search for overcorrelations, enabling faster investigation and management of over-correlated data.
    • New Test Sync Rules widget lets users evaluate how many events would be filtered under current synchronization filtering rules before applying them.
    • Sync filtering now uses organization UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. instead of names, reducing ambiguity in multi-org synchronization configurations.
    • Expands Galaxy Cluster search scope beyond synonyms to additional fields, improving search flexibility and accuracy.

    4 details in Everything

54. v2.5.6 Jan 13, 2025 · release notes

    MISP v2.5.6 adds the Threatmon MISP Community and delivers correlation engine performance improvements via split queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.6 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.6

    • Adds the Threatmon MISP Community to the platform's community integrations.
    • Improves correlation engine performance by splitting attribute correlation lookups into two distinct queries on value1 and value2 for optimized MySQL performance.
    • Reduces memory usage when fetching index data from Redis cache.

    3 details in Everything

55. v2.4.204 Jan 13, 2025 · release notes

    MISP v2.4.204 adds AuditLog filtering for SharingGroupOrg/SharingGroupBlueprint and creation timestamps to application logs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.204 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.204

    • Adds AuditLog filtering support for SharingGroupOrg and SharingGroupBlueprint options, enabling more targeted audit trail queries.
    • Adds creation timestamps to application logs for improved event tracking and chronological analysis.

    2 details in Everything

56. v2.5.5 Jan 13, 2025 · release notes

    MISP v2.5.5 adds misp_stix_converter support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. testing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.5 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.5

57. v2.4.203 Jan 13, 2025 · release notes

    MISP v2.4.203 reworks Log Search with modernized internals, better pagination, and a new object-attribute checkbox in the event view.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.203 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.203

    └──▷ HOW TO FIND IT
    Use the reworked Log Search UI to filter and paginate through audit logs without losing your filter state between pages.
    📍In the MISP UI, go to Audit › Search Logs, apply your filters (e.g., by action or model), and navigate pages — filters now persist across pagination.
    • Reworked Log Search with a modernized internal system, enhanced pagination, filter persistence, and improved UI field information.
    • New checkbox in the event view for selecting object attributes directly.
    • Adds more cli_only flags for fine-grained control of settings.

    3 details in Everything

58. v2.5.4 Dec 31, 2024 · release notes

    MISP v2.5.4 flattens Analyst Data structures, adds analyst/event-report metrics, and expands tag collection support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.4 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.4

    • Analyst Data objects (Notes, Opinions) are now flattened lists attached to their data layer instead of nested, improving API consistency across endpoints and views.
    • Adds new statistics metrics for analyst data and event reports.
    • Supports adding combinations of tag collection tags and other tags simultaneously on attributes.
    • The rest_client_baseurl setting is now CLI-only, restricting it from being configured via the web UI.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Security.disable_form_security setting has been removed; any configuration referencing it will silently lose that setting on upgrade.
    • !rest_client_baseurl is now CLI-only and can no longer be set through the web UI or REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. settings interface.
59. v2.4.202 Dec 31, 2024 · release notes

    MISP v2.4.202 flattens Analyst Data structures, adds new metrics, and supports combined tag collection tagging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.202 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.202

    • Analyst Data objects (Notes, Opinions) are now flattened lists attached to their data layer instead of nested, improving handling across endpoints and views.
    • Adds new metrics for analyst data and event reports in the Statistics section.
    • Supports adding combinations of tag collection tags and other tags simultaneously on attributes.
    • Adds a new setting to skip base URL coercion, enabling cleaner deployments of MISP under a subdirectory.
    • Adds Threatmon MISP Community to the community list.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !rest_client_baseurl is now CLI-only and can no longer be set via the web UI or API.
    • !Security.disable_form_security has been removed; any configuration referencing this setting will no longer be recognized.
60. v2.5.3 Dec 17, 2024 · release notes

    MISP v2.5.3 adds protected-event feed exchange, instance-wide report variables, and a new arbitrary-data signing endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.3 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.3

    └──▷ HOW TO FIND IT
    Enable instance-wide report template variables so all analysts can reference shared context (e.g., CERT name, TLP defaults) in every event report without per-report duplication.
    📍In the MISP console, go to Administration › Report Variables and create a new instance-wide variable (requires site administrator role).
    • Supports exchanging protected events via feeds.
    • Supports uploading protected events via the import MISP JSON functionality.
    • Adds a new endpoint to let the instance sign arbitrary data on demand, gated by a new role permission and ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting.
    • Introduces instance-wide template variables for reports, manageable only by site administrators but viewable and usable by all users.
    • Adds a CodeMirror editor placeholder plugin to display placeholders in the editor interface.

    +4 more show less

    • Adds object count to instance statistics.
    • Adds UI and API export to display bound synchronization users in /users and /servers views.
    • Updates Redis serializer to default to JSON.
    • Restricts additional server settings to CLI-only for improved security.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Redis serializer now defaults to JSON; existing installations should verify Redis serializer settings after upgrading.
61. v2.4.201 Dec 17, 2024 · release notes

    MISP v2.4.201 adds protected-event feed exchange, instance-wide report variables, and a new data-signing endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.201 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.201

    └──▷ HOW TO FIND IT
    Create an instance-wide report template variable as a site admin so all users can reference it in event reports.
    📍In the MISP UI, go to Administration › Report Variables and create a new instance-wide variable; it will be visible and usable by all users in event reports.
    • Supports exchanging protected events via feeds.
    • Supports uploading protected events via the import MISP JSON functionality.
    • Adds a new endpoint to let the instance sign arbitrary data on demand, gated by a new role permission and ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting.
    • Introduces instance-wide template variables for reports, manageable only by site administrators but viewable and usable by all users.
    • Adds object count to MISP instance statistics.

    +2 more show less

    • Adds UI and API export to display bound synchronization users in /users and /servers views.
    • Adds a placeholder plugin to the CodeMirror editor interface.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Redis serializer now defaults to JSON — existing installations should verify Redis serializer settings after upgrading.
62. v2.5.2 Nov 19, 2024 · release notes

    MISP v2.5.2 adds ad-hoc & scheduled workflows, private custom galaxies, PDF export for event reports, and a RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.4 installer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.2 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.2

    └──▷ HOW TO FIND IT
    Reuse analyst boilerplate (e.g. author name, TLP header) across all Event Reports without retyping it.
    📍In the MISP console, go to Global Actions › My Profile › User Settings, define a template variable (e.g. author: Jane Doe), then reference it in any Event Report body as {{ author }}.
    Export a finished Event Report as a properly formatted PDF for sharing outside MISP.
    📍Open the Event Report, click the Download menu, and select Download as PDF (requires the convert_markdown_to_pdf.py misp-module and its dependencies: Pandoc, wkhtmltopdf, mermaid-cli).
    • Adds Ad-Hoc Workflows that run independently of application triggers, executable manually or on a schedule.
    • New run_workflow action module enables workflows to chain and launch other workflows.
    • Enables running a workflow directly against a specific event, similar to running an enrichment.
    • All available galaxy matrices are now selectable in the event view, including user-created matrices.
    • MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix gains an attack-enterprise unfiltered tab showing all techniques together, opened by default.

    +11 more show less

    • Supports creating and editing Private Custom Galaxies with ownership and distribution levels for access control.
    • New MISP.hide_unknown_cluster setting (enabled by default) hides unknown clusters from the tag list after synchronization.
    • New diagnostic widget on the Galaxy index page warns about unknown default and custom clusters.
    • Allows attaching global and local tags to Event Reports for improved classification and sorting.
    • Template variables (handlebars-style {{ var_name }}) can now be defined in user-settings and auto-substituted in Event Reports on visualization or export.
    • New Download as PDF option for Event Reports using Pandoc via the convert_markdown_to_pdf.py misp-module (requires Pandoc, wkhtmltopdf, and mermaid-cli).
    • Enables pasting pictures directly into the Event Report editor, saving images to disk or as event attachments.
    • Site admins can manage imported (pasted) pictures and assign aliases for reuse in reports via  syntax.
    • Extended event view adds a reverse merged view where the parent event's data is merged into the child event.
    • Releases first iteration of a native RHEL installer (minimum RHEL 9.4) as part of MISP 2.5.x.
    • MISP Galaxy, Taxonomies, and Objects now versioned independently using %Y%m%d00 format, decoupled from MISP core releases.

    16 details in Everything

63. v2.4.200 Nov 19, 2024 · release notes

    MISP v2.4.200 adds Ad-Hoc Workflows, private custom galaxies, Event Report PDF export/image pasting, and a RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.4 installer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.200 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.200

    └──▷ HOW TO FIND IT
    Suppress unknown cluster tags that arrive via synchronisation so analysts aren't confused by unrecognised galaxy tags.
    📍In the MISP admin console, go to Administration › Server Settings & Maintenance › MISP, find MISP.hide_unknown_cluster and set it to true.
    Reuse analyst-specific boilerplate (e.g. analyst name, TLP caveat) across all Event Reports without retyping.
    📍In your user profile settings, define a template variable (e.g. analyst_name = Jane Doe), then reference it inside any Event Report as {{ analyst_name }} — it will be substituted automatically when the report is viewed or exported.
    Export a finished Event Report as a polished PDF for stakeholder distribution, using Pandoc rather than the browser print dialog.
    📍Open the Event Report, click the download icon and select Download as PDF — requires convert_markdown_to_pdf.py from misp-modules and Pandoc, wkhtmltopdf, and mermaid-cli installed on the MISP server.
    • Adds Ad-Hoc Workflows that execute independently of application triggers — run manually or on a schedule without waiting for a MISP event.
    • New run_workflow action module lets workflows chain into other workflows, enabling multi-stage automation pipelines.
    • Enables running a workflow directly against a single event, similar to running an enrichment module.
    • Adds private Custom Galaxies with ownership and distribution levels so clusters can be selectively hidden from other users.
    • New MISP.hide_unknown_cluster setting (enabled by default) hides unknown clusters from the tags list after synchronisation.

    +11 more show less

    • Adds a diagnostic widget on the Galaxy index page to warn about misconfigured hidden default and custom clusters.
    • Any galaxy matrix can now be selected and viewed from the Event view, including user-defined matrices.
    • MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix gains an attack-enterprise tab showing all techniques unfiltered, and opens by default.
    • Tags (global and local) can now be attached to Event Reports for classification and sorting.
    • Template variables defined in user-settings are now supported in Event Reports using {{ var_name }} handlebars-style notation, substituted automatically on visualisation or export.
    • New Download as PDF option in Event Reports converts markdown (GFM) to PDF via Pandoc, wkhtmltopdf, and mermaid-cli through the convert_markdown_to_pdf.py misp-module.
    • Users can now paste images directly into the Event Report editor, saving them to disk or as event attachments.
    • Site admins can manage pasted images, assign aliases, and reference them in reports with  syntax.
    • Extended event view adds a reverse merged view where the parent event's data is merged into the child event.
    • First iteration of a native RHEL 9.4+ installer released, bringing MISP 2.5.x to the RHEL community.
    • MISP Galaxy, Taxonomies, and Objects now version independently using %Y%m%d00 format, making currency checks straightforward.

    16 details in Everything

64. v2.4.199 Oct 18, 2024 · release notes

    MISP 2.4.199 adds Kunai export via restSearch, new workflow triggers, and a version comparison tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.199 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.199

    └──▷ TRY IT
    Export MISP events in Kunai format via restSearch to feed into Linux endpoint monitoring pipelines.
    copy

    $ curl -H 'Authorization: <your-api-key>' -H 'Accept: application/json' 'https://<misp-instance>/events/restSearch/returnFormat:kunai'

    • Adds Kunai export format, available via restSearch, for use with Linux endpoint monitoring via the Kunai OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. tool.
    • New workflow triggers for event report saving and proposal saving.
    • New version comparison tool that warns users of new major MISP releases and indicates up-to-date status on their current branch.
    • Improvements to the workflow editor and individual workflow modules.

    4 details in Everything

65. v2.5.1 Oct 18, 2024 · release notes

    MISP 2.5.1 adds Kunai export format, new workflow triggers, and a version comparison tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.1 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ TRY IT
    Export MISP events in Kunai format via restSearch to feed into Linux host-based monitoring with Kunai.
    copy

    $ curl -H 'Authorization: <your-api-key>' -H 'Accept: application/json' -H 'Content-Type: application/json' -X POST https://<misp-instance>/events/restSearch -d '{"returnFormat": "kunai", "tags": ["<tag>"]}'

    • New Kunai export format available via restSearch, enabling Linux endpoint monitoring data export from MISP events.
    • New workflow triggers added for event report saving and proposal saving.
    • New version comparison tool warns users of new major MISP releases and indicates up-to-date status on their current branch.
    • Improvements to the workflow editor and individual workflow modules.
    • Continued improvements to the STIX2 integration, handling additional edge cases.

    5 details in Everything

66. v2.5.0 Oct 4, 2024 · release notes

    MISP 2.5.0 adds PHP 8.1+ support, Supervisor-based workers, and a new Ubuntu 24.04 install/upgrade script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ TRY IT
    Perform a fresh native MISP 2.5 installation on Ubuntu 24.04 with sane defaults.
    copy

    $ bash INSTALL/INSTALL.ubuntu2404.sh

    Upgrade an existing Ubuntu MISP 2.4 installation to 2.5 after first upgrading the OS to Ubuntu 24.04.
    copy

    $ bash INSTALL/UPGRADE.ubuntu2404.sh

    • Adds PHP 8.1+ support via an updated CakePHP fork, enabling MISP to run on a modern, non-EOL PHP runtime.
    • Switches default worker engine to Supervisor-based implementation for new installs and upgrades, replacing the CakeResque-based engine with a more reliable and lightweight alternative.
    • Introduces new native installation and upgrade scripts targeting Ubuntu 24.04 (INSTALL.ubuntu2404.sh and UPGRADE.ubuntu2404.sh).
    • Supports Docker-based installation and upgrade to MISP 2.5 via the updated MISP-docker project.
    • Replaces legacy dependencies with modern PHP 8.x-compatible alternatives across the core platform.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading via the built-in MISP UI or API update function will NOT trigger the 2.4→2.5 minor version upgrade; the upgrade process is manual and requires running the provided upgrade script.
    • !Ubuntu installations must be upgraded to Ubuntu 24.04 before running the UPGRADE script.
    • !Switching to the Supervisor worker engine drops support for scheduled tasks (previously available in CakeResque).
    • !RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. and non-Ubuntu distributions are not yet supported for 2.5; those installations should remain on 2.4 until installation guides are available.
67. v2.4.198 Sep 16, 2024 · release notes

    MISP v2.4.198 adds the dom-hash attribute type for fingerprinting and correlating HTML DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. structure across phishing pages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.198 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.198

    └──▷ HOW TO FIND IT
    Tag a phishing-page event with its DOM fingerprint so analysts can correlate structurally identical pages across MISP instances.
    📍In the event view, click Add Attribute, set Type to dom-hash, and paste the 32-character SHA-256 DOM fingerprint (e.g. from LookyLoo) as the value.
    └──▷ BREAKING ON UPGRADE

    • !The external_baseurl setting is no longer the preferred base URL source; MISP.baseurl is now preferred, and external_baseurl is intended to be informational only for sharing groups.
68. v2.4.197 Sep 2, 2024 · release notes

    MISP v2.4.197 adds org UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. response headers, bookmark comments, and improved STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. dependency visibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.197 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.197

    • New user_org_uuid_in_response_header config option includes the requesting user's organization UUID in API response headers.
    • Bookmarks now support comments, visible in the bookmark index, dropdown menu titles, and add/edit views.
    • Displays required STIX dependency versions during the build process.

    3 details in Everything

69. v2.4.196 Aug 21, 2024 · release notes

    MISP 2.4.196 adds a sighting-based Decaying Model, finer log search timestamps, and REST pagination headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.196 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.196

    └──▷ TRY IT
    Retrieve paginated attribute search results and use the X-Skipped-Elements-Count header to track how many elements were skipped — useful when building reliable paging logic over large result sets.
    copy

    $ curl -s -D - -H 'Authorization: <api_key>' -H 'Accept: application/json' -H 'Content-Type: application/json' -X POST https://<misp_instance>/attributes/restSearch -d '{"returnFormat":"json","sort":"publish_timestamp","page":2,"limit":100}' | grep -E '(X-Skipped-Elements-Count|^{)'

    • New DecayingModel leverages true positive and false positive sightings for improved attribute scoring decisions.
    • Log searches now accept optional hh:mm:ss time accuracy for more precise time-based queries.
    • Attributes REST search gains sorting by publish_timestamp and a new X-Skipped-Elements-Count response header to support accurate pagination.
    • The review user logs button now links directly to logs for the specific user, aligned with the audit log system.

    4 details in Everything

70. v2.4.195 Aug 8, 2024 · release notes

    MISP v2.4.195 adds correlation rule (de-correlation) system and major attribute restSearch performance improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.195 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.195

    └──▷ USE IT
    Exclude recurring daily scan events from correlating with each other using event title substring matching.
    json copy

    {
      "selector_type": "event_info",
      "selector_list": [
        "%] Daily scan results",
        "Weekly scan results week #%"
      ]
    }

    • New correlation rule system lets site admins define de-correlation rules — by org_id, orgc_id, event_id, or event_info (with substring matching) — to suppress noisy cross-correlations between selected events while still allowing those events to correlate with non-matching events.
    • Attribute restSearch now uses internal clustering and ID-based pagination (replacing MySQL offsets) for significantly faster large-dataset and paginated queries.
    • New legacy restSearch setting switches from sub-queries to joins, providing a major performance boost on older MySQL versions.

    3 details in Everything

71. v2.4.194 Jun 21, 2024 · release notes

    MISP v2.4.194 adds bookmark sharing, an unauthenticated /users/heartbeat API endpoint, and a new role permission to skip OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. for service accounts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.194 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.194

    └──▷ TRY IT
    Check if the MISP instance is responsive without needing API credentials or admin access.
    copy

    $ curl -s -o /dev/null -w '%{http_code}' https://<misp_host>/users/heartbeat

    Verify if a specific user has TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. enabled via the API.
    copy

    $ curl -H 'Authorization: <api_key>' https://<misp_host>/users/view/<user_id>.json | jq '.User.totp'

    • /users/heartbeat GET endpoint added for unauthenticated instance health checks returning HTTP 200
    • Bookmark creation now supports sharing with all users in the same organization via the exposed_to_org field
    • New role permission allows excluding specific roles from OTP requirements, enabling local service accounts to bypass two-factor authentication

    3 details in Everything

72. v2.4.193 Jun 7, 2024 · release notes

    MISP v2.4.193 adds /attributes/enrich API endpoint and collapsible attribute UI for instances with misp.enable_collapsible_attributes enabled

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.193 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.193

    └──▷ TRY IT
    Run enrichment modules on a specific attribute via API.
    copy

    $ curl -X POST https://misp.local/attributes/enrich/[attribute_id] \
      -H 'Authorization: YOUR_AUTH_KEY' \
      -d '{"dns": 1}'

    • GET/POST /attributes/enrich/[attribute_id|attribute_uuid] endpoint added to execute enrichment modules on specific attributes.
    • Adds misp.enable_collapsible_attributes MISP setting to configure instance-wide collapsing of Attributes inside an Object in the UI.

    2 details in Everything

73. v2.4.192 May 7, 2024 · release notes

    MISP v2.4.192 adds Fast API Auth with Redis storage for hashed keys and allows disabling TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. with strong IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.192 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.192

    • Fast API Authentication introduces temporary storage of hashed API keys in Redis to enhance endpoint performance
    • Ability to disable TOTP/HTOTP when linked to an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. with strong authentication

    2 details in Everything

74. v2.4.191 Apr 22, 2024 · release notes

    MISP v2.4.191 allows setting the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. issuer for authentication subsystems

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.191 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.191

    • Adds the ability to configure the issuer field within the OIDC authentication subsystem

    1 detail in Everything

75. v2.4.190 Apr 19, 2024 · release notes

    MISP v2.4.190 adds tag collections to feed:pullEvents, workflow stop reasons, unpublished pull mode, and a new benchmarking suite.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.190 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.190

    • feed:pullEvents now accepts tag collections to automatically apply them to pulled events
    • feed functionality includes an option to keep all pulled events unpublished
    • New benchmarking suite collects performance metrics such as memory usage and query counts

    3 details in Everything

76. v2.4.189 Apr 10, 2024 · release notes

    MISP v2.4.189 introduces sighting blocklists for sync filtering and a new integer attribute type.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.189 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.189

    • Adds a sighting blocklist subsystem to filter organisations from sighting sync negotiations in Sightings > Blocklist

    1 detail in Everything

77. v2.4.188 Mar 24, 2024 · release notes

    MISP v2.4.188 adds sighting loading control and analyst-data content type

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.188 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.188

    • Adds MISP.sightings.enabled config key to toggle API-driven sighting data loading for restsearch and /events/view endpoints
    • Adds analyst-data as a supported OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. response content type
    • Introduces sighting policy enforcement in the sightings:getLastSighting function

    3 details in Everything

78. v2.4.187 Mar 24, 2024 · release notes

    MISP v2.4.187 adds org list CLI command and OidcAuth.update_user_role config key

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.187 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.187

    • Adds org list subcommand to MISP's shell interface for listing organizations
    • Adds new role management command accessible via the MISP shell interface

    2 details in Everything

79. v2.4.186 Mar 6, 2024 · release notes

    MISP v2.4.186 introduces Analyst Data (notes/opinions/relationships) and Collections for organizing shared data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.186 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.186

    • Adds the ability to add an Analyst Note to any MISP element (Event, Object, Attribute, etc.)
    • Adds the ability to add an Analyst Opinion with a rating (0-100) to any MISP element
    • Adds the ability to define Analyst Relationships between elements in MISP
    • Adds Collections as a new first-class citizen object for organizing shared data

    4 details in Everything

80. v2.4.184 Feb 6, 2024 · release notes

    MISP v2.4.184 adds first/last seen filters to restsearch API, blocks self-published events, and disables cached exports by default.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.184 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.184

    • Adds first_seen and last_seen filters to the [objects] restsearch endpoint for time-bounded object queries
    • Adds new setting to block event publication if the publishing user is the creator of the event
    • Disables cached exports by default via the MISP.disable_cached_exports configuration key, deprecating /events/export
    • Enforces POST method usage for starting an export generation process

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The MISP.disable_cached_exports setting now defaults to true, disabling the deprecated /events/export endpoint unless explicitly re-enabled.
    • !Starting an export generation process now requires POST; GET requests will fail.
81. v2.4.183 Jan 9, 2024 · release notes

    MISP v2.4.183 adds ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. logging config, UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. tag API, mass cluster tagging event view option, and new galaxy models.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.183 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.183

    • Adds Security.ecs_log configuration key to enable Elastic Common Schema security logging
    • Adds Security.alert_on_suspicious_logins configuration key for security audit alerts
    • Sync configuration now supports sharing group blueprints to create filter rules based on dynamically updated organisation lists
    • Updated API tag functions to accept UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. in addition to local IDs
    • Added mass local cluster tagging option in the [event:view] interface

    +5 more show less

    • Parsing PE binary extensions within File observable objects improved via misp-stix library update
    • New flowintel CM object type available for MISP Objects
    • New disarm galaxy available with Actor Types, Countermeasures, Detections, and Techniques clusters
    • MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Atlas framework added to MISP Galaxy as Attack Pattern and Course of Action clusters
    • Sync configuration now supports sharing group blueprints for filter rule generation based on dynamically updated organisation lists

    10 details in Everything

82. v2.4.182 Dec 22, 2023 · release notes

    MISP v2.4.182 adds show_server_correlations_for_all_users option and event-graph double-click expansion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.182 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.182

    • Adds show_server_correlations_for_all_users configuration option to allow non-privileged users to view server correlations.
    • Enables double-click interaction to expand nodes in the [events:event-graph] visualization.

    2 details in Everything

83. v2.4.180 Dec 22, 2023 · release notes

    Adds X-MISP-AUTH header support and new user login profile features to MISP v2.4.180

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.180 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.180

    └──▷ TRY IT
    Authenticate to the MISP API using the new X-MISP-AUTH header instead of the standard Authorization header.
    copy

    $ curl -H 'X-MISP-AUTH: <your_api_key>' https://misp.example.com/attributes/restSearch

    View the login history for a user in the UI to leverage the new login profile capabilities.
    📍Go to Users › View and select view_login_history from the action menu for the target user.
    • X-MISP-AUTH header added as an alternative to Authorization for API requests.
    • New user login profiles feature enabling suspicious login detection and admin notifications.
    • Event index now shows info field on ID hover, replacing threat level by default.

    3 details in Everything

84. v2.4.179 Nov 26, 2023 · release notes

    MISP v2.4.179 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. report summarization, a fast_update mode for large event edits, and an /events/edit endpoint optimization.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.179 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.179

    • Adds initial LLM integration capabilities for report summarisation and extraction via stochasticCTIExtractor
    • Introduces a new IF module in workflows that allows decisions based on element count criteria
    • Adds a fast_update mode to the /events/edit endpoint to bypass duplicate validation for high-performance bulk updates

    3 details in Everything

85. v2.4.178 Oct 30, 2023 · release notes

    MISP v2.4.178 adds custom JSON hashpath input, new trigger events, enhanced webhook support, orgc_id filter, and totp_delete API endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.178 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.178

    └──▷ USE IT
    Include granular correlation attributes when querying events via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    shell copy

    curl -X GET "https://misp.example.org/events/restSearch?includeGranularCorrelations=1" -H "Authorization: <key>"

    Filter events in /events/restSearch by organization ID using the new orgc_id parameter.
    shell copy

    curl -X GET "https://misp.example.org/events/restSearch?orgc_id=12345" -H "Authorization: <key>"

    • includeGranularCorrelations is now exposed in the event RestSearch endpoint.
    • orgc_id is added as a valid filter for the /events/restSearch API endpoint.
    • Added option to provide custom JSON in the hashpath picker helper within the workflow UI.

    3 details in Everything

86. v2.4.177 Sep 27, 2023 · release notes

    MISP v2.4.177 adds CLI commands for AuthKey expiry and password change triggers, plus trainingShell data wiping functions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.177 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.177

    • Console:trainingShell gains wipeUsers and wipeOrgs functions to delete bulk test data
    • New CLI command to expire active AuthKeys missing an IP allowlist
    • CLI trigger for password change on next login for users with old passwords
    • Added action module under [workflowModules:event_distribution_operation]

    4 details in Everything

87. v2.4.176 Sep 15, 2023 · release notes

    MISP v2.4.176 adds log time filters, user password change timestamps, Shadow Attribute UI visibility, TrainingShell deleteAllSyncs, Ellio feed, Cisco/Censys warning lists

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.176 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.176

    • Adds time based filtering to logs via time parameter in log queries.
    • Adds last_password_change timestamp field to user audit records.
    • Shows which attributes and objects are new and awaiting publication in the UI.
    • Adds deleteAllSyncs function to the console:TrainingShell.
    • Adds Ellio threat list integration to the feeds module.

    +1 more show less

    • Adds Cisco umbrella block pages and Censys scanning IP address space to warning-lists.

    6 details in Everything

88. v2.4.175 Aug 24, 2023 · release notes

    MISP v2.4.175 adds dashboard date filtering, periodic report day selection, new SigMF/SigMF-object support, and generic x-header object template

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.175 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.175

    • Adds start_date and end_date options to MISP dashboard widgets for precise time-range filtering.
    • Adds a configurable number-of-days field in the UI for user periodic reporting.
    • Adds first_half_year and second_half_year timeframe support in the MISP dashboard org Widget.
    • Adds new enrich object functionality allowing enrichment of a complete MISP object, usable with any expansion module supporting objects.
    • Adds new generic x-header object template to add custom HTTP or SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. headers easily.

    +1 more show less

    • Adds SigMF object templates for Signal Metadata Format Specification support.

    6 details in Everything

89. v2.4.174 Jul 31, 2023 · release notes

    MISP v2.4.174 adds curation blueprints, workflow editor operators, new object templates, and an IP allowlist setting for authkeys.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.174 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.174

    • Adds authkeys setting to mandate IP allowlist for advanced authentication keys.
    • Adds proposal sync option to disable correlation/proposal to delete fields in the proposal index.
    • Adds 9 new workflow blueprints for false-positive curation, including Flag false-positive tripping over warninglists.
    • Adds Any value and Any values from operators for multiple values filtering in the workflow editor.
    • Adds quick insert on existing links feature in the workflow editor UI.

    +7 more show less

    • Adds collapsible sidebar support in the workflow editor UI.
    • Adds hash-path picker helper tool in the workflow editor UI.
    • Adds frame nodes feature for grouping actions in blueprints within the workflow editor UI.
    • Adds hhhash format object template for threat intelligence objects.
    • Adds new object templates for STIX 2.1 incident extension and AbuseIPDB.
    • Adds new object template for Google Safe Browsing.
    • Adds support for STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. relationships in MISP.

    12 details in Everything

90. v2.4.173 Jul 11, 2023 · release notes

    MISP v2.4.173 adds user self-service password reset and new dashboard widgets (ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmap, log events/org chart)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.173 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.173

    └──▷ HOW TO FIND IT
    View threat hunting coverage using the new ATT&CK visualization on the dashboard.
    📍Navigate to Dashboard › Widgets › Add Widget › ATT&CK heatmap
    • Adds self-service password reset for users, enabling a login-screen link to enter email and receive a token with a 10-minute lifetime
    • Adds Logarithmic events/org chart widget to the dashboard
    • Adds ATT&CK heatmap widget to the dashboard
    • Enables downloading raw data feeds for all dashboard widgets

    4 details in Everything

91. v2.4.172 Jun 13, 2023 · release notes

    MISP v2.4.172 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip./HOTP authentication enforcement via MISP.totp_required and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server browsing capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.172 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.172

    • Adds the MISP.totp_required security setting to enforce TOTP for all users
    • Adds TAXII browser to view collections and browse STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. object contents at the taxii_servers/view/[id] endpoint

    2 details in Everything

92. v2.4.171 May 18, 2023 · release notes

    MISP v2.4.171 adds configurable dashboard widgets, time ranges, and new Galaxy objects.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.171 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.171

    • organisation evolution line-chart widget for monitoring community growth trends
    • World map widget displaying country representation of the community
    • latest Users ticker showing newly enrolled users
    • latest organisations ticker showing newly enrolled organizations
    • UI login counts list for configured timeframes

    +6 more show less

    • UI authentications list for configured timeframes
    • Published event line-chart widget
    • Contributing organisation and user top lists (requires security setting)
    • Filterable trending attribute values widget
    • New risk-assessment-report object for sharing risk reports
    • New ai_chat_prompt object template

    11 details in Everything

93. v2.4.170 Apr 13, 2023 · release notes

    MISP v2.4.170 adds workflow logic modules, API IP pinning, Greynoise object, and /attributes/add upsert support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.170 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.170

    └──▷ HOW TO FIND IT
    Pin an API key to a specific IP address for tighter security controls in the UI.
    📍In the User › My settings › Auth tab, select Pin IP next to the desired API key entry and save.
    Add a new Greynoise IP object to an event for immediate enrichment integration.
    📍In the Event view › Objects tab, click Add Object and select Greynoise-ip.
    • Adds the if logic module to the misp-workflow-modules framework for event threat level conditions.
    • Allows org admins and all admins to use the workflow-module:send_mail module to receive send_log_mail events.
    • Enables workflow-module:tag_if to support galaxy clusters, resolving issue #8959.
    • Improves API security by allowing single-click IP pinning for API authentication keys.
    • Adds a new Greynoise-ip object type for importing threat intelligence data.

    +3 more show less

    • Adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. attributes to the network-socket object schema.
    • Introduces new relationship type rewrite for MISP Objects and Relationships.
    • Adds breakOnDuplicate parameter support on /attributes/add endpoint to enable upsert behavior.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The workflows module now requires misp-modules for email functionality.
94. v2.4.169 Mar 14, 2023 · release notes

    MISP v2.4.169 adds Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host. export workflow module, new MISP objects and galaxy clusters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.169 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.169

    • Adds workflow module for exporting MISP events to Splunk via HTTP Event Collector (HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.)
    • Introduces ransomware-group-post MISP object type for sharing ransomware group data from ransomlook.io
    • Adds new transport-ticket MISP object for tracking transport-related intelligence
    • Adds registry-key-value MISP object type for storing Windows registry key details
    • Adds first-dns galaxy matrix describing DNS abuse techniques

    +2 more show less

    • Adds captive-portals warning list to detect captive portal networks
    • Adds parking-page warning list to identify parking page infrastructure

    7 details in Everything

95. v2.4.168 Feb 16, 2023 · release notes

    MISP v2.4.168 adds typosquattingtyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike.-finder object, Sigma Galaxy, and several new taxonomies/generators

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.168 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.168

    • Adds a MISP object for typosquatting-finder output from typosquatting-finder.circl.lu
    • Introduces a Sigma Galaxy cluster with all Sigma rules and their ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. relationships, including an import script at misp-galaxy/tools/sigma/sigma-to-galaxy.py
    • Adds new warning-list generators for Cached Chrome Top Million Websites and improved gzip file source support

    3 details in Everything

96. v2.4.167 Dec 26, 2022 · release notes

    MISP v2.4.167 adds timeline overview for large events, taxonomy highlighting, free-text object creation, and a session kill-switch API endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.167 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.167

    └──▷ HOW TO FIND IT
    Highlight specific taxonomies for your organization.
    📍1. Log in as a site admin user. 2. Navigate to the taxonomy list settings page. 3. Select the checkboxes next to the taxonomies you consider important. 4. Save the configuration; the selected namespace boxes will now appear visibly on the interface.
    • session kill-switch API endpoint added to terminate active sessions for integration with MeliCERTes project
    • New event timeline view displays overall occurrence counts and sighting trends for events with more than 500 attributes or objects
    • Site admins can now highlight important taxonomies via the taxonomy list UI, making those namespaces appear in a visible box on the interface
    • Free-text import now supports creating MISP objects directly alongside attributes

    4 details in Everything

97. v2.4.166 Nov 30, 2022 · release notes

    MISP v2.4.166 adds TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. server push integration and logging rework

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.166 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.166

    • Adds TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2.1 server push integration for exporting content to external servers.
    • Introduces a separate Access log subsystem within the reworked logging architecture.

    2 details in Everything

98. v2.4.165 Nov 22, 2022 · release notes

    Adds generic attribute edition module, new workflow triggers for event creation, and CLI feed management commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.165 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.165

    • Adds workflow modules to toggle/remove the to_ids flag on attributes
    • Adds a generic workflow module to support attribute edition operations
    • Adds event_after_save_new trigger firing on new events and new events from pull
    • Adds execute_module parameter to ignore format conversion before executing modules
    • Adds filtering capability on the workflows:triggers index

    +5 more show less

    • Adds feed management commands via the CLI interface
    • Adds pretty and JSON output options for CLI list and view feeds
    • Adds MISP workflow taxonomy for consistent tagging messages
    • Adds Telegram bot object description type
    • Updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework support to version 12.0

    10 details in Everything

99. v2.4.164 Oct 10, 2022 · release notes

    MISP v2.4.164 adds tag relationships to the API and workflow filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.164 https://github.com/MISP/MISP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.164

    └──▷ TRY IT
    Modify the relationship of a specific attribute tag via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    copy

    $ curl -X POST 'https://<misp_host>/tags/modifyTagRelationship/attribute/<attribute_id>' -H 'Authorization: <key>' -H 'Accept: application/json'

    Configure a workflow to utilize the new local and relationship scopes.
    ini copy

    [workflow]
    scoping = ["local", "relationship"]
    # ... other settings

    • Adds /tags/modifyTagRelationship/[scope]/[id] API endpoint to modify tag relationships for attributes, events, and galaxy clusters.
    • Adds local and relationship values to the [workflow] configuration or UI filter options.
    • Enhances [API/galaxyCluster/restSearch] to allow multiple filtering conditions simultaneously.

    3 details in Everything

100. v2.4.163 Sep 26, 2022 · release notes

     MISP v2.4.163 updates periodic notifications with configurable trending days and shows new correlation data.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.163 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.163

     • Adds an option to set the number of days for the trending calculation in periodic notifications.
     • New correlations are now displayed in the periodic notification summary.
     • Periodic notification charts now only show data for tags that have changed over time.

     3 details in Everything

101. v2.4.162 Sep 13, 2022 · release notes

     MISP v2.4.162 adds periodic data summaries, a new email workflow module with Jinja templating, and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. search enhancements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.162 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.162

     └──▷ TRY IT
     Filter events by specific tags using the new REST API parameter for targeted analysis.
     copy

     $ GET /api/events/restSearch?event_tags='exploit,cve-2023'

     Generate a static HTML report of event search results for offline sharing without running the API.
     copy

     $ GET /api/events/restSearch?static=1&include_proposals=false

     • Adds periodic summary feature for daily, weekly, and monthly data snapshots, sent via email or UI to subscribed users.
     • Adds email notification module in workflows supporting list recipients and Jinja templating.
     • Allows specifying arbitrary URLs in webhook modules for diagnostic purposes.
     • Adds new Microsoft Teams module based on the existing webhook module.
     • Enables use of tag names directly within workflow configurations.

     +2 more show less

     • Adds event_tags parameter to API/Event:restSearch to filter by eventTag only.
     • Adds static parameter support in API RestSearch to produce static HTML output.

     7 details in Everything

102. v2.4.161 Aug 11, 2022 · release notes

     MISP v2.4.161 adds an API request log option, overcorrelation occurrence counting, and TLP tag validation.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.161 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.161

     • Adds a new option to log the last API request of an API key
     • Adds a hook to truncate the over-correlating value table on recorrelation
     • Adds tlp:amber+strict and tlp:clear as valid tags

     3 details in Everything

103. v2.4.160 Aug 8, 2022 · release notes

     MISP v2.4.160 adds built-in workflow system, new correlation engines, and Mermaid support in event reports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.160 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.160

     └──▷ HOW TO FIND IT
     Explore the built-in workflow system to customize automated tasks like event publishing.
     📍In the MISP UI, navigate to the new Workflows section to access the graphical interface for defining custom logical steps in your synchronization and enrollment processes.
     • mermaid diagram syntax is now supported directly inside the event report editor, enabling graph and flow chart creation via markdown without external tools
     • Built-in graphical workflow system introduced for modifying event publishing, user enrollment, and synchronization logic through a module-based interface
     • Two new correlation engines replace the deprecated engine, significantly improving performance and reducing storage requirements

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The previous correlation engine is retired and replaced; upgrading will regenerate all correlations using the new engine, a process that may take an extended period on large instances.
104. v2.4.159 May 30, 2022 · release notes

     MISP v2.4.159 adds DB query hints, feed correlation disable, and multiple UI filters

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.159 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.159

     • Adds MysqlExtended DboSource to support index query hints for database performance tuning
     • Adds a new setting to disable taxonomy checks when browsing data in the UI
     • Adds diagnostic check for file-based PHP session handling with recommendation to use Redis sessions
     • Adds option to disable correlations for all events imported from a specific feed
     • Adds textarea input for uploading MISP events via pasted data alongside existing file upload

     +7 more show less

     • Enables clusters:attachMultipleClusters config key to mirror attribute clusters to events during mirroring
     • Adds ability to fetch event changes from a specific time in audit logs
     • Adds filter capability for attributes within the Related Events box in the UI
     • Adds filter capability for attributes within the warninglist box in the UI
     • Disables the correlation checkbox for non-correlating attribute types in the UI
     • Improves STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2 import to parse Galaxies by looking for ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. technique IDs
     • Enables sharing group filter on Event controller objects in addition to existing attribute-level support

     12 details in Everything

105. v2.4.158 Apr 20, 2022 · release notes

     MISP v2.4.158 adds custom email template overrides and RestSearch by sharing groups

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.158 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.158

     └──▷ TRY IT
     Query the RestSearch API for events associated with a specific sharing group.
     copy

     $ curl -s 'https://misp-server/api/events/restSearch?sharing_group=123&authkey=YOUR_KEY' | jq '.Event[0].id'

     • Adds the ability to override standard email templates using custom files in /var/www/MISP/app/View/Email/text/Custom/ and /var/www/MISP/app/View/Email/html/Custom/.
     • Enables searching events by sharing_group in RestSearch queries, in addition to distribution levels.

     2 details in Everything

106. v2.4.157 Mar 25, 2022 · release notes

     Adds MISP.disable_event_locks server setting; restores auth key management for org admins

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.157 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.157

     • Adds MISP.disable_event_locks server setting to disable event lock checks.
     • Enables org admins to manage authentication keys directly via the interface or API.

     2 details in Everything

107. v2.4.156 Mar 18, 2022 · release notes

     MISP v2.4.156 adds PGP-signed sync events, HTML context export, warning system, and LinOTP enable flag

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.156 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.156

     • Adds the Protected mode field in the event UI to attach PGP signing keys for cryptographic event synchronization
     • Adds an HTML export format for filtering data and generating a summary with Mitre ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. matrix and context labels
     • Introduces a pluggable warning system that warns users about event quality improvements such as tagging issues
     • Adds the LinOTP.enable system setting to control the LinOTP authentication subsystem via configuration

     4 details in Everything

108. v2.4.154 Mar 18, 2022 · release notes

     Adds sharing group blueprints via API and UI to automate dynamic member updates.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.154 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.154

     └──▷ USE IT
     Automate the creation of a sharing group that includes all Financial organizations and members of SG 127, while excluding those from Russia, Belarus, or their federations.
     json copy

     {
        "AND": {
            "OR": {
                "org_sector": "Financial",
                "sharing_group_id": 127
            },
            "NOT": {
                "org_nationality": [
                    "Russia",
                    "Russian Federation",
                    "Belarus",
                    "Republic of Belarus"
                ]
            }
        }
     }

     Pre-populate an existing event with attributes and objects from a local JSON file via the UI instead of manual entry.
     📍In the Event editor, click 'Populate from...' › 'Populate using a JSON file containing MISP event content data' › Upload your JSON file.
     • Adds the ability to define reusable sharing group blueprints using JSON filters (inheritance, metadata, boolean operators) to programmatically generate or update MISP sharing groups.
     • Adds a new event population workflow: uploading a JSON file containing MISP elements via the UI option "Populate from... > Populate using a JSON file containing MISP event content data".

     2 details in Everything

109. v2.4.153 Feb 4, 2022 · release notes

     MISP v2.4.153 adds Thai UI, VirusTotal collection export MWDB push modules, FOAF/STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. object templates

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.153 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.153

     • misp-stix library improved to support additional file import coverage and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export.
     • New virustotal_collections export module added for MISP Modules.
     • New MWDB push module added for malware samples.
     • New State responsibility taxonomy added.
     • New Unified Kill Chain taxonomy added.

     +2 more show less

     • New social and personal relationships based on FOAF relationships added to MISP objects.
     • Probabilistic data structure object added as a new template.

     7 details in Everything

110. v2.4.152 Dec 22, 2021 · release notes

     MISP v2.4.152 adds optional sync filtering, attribute restSearch STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. exports, LinOTP mixed mode, Qintel module, and political/deception taxonomies.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.152 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.152

     └──▷ TRY IT
     Export attributes from a specific search query in STIX 2 format via the API.
     copy

     $ curl -k -H 'Authorization: <YOUR_API_KEY>' -H 'Accept: application/json' 'https://<MISP_HOST>/attributes/restSearch?returntype=stix2&search=<your_search_criteria>'

     • Adds optional synchronisation filtering to remove specific attribute or object types during sync (requires enabling in general configuration)
     • Adds STIX 1 and 2 export support for the attribute restSearch endpoint by specifying the format as the return type
     • Adds mixed mode to the LinOTP authentication module allowing both OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. and standard password authentication simultaneously
     • Adds CIRCL hashlookup expansion module with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. support
     • Adds the political spectrum taxonomy to MISP

     +4 more show less

     • Adds the deception taxonomy to MISP
     • Adds the Concordia Mobile Modelling Framework - Attack Pattern galaxy entry
     • Adds new CONCORDIA intrusion set and temporal event object types
     • Adds new relationship types (found-in, works-with, drives) to MISP objects

     9 details in Everything

111. v2.4.151 Nov 23, 2021 · release notes

     MISP v2.4.151 adds a new Supervisord-based background processor, DB-stored system settings, and several new expansion modules.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.151 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.151

     • Adds an optional Supervisord-based background processing engine as a replacement for CakeResque
     • Enables moving system settings from config.php to the database for containerized persistence
     • Adds Passive SSH expansion module for SSH traffic analysis
     • Adds CIRCL hashlookup expansion module for hash lookups
     • Updates Recorded Future expansion module to include related data and links

     +1 more show less

     • Adds JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. server, Security playbook, submarine, Passive SSH, hashlookup, and edr-report objects

     6 details in Everything

112. v2.4.149 Oct 12, 2021 · release notes

     MISP v2.4.149 adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export version control, Cerebrate sharing group fetches, and mail2misp v1.0 integration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.149 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.149

     • Allows specifying stix_version when exporting STIX data to select between versions 1.1.1, 1.2, 2.0, or 2.1
     • Enables fetching sharing group data from Cerebrate instances for community orchestration
     • Adds official support for mail2misp v1.0 to create MISP events from email infrastructure

     3 details in Everything

113. v2.4.148 Aug 9, 2021 · release notes

     MISP v2.4.148 adds ApacheShibbAuth org block and misp_json_warninglist ZMQ topic

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.148 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.148

     • Adds block_organisation_changes option to ApacheShibbAuth to prevent identity changes at login
     • Adds misp_json_warninglist to the ZMQ pub-sub channels for warning list updates

     2 details in Everything

114. v2.4.146 Jul 5, 2021 · release notes

     MISP v2.4.146 adds email summary-only alerts, read-only API keys, and API-managed warning lists.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.146 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.146

     • Adds New event summaries only configuration option to send email notifications excluding attributes and objects.
     • Adds support for creating read-only authentication keys via the API (requires enabling advanced authentication key feature).
     • Enables importing warning lists directly via the MISP API.
     • Exports warning list changes through the ZMQ channel for external consumption.

     4 details in Everything

115. v2.4.145 Jul 5, 2021 · release notes

     MISP v2.4.145 adds custom warning lists in UI, API import/export, read-only auth keys, and summary-only email notifications.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.145 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.145

     • Custom warning lists can be created and managed in the MISP user-interface
     • Warning lists can now be imported via the API
     • Warning list changes are exported in the ZMQ channel
     • You can now create read only authentication keys with the advanced authentication key feature enabled
     • Email notifications include a new configuration setting for event summaries only, excluding attributes and objects

     5 details in Everything

116. v2.4.144 Jun 9, 2021 · release notes

     MISP v2.4.144 adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation, CyCAT integration, and sync/auth diagrams

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.144 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.144

     └──▷ HOW TO FIND IT
     Explore MISP's REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. directly from the web interface with examples
     📍Open the new API menu item in the MISP UI to view endpoints and payloads.
     Enable CyCAT integration to map galaxy clusters to security techniques
     📍Go to Plugin settings and enable the cycat feature.
     • Adds in-app API documentation via an API menu item, with example payloads and responses
     • Adds a cycat plugin setting to enable CyCAT integration for galaxy cluster relations
     • Adds Authentication Diagram and Data visibility for Sync-users synchronisation graphs

     3 details in Everything

117. v2.4.143 May 19, 2021 · release notes

     MISP v2.4.143 introduces a new JSON audit subsystem, Passive DNS COF module, and alert flood protection settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.143 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.143

     • Adds a new machine-parsable audit system that logs all changes as JSON objects, enabled via server_settings
     • Adds cof2misp MISP module to import Passive DNS data in JSON COF Format (draft-dulaunoy-dnsop-passive-dns-cof-08) into MISP objects
     • Adds configurable alert lockout timers for event republish-alert flood protection via server settings

     3 details in Everything

118. v2.4.142 Apr 28, 2021 · release notes

     Adds correlation exclusion lists, top correlations view, revamped server sync rule management UI, and new dashboard widgets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.142 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.142

     • Enables adding values to a correlation exclusion list to prevent them from ever correlating again
     • Provides a background task to retroactively execute exclusion rules on existing correlations
     • Adds a Top correlations view to list the most correlating values for evaluating noisy correlations
     • Revamps server sync rule management UI with automatic remote tag retrieval and JSON parsing for custom filters
     • Introduces new dashboard widgets showing usage statistics and user base growth

     5 details in Everything

119. v2.4.141 Apr 19, 2021 · release notes

     MISP v2.4.141 adds HTML email alerts, event_alert_metadata_only config, and new DataPlane.org feeds

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.141 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.141

     └──▷ TRY IT
     Validate that new HTML email templates render correctly before enabling them in production.
     copy

     $ python /var/www/MISP/app/Lib/cake.php Console/Test alert_email_template

     • Adds MISP.event_alert_metadata_only configuration key to control email alert payload contents
     • Adds backend support for sending HTML formatted email notifications
     • Adds command-line interface to test generated alert emails
     • Adds support for new DataPlane.org feeds as default sources
     • Allows setting the email subject line from within the template

     5 details in Everything

120. v2.4.140 Mar 10, 2021 · release notes

     MISP v2.4.140 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./Azure AD auth, security audit tool, cross-event object graphs, new CLI sync commands, and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. attributes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.140 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.140

     └──▷ TRY IT
     List connected servers to sync specific instance data via CLI.
     copy

     $ bin/cake MISP.ServerList

     • Adds OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication integration via app/Plugin/OidcAuth plugin
     • Adds Azure Active Directory Authentication integration via app/Plugin/AadAuth plugin
     • Adds Security Audit tool in server settings diagnostics section to check security posture and CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. configuration
     • Enables cross-referencing objects across extended events with connected graphs for counter-analyses
     • Adds CLI tools to list connected servers for automating sync processes per server

     +2 more show less

     • Adds developer CLI tool to massage direct feed description dumps into expected formats
     • Adds dkim, dkim-signature, and full-name attribute types to support DKIM object investigation

     7 details in Everything

121. v2.4.139 Feb 16, 2021 · release notes

     Event Reports integration in MISP modules, configurable event fetcher options, and EventStream widget

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.139 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.139

     • MISP modules are now Event Report aware, allowing integrations to process or generate reports alongside events.
     • Modules can impose options for the event fetcher to restrict received event parts or include specific data like the decay score.
     • New EventStream widget enables monitoring ongoing trends based on organization sources and applied tags.

     3 details in Everything

122. v2.4.138 Feb 10, 2021 · release notes

     Adds nested JSON to Galaxy Element generator for dynamic marking support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.138 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.138

     • Integrates the RSIT galaxy with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. relationships.

     1 detail in Everything

123. v2.4.137 Jan 21, 2021 · release notes

     MISP 2.4.137 adds sync data compression, correlation value exclusion tool, and improved API key logging.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.137 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.137

     • Adds data compression for synchronization exchanges to improve transfer rates
     • Introduces a new tool to exclude specific values from the correlation engine to reduce noise
     • Adds additional metrics and comparison tools for sync connections
     • Improves API key management with better usage logging

     4 details in Everything

124. v2.4.136 Jan 18, 2021 · release notes

     MISP v2.4.136 adds Cerebrate integration as a metadata lookup source and enhances sharing group filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.136 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.136

     └──▷ HOW TO FIND IT
     Look up organisation metadata from a Cerebrate instance during event creation.
     📍Configure MISP to point to your Cerebrate instance, then create an event and utilize the familiar preview/pull mechanism for organisation metadata.
     Filter sharing groups to quickly find relevant events in large communities.
     📍In the MISP interface, use the new filtering options on the sharing group list or event search to target information within specific sharing group repositories.
     • Adds the ability to use a Cerebrate instance as a lookup repository for organisation metadata within MISP events
     • Introduces filtering capabilities for sharing groups to locate specific events more accurately

     2 details in Everything

125. v2.4.135 Dec 23, 2020 · release notes

     MISP v2.4.135 introduces Galaxy 2.0 customization, Advanced API authkeys, JARM support, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2 import improvements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.135 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.135

     • Enables Security.advanced_authkeys configuration to allow per-user API key management with individual expirations and comments
     • Adds support for the jarm indicator type in MISP and MISP standard format
     • Introduces Galaxy 2.0 capability to customize, extend, and share Galaxy clusters (e.g., threat-actors, @MITREattack) within the community

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !API keys are now stored in a hashed state and can no longer be recovered from MISP
126. v2.4.134 Nov 12, 2020 · release notes

     MISP v2.4.134 adds automatic Event Report discovery, optional A/V scanning, ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. sub-techniques, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. ingestion scripts

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.134 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.134

     └──▷ HOW TO FIND IT
     Use Event Reports to automatically pull IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and context from a suspect URL into your MISP event.
     📍In the MISP UI, create or edit an Event Report and enable the Automatic discovery feature for web content.
     • Adds automatic attribute/galaxy/tag discovery from websites in Event Reports to external collectors data

     1 detail in Everything

127. v2.4.133 Oct 16, 2020 · release notes

     MISP v2.4.133 introduces Event Reports with a Markdown editor and recovery for deleted events via the diagnostics page.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.133 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.133

     └──▷ HOW TO FIND IT
     Attach a markdown report to an event using the new editor.
     📍In the MISP UI, navigate to an Event › click Add Report to open the Markdown editor.
     Recover a previously deleted event via the diagnostics page.
     📍Go to Admin › Diagnostics › find recover-deleted-events section and select the target event ID from history.
     Use new attribute types for CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. and telfhash in event attributes.
     📍When adding an attribute to an event, select cpe or telfhash from the type dropdown menu.
     • Adds Event Report feature with Markdown editor to attach structured reports (using attributes, objects, galaxies, tags) to an event
     • Adds ability to recover deleted events from the diagnostics page using event history
     • Adds filename-pattern, cpe, and telfhash attribute types for new data structures
     • Adds support for CPE associated object type cpe-asset
     • Adds display of organization nationality flags using Twemoji icons in the UI

     +2 more show less

     • Adds icons for threat levels in the MISP interface
     • Speeds up sending module results and sighting saving

     7 details in Everything

128. v2.4.132 Sep 21, 2020 · release notes

     MISP v2.4.132 adds Sightings_anonymise_as setting for anonymising pushed sightings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.132 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.132

129. v2.4.131 Sep 8, 2020 · release notes

     MISP v2.4.131 adds pgp/sha3/email types, API count endpoint, and inclusive naming.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.131 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.131

     • Adds pgp-public-key, pgp-private-key, sha3, and new email attribute types
     • Adds count returnFormat to the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for counting attributes/events by scope
     • Adds a type filter to the internal fetcher that appends email as type for email-src/email-dst matches
     • Extends ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to allow host org users to manage event blocklists via new host_org_user permission

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The terms blacklist and whitelist are renamed to blocklist and includelist in the UI and API responses; scripts managing these must be updated.
130. v2.4.130 Aug 21, 2020 · release notes

     MISP v2.4.130 adds IDN domain support, UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based event fetching via CLI, tag deletion APIs, and UI event preview on merge.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.130 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.130

     • tag deletion for an event on update allows removing tags during an event update operation
     • attribute tag deletion is now supported via Event or Attribute edit endpoints, with attribute tags cleaned and returned in the response
     • url parameter added to [opendata export] parsing to specify a custom Open data portal URL
     • [at], hxtp, and htxp auto-conversion in freetext fields ([at] to @, hxtp/htxp to http)
     • IDN domains are now supported in attribute types

     +1 more show less

     • UI event preview is now shown when merging events

     6 details in Everything

131. v2.4.129 Jul 28, 2020 · release notes

     MISP v2.4.129 adds an event block rule system for tag-based filtering and API-enabled event merging

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.129 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.129

     • Adds an event block rule system to prevent tagged events from syncing into MISP
     • API enabled for the merge functionality to directly merge source event contents into a target event

     2 details in Everything

132. v2.4.128 Jun 26, 2020 · release notes

     Adds CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. correlation for IP/port types, authentication failure dashboard widget, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. galaxy mapping

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.128 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.128

     └──▷ HOW TO FIND IT
     View authentication failures directly on the main dashboard without navigating to logs.
     📍In the Dashboard, add the Authentication failure widget from the available widgets list.
     • Enables CIDR-based correlation logic for ip-src|port and ip-dst|port attribute types
     • STIX import now automatically maps threat-actors and tools to existing MISP galaxies

     2 details in Everything

133. v2.4.127 Jun 19, 2020 · release notes

     MISP v2.4.127 adds user settings for default REST search parameters, tag numerical value overrides, new system widgets, and CLI remote pulls.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.127 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.127

     • Adds default_restsearch_parameters user setting to inject filters into API queries
     • Adds tag_numerical_value_override site-admin setting to define custom tag values
     • Attributes' last_seen field now takes precedence over timestamp in decay computation
     • New system resource widget displays df, cpu, and mem data
     • New latest sightings widget shows recent activity

     +2 more show less

     • New false positive sightings widget displays items above a defined threshold
     • Adds CLI command for pulling updates from all remote servers

     7 details in Everything

134. v2.4.126 Jun 4, 2020 · release notes

     Adds community webpage generation tool and experimental CLI force-pull method for MISP data synchronization

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.126 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.126

     └──▷ USE IT
     Generate the HTML page listing all MISP communities for public discovery.
     shell copy

     python /opt/misp/PyMISP/scripts/generate_community_page.py

     • Adds a new command-line tool to generate the communities webpage, helping users find the right MISP communities.
     • Adds an experimental CLI-only force-pull method accessible via the API, allowing administrators to overwrite local data with remote state regardless of version.

     2 details in Everything

135. v2.4.125 May 6, 2020 · release notes

     MISP v2.4.125 adds self-registration inbox for community onboarding and email-based OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. for login security.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.125 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.125

     • self_registration inbox allows unauthenticated registration requests to land in a queue for admin review, enabling ISACs and large communities to onboard members without manual user creation.
     • E-mail based OTP requires users to provide a token received via email at each new session login, accessible through the security settings.
     • Feed index refactoring adds the ability to select an orgc_id for CSV/freetext feeds so all generated events carry that organization context.
     • MySQLObserver datasource prepends database queries with controller/action and user ID to improve debugging visibility.

     4 details in Everything

136. v2.4.124 Apr 6, 2020 · release notes

     MISP v2.4.124 adds multiline dashboard widgets and per-user audit logging for admin monitoring.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.124 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.124

     └──▷ HOW TO FIND IT
     Inspect the delta between two data points in a dashboard chart using the new multiline widget UI.
     📍In the MISP Dashboard, add a multiline widget, select the first point on the line, then click a second point to view the delta summary.
     Monitor all activity for a specific suspect account by enabling the monitoring flag in user settings.
     📍As Site Admin: Go to Users › [User], enable the monitoring flag (if enabled on instance). All requests and POST bodies will be logged.
     • Adds multiline widget type to the MISP Dashboard with configurable styling, linear/time-based x-axis support, and point-selection delta queries
     • Enables site admins to set a monitoring flag on individual users to log all requests and POST bodies for that user

     2 details in Everything

137. v2.4.123 Mar 11, 2020 · release notes

     MISP v2.4.123 adds a customizable Dashboard system with widgets, templates, and a home page selector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.123 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.123

     • Adds a new Dashboard system accessible in MISP that supports bundled and custom widgets for tracking information.
     • Enables users to set a custom home page by clicking the star icon in the header bar instead of redirecting to the event index.
     • Supports saving and sharing Dashboard templates via MISP UI or JSON configuration files.
     • Provides ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., caching, auto-reloading, and configuration systems for Dashboard widgets.

     4 details in Everything

138. v2.4.122 Feb 28, 2020 · release notes

     Adds optional IP logging on login with two new console commands to query user-IP associations

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.122 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.122

     └──▷ TRY IT
     Look up all IPs associated with a specific user account for auditing.
     copy

     $ MISP/app/Console/cake Admin UserIP <user_id>

     Identify which user account is associated with a specific IP address.
     copy

     $ MISP/app/Console/cake Admin IPUser <ip>

     • MISP/app/Console/cake Admin UserIP [user_id] command to retrieve IPs for a user
     • MISP/app/Console/cake Admin IPUser [ip] command to retrieve the user ID for an IP

     2 details in Everything

139. v2.4.121 Feb 12, 2020 · release notes

     MISP v2.4.121 adds sync pull event index filters and improves background worker config reloading.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.121 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.121

     • event_index filter options added to sync connection configuration to limit data fetched during synchronization (e.g., by publish age).
     • Background workers now reload server-wide configurations on each job execution instead of only at startup, allowing live setting changes to take effect without restarts.

     2 details in Everything

140. v2.4.120 Jan 21, 2020 · release notes

     MISP v2.4.120 adds a timeline editor, first/last_seen data model fields, new attribute types, and improved MISP modules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.120 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.120

     • Adds first_seen and last_seen to the data-model at attribute and object levels, accessible via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and UI.
     • Adds a timeline viewer/editor per event for visualizing and editing time-based attribute and object occurrences.
     • Adds kusto-query as a new attribute type for Azure Sentinel and Defender ATP hunting queries.
     • Adds chrome-extension-id as a new attribute type for identifying malicious Chrome extensions.
     • Expands MISP modules in expansion, export, and import scopes with new capabilities.

     5 details in Everything

141. v2.4.119 Dec 5, 2019 · release notes

     MISP v2.4.119 adds attribute_timestamp filter to REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and new database diagnostics subsystem.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.119 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.119

     └──▷ TRY IT
     Query events where the attribute itself was modified within the last hour, distinct from the event creation time.
     copy

     $ GET /attributes/restSearch?timestamp=3600&attribute_timestamp=true

     • event_timestamp, attribute_timestamp, and publish_timestamp timestamp filters added to /attributes/restSearch for precise time-based querying.
     • New database diagnostics subsystem compares current DB state against reference schema, highlighting divergences and generating corrective SQL queries.
     • Deprecation tracking system now warns users of deprecated endpoints via response headers (API) or flash messages (UI).

     3 details in Everything

142. v2.4.118 Nov 10, 2019 · release notes

     MISP v2.4.118 adds SightingDB integration, exclusive taxonomy enforcement, and enhanced restSearch capabilities

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.118 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.118

     └──▷ TRY IT
     Query galaxy cluster metadata fields via restSearch to find attributes linked to specific suspected victims
     copy

     $ curl -X POST 'https://<misp>/attributes/restsearch' \
       -H 'Authorization: <auth>' \
       -H 'Content-Type: application/json' \
       -d '{
         "galaxy.cfr-suspected-victims": ["China", "Japan"]
       }'

     • Adds support for external Sighting sources via SightingDB protocol with a new configuration tool and connection test tool
     • Enforces tag exclusivity rules within taxonomies in the MISP user-interface
     • Adds includeSightingdb flag to restSearch API requests to include SightingDB lookups
     • Extends restSearch to support searching by creator organisation (orgc.* fields) and meta fields in galaxy clusters (galaxy.*)
     • Adds database schema model consistency checks for upcoming upgrade paths

     5 details in Everything

143. v2.4.117 Oct 12, 2019 · release notes

     Adds publish filter alerts per-user, rate-limiting for restSearch API users, custom CA bundles, and Redis diagnostics

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.117 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.117

     • Adds Publish Filters to user settings to create nested boolean rule systems restricting alert e-mails by tags and publishing organisations
     • Adds per-role restSearch throttling (rate limits on heavy search queries within a 15-minute window) with header-based quota notifications for API users
     • Allows overriding MISP's default CA bundle with a custom one
     • Adds Redis configuration diagnosis directly from the MISP UI diagnostics page

     4 details in Everything

144. v2.4.116 Sep 17, 2019 · release notes

     MISP v2.4.116 adds decaying indicators via decay models, ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. sightings export, and sync prioritization.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.116 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.116

     • Introduces a new capability for decaying indicators to automatically expire attributes based on custom or shared decay models
     • Adds the ability to export MISP sightings in the MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. sightings format
     • Enables setting a priority order for synchronization between multiple MISP instances

     3 details in Everything

145. v2.4.115 Sep 10, 2019 · release notes

     MISP v2.4.115 adds /servers/index endpoint restrictions, API key reset APIs, and event export filenames.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.115 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.115

     └──▷ USE IT
     Reset all synchronization user API keys across the instance via the CLI.
     shell copy

     /var/www/MISP/app/Console/cake resetSyncAuthkeys

     • /servers/index API endpoint now restricts access to site administrators only, preventing sync users from retrieving other servers' API keys.
     • Event restsearch export filenames are now properly set for downloaded events, resolving issue #4905.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The /servers/index API endpoint no longer returns data to sync users or organization administrators; access is now restricted to site admins only.
146. v2.4.114 Aug 31, 2019 · release notes

     MISP v2.4.114 adds community registry UI, delegation request search, DB size diagnostics, and ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments./OT taxonomy

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.114 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.114

     └──▷ HOW TO FIND IT
     Browse known communities and send an access request from within the web UI
     📍In the navigation menu, go to sync actions -> communities, then select a community and click Request Access.
     Search for pending delegation requests without using the API or shell
     📍In the navigation menu, go to the delegation request search interface and filter by received or issued.
     Check database optimization potential via the admin dashboard
     📍Access the new diagnostic tool in the administrator settings to view table sizes and recoverable space metrics.
     Use the newly added ICS/OT taxonomy to tag indicators
     📍When creating or editing an indicator, select ics from the available taxonomy tags.
     • Adds a new communities view under sync actions for browsing known MISP communities and sending access requests directly to administrators
     • Adds an interface to search both received and issued delegation requests
     • Adds a new diagnostic tool for administrators to track database table sizes and potentially recoverable space via optimization
     • Adds the Industrial control systems and operational technology (ICS/OT) taxonomy to the default MISP taxonomy library

     4 details in Everything

147. v2.4.113 Aug 20, 2019 · release notes

     MISP v2.4.113 adds UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based API access across multiple endpoints and introduces email-subject attribute type.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.113 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.113

     • /servers/getSetting/[setting_name] allows fetching individual server settings via the API
     • /galaxies/view accepts a uuid parameter for galaxy lookup
     • sightings/listSightings and sightings/restSearch accept UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. for the org_id parameter
     • Events, sightings, organisations, and objects can now be deleted or accessed by UUID via dedicated API endpoints
     • /objects/view accepts a uuid query parameter instead of just an ID

     +1 more show less

     • email-subject is available as a valid attribute type for network activity

     6 details in Everything

148. v2.4.112 Aug 2, 2019 · release notes

     MISP v2.4.112 adds CWS attribute type, cleanCaches CLI, pagination for sync previews, and new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. parameters.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.112 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.112

     └──▷ USE IT
     Get event correlations and sightings in a single search to reduce round trips.
     shell copy

     curl -X GET "https://misp.local/attributes/restSearch" \
       -H 'Authorization: YOUR_API_KEY' \
       -H 'Content-Type: application/json' \
       -d '{
         "search": {"category": "Network activity"},
         "includeSightings": true,
         "includeCorrelations": true
       }'

     Add a new CWS (Common Weakness Scoring) attribute to an existing event.
     shell copy

     # Create the event ID first if needed, then add attribute
     # Using PyMISP or API with new type
     curl -X POST "https://misp.local/events/addAttribute/12345" \
       -H 'Authorization: YOUR_API_KEY' \
       -d '{
         "attribute": {"value": "CWE-79", "type": "weakness (CWS)"}
       }'

     • sync preview passes pagination rules to the remote side for massive performance boost when previewing remote instances.
     • attributes/restSearch now accepts includeSightings and includeCorrelations parameters to add context to results.
     • Added cleanCaches CLI command to clear cached data.
     • API supports disabling background processing via URL parameter and DB logging via URL parameter.
     • attributes/restSearch JSON output now includes additional event fields when using IncludeContext.

     +1 more show less

     • [data model] New attribute type weakness (CWS) added.

     6 details in Everything

149. v2.4.111 Jul 20, 2019 · release notes

     Adds community-id attribute type and new object templates for network flow correlation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.111 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.111

     • community-id attribute type added for correlating network forensic flows from tools like Zeek, Suricata, Moloch, HELK, Elastic, and Corelight.
     • New object templates Netflow and Network connection included with support for the community-id field.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Proposal synchronisation now limits pull to the last 14 days; older proposals are no longer fetched automatically.
150. v2.4.110 Jul 8, 2019 · release notes

     MISP v2.4.110 adds local tags, full MISP standard format support in modules, new API filters, and CLI-only settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.110 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.110

     • Adds local tags for in-place tagging that are stripped during synchronization
     • MISP modules now support the full MISP standard format (objects and relationships)
     • Adds [API] option excludeLocalTags to events/restSearch endpoint
     • Adds Norwegian translation for the user-interface
     • Enables/disables physics in the interface on demand

     +1 more show less

     • Adds a filter in the template object index UI

     6 details in Everything

151. v2.4.109 Jun 13, 2019 · release notes

     MISP v2.4.109 adds attribute-to-object encapsulation and improved ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. matrix filtering

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.109 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.109

     • new restSearch filter: date replaces the deprecated to and from filters with shorthand time ranges (e.g., 7d), timestamps, and list-based ranges
     • UI feature to select multiple attributes and automatically propose suitable object templates for encapsulation

     2 details in Everything

152. v2.4.108 Jun 5, 2019 · release notes

     MISP v2.4.108 adds paranoid logging, JSON sync config generation, and advanced REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. filters

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.108 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.108

     • Adds a steps-based workflow for generating MISP sync configuration objects via the UI to simplify cross-instance synchronization setup.
     • Adds configurable paranoid logging that captures POST/PUT request bodies and supports routing logs via ZMQ, Kafka, ElasticSearch, or syslog instead of the database.
     • Adds logical AND support for tag filters in the restSearch API.
     • Adds object_relation as a valid filter parameter in both event and attribute restSearch functions.

     4 details in Everything

153. v2.4.107 May 13, 2019 · release notes

     MISP v2.4.107 adds YARA export, similar object merging, ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. HTML export, and includeWarninglistHits API option

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.107 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.107

     • Native yara and yara-json export formats for generating YARA rules from existing MISP attributes
     • UI feature to view similar objects and merge them into existing objects based on common attributes
     • New attack export format for restSearch API returning ATT&CK matrix data as HTML
     • New includeWarninglistHits option for attribute and event search APIs to query subsets for false positives

     4 details in Everything

154. v2.4.106 Apr 25, 2019 · release notes

     MISP v2.4.106 adds feed cache search UI/API, CLI worker management, LinOTP auth, and configurable user API key reset.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.106 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.106

     • Adds UI and API endpoints to search cached threat intelligence feeds and other MISP servers
     • Adds WorkerShell CLI commands (list, start, restart, kill) for managing MISP workers
     • Adds LinOTP authentication module support
     • Adds CLI capability to reset or set a user's API key via the command line
     • Adds TrainingShell deployment script for networked MISP training topologies

     5 details in Everything

155. v2.4.105 Mar 31, 2019 · release notes

     MISP v2.4.105 adds a git sub-module diagnostic command, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.-based export replacing the old UI page, and non-standard namespace support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 1.1 imports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.105 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.105

     • Adds a new diagnostic command to display the status of all git sub-modules
     • Replaces the old non-cached export page with improved restSearch for exports
     • Enables import of STIX 1.1 files using additional, non-standard namespaces (such as CISCP)

     3 details in Everything

156. v2.4.104 Mar 27, 2019 · release notes

     MISP v2.4.104 adds overlap feed comparator, distribution graph, REST client bookmarks/history, required taxonomies, and Kafka publishing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.104 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.104

     └──▷ HOW TO FIND IT
     Compare a new feed to existing ones to verify coverage before ingestion.
     📍Use the New overlap feed comparator in the UI
     Visualise where shared data will go using the distribution graph.
     📍Open the distribution visualisation graph in the event/attribute view
     Save frequently used REST queries for future use.
     📍Bookmark queries in the MISP UI REST Client history (last 10)
     • feed compare functionality to compare cached feeds against entire or subset of other cached feeds for coverage analysis
     • New distribution visualisation graph showing potential recipients of events and attributes
     • REST client history of the 10 most recent queries with bookmark capability

     3 details in Everything

157. v2.4.103 Mar 7, 2019 · release notes

     MISP v2.4.103 adds flexible attribute filtering at event view, new tag search API, generic matrix galaxies, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. email field.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.103 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.103

     • Adds a new flexible attribute filtering tool at the event level that supports complex rules for large events.
     • Adds support for creating and using generic matrix-like galaxies with custom kill chains.
     • Exposes change_pw to the API for changing passwords programmatically.
     • Adds ldapEmailField configuration option to Kerberos authentication settings.
     • Adds a new tag search API endpoint for searching tags with wildcard support.

     +1 more show less

     • Extends log search API to support time range parameters.

     6 details in Everything

158. v2.4.102 Feb 3, 2019 · release notes

     MISP v2.4.102 adds anonymised attribute type with new object, Zeek support, and sighting enhancements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.102 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.102

     • Adds anonymised attribute type and anonymisation object for sharing anonymized threat data
     • Adds zeek attribute type (used identically to the existing bro type)
     • Enables global-level sightings in addition to per-attribute sightings via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and UI
     • Includes sighting results in standard search responses

     4 details in Everything

159. v2.4.101 Jan 20, 2019 · release notes

     MISP v2.4.101 introduces tag collections, multi-select tag/galaxy UI, instance caching, HASSH attribute types, and STIX2 improvements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.101 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.101

     • Adds TagCollection capability to predefine reusable structures of tags (from taxonomies) and galaxy information for quick classification
     • Introduces a new selector-system in the UI for adding multiple tags and galaxies simultaneously
     • Enables MISP instance caching via admin settings to perform remote instance caching without full synchronization
     • Adds hassh-md5 and hasshserver-md5 as new attribute types for SSH implementation fingerprints
     • Adds a new unpublish action in the UI to simplify unpublishing events/attributes

     +3 more show less

     • Makes disable correlation accessible when creating or modifying an attribute
     • Adds a default feed from mirai.security.gives
     • Improves STIX2 import and export functionality

     8 details in Everything

160. v2.4.100 Jan 1, 2019 · release notes

     MISP v2.4.100 introduces a new query builder for REST search queries plus two new attribute types (cdhash, ja3-fingerprint-md5).

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.100 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.100

     └──▷ USE IT
     Create a new event with one of the new standard attribute types introduced in this release.
     shell copy

     # Via MISP API or UI when adding attributes
     { "type": "cdhash", "value": "<code_signing_hash>" }
     { "type": "ja3-fingerprint-md5", "value": "<ssl_fingerprint>" }

     • New query builder interface in the UI to construct complex JSON queries for search ingestion.
     • Adds cdhash and ja3-fingerprint-md5 as new standard attribute types for MISP events.
     • MISP submodule for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.x now uses a forked cti-python-stix2 library to support import of STIX 2.x files with time-based UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..

     3 details in Everything

161. v2.4.99 Dec 6, 2018 · release notes

     MISP v2.4.99 adds x509x509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-fingerprint attribute types, CLI brute-force cleanup, and fixes STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. import vulnerability.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.99 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.99

     • Adds x509-fingerprint-md5 and x509-fingerprint-sha256 attribute types to the network activity category
     • Adds new CLI interface to cleanup brute-force protection entries
     • Replaces STIX file storage mechanism with a standardized function that processes files without passing them to external tools

     3 details in Everything

162. v2.4.98 Nov 26, 2018 · release notes

     MISP v2.4.98 adds SleuthKit mactime import, x-result-count API header, and fixes CSV export behavior

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.98 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.98

     └──▷ TRY IT
     Include proposal attributes when searching for specific indicators at the attribute level
     copy

     $ curl -s -H 'Authorization: <token>' 'https://<misp-host>/events/restSearch/attribute/value:<value>?includeProposals=1'

     • Adds an experimental import functionality to ingest SleuthKit mactime timelines directly into MISP as forensic activity objects
     • Exposes the result count from restSearch API responses via the x-result-count response header
     • Makes the includeProposals option functional for attribute-level restSearch queries

     3 details in Everything

163. v2.4.97 Oct 30, 2018 · release notes

     MISP v2.4.97 adds related tags view, REST sighting search API, Galaxy/log/warning-list API endpoints, and CSV event export

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.97 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.97

     • Adds a new related tags feature to display the most commonly used tags for a specific attribute across all events.
     • Adds restSearch API support for searching MISP sightings with filter parameters and output formats (JSON, CSV, XML) at event, attribute, or instance levels.
     • Exposes Galaxy data via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for browsing directly through the API client.
     • Adds CSV export option to the Event index API alongside existing JSON format.
     • Exposes log entries to the REST API with documentation via the template system/REST client.

     +1 more show less

     • Adds warning-list lookup capability to the REST API, allowing quick testing of values against enabled warning-lists without persistent data creation.

     6 details in Everything

164. v2.4.96 Oct 10, 2018 · release notes

     MISP v2.4.96 adds pagination to restSearch API, unified export APIs, and backgrounded freetext import with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. detection

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.96 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.96

     └──▷ TRY IT
     Paginate through a large set of search results using the new parameters.
     copy

     $ curl -k -H 'Authorization: YOUR_KEY' -H 'Accept: application/json' 'https://misp.example.com/restSearch/event?limit=100&page=2'

     • limit and page parameters now supported in restSearch API calls for result pagination.
     • Export endpoints unified into restSearch, allowing direct downloads of search results in MISP-supported formats via the UI or API.
     • Freetext import delegated to a background process for large imports, with added ASN detection and indicator refanging rules.
     • Warning-lists API now supports updating by substring of the warning-list name and includes toggle functions to enable/disable lists.

     4 details in Everything

165. v2.4.95 Sep 6, 2018 · release notes

     MISP v2.4.95 adds a new SQL debug flag (/sql:1), bro NIDS type support, and enhanced STIX2 export mapping.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.95 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.95

     • Adds /sql:1 parameter to any API query to dump the generated SQL (requires debugging mode set to 'debug with SQL dump')
     • Adds bro as a supported NIDS attribute type for exchanging raw signature data
     • Improves STIX2 export by mapping valid_until based on MISP expiration sightings and fixing SDO relationship mapping

     3 details in Everything

166. v2.4.94 Aug 6, 2018 · release notes

     MISP v2.4.94 adds event graph state saving/export, STIX2 export/import scope expansion, xmr attribute type, and ES logging plugin

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.94 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.94

     • Adds ability to export the MISP event graph in PNG, JPEG, JSON, and Graphviz dot formats
     • Adds save functionality to preserve and retrieve the state of a user's event graph
     • Extends MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix UI to add techniques directly at event level without using the galaxy interface
     • Introduces ElasticSearch plugin for logging all MISP activities
     • Enhances CLI with commands to get API keys, force update taxonomies, warning lists, notice lists, and object templates

     +4 more show less

     • Improves Synchronisation by moving blacklist event skipping to the negotiation phase and using UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based lookups
     • Adds API endpoint to deduce preferred edit strategy (edit vs extend) for a given event
     • Adds Monero (xmr) attribute type with soft validation and updates coin-address object template
     • Improves STIX2 export and import scope to better align with MISP open standard mapping

     9 details in Everything

167. v2.4.93 Jun 27, 2018 · release notes

     MISP v2.4.93 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. UI integration, event locking, STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export/import improvements, and multilingual support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.93 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.93

     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. matrix directly accessible in the UI to attach techniques and tactics at event and attribute levels
     • Adds event lock functionality to show users if another user in the same organisation is editing the viewed event
     • Extends STIX 2 export to include PE binaries and provides better support for MISP objects
     • Improves STIX 1 import capabilities for AIS/US-CERT STIX files including specific relationships for malware samples
     • Adds UI toggle for interface language as part of the internationalization effort

     5 details in Everything

168. v2.4.92 Jun 7, 2018 · release notes

     Adds ZMQ publish permission per user, STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. exports to Python 3, benchmarking tool, and hard delete for unpublished attributes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.92 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.92

     └──▷ TRY IT
     Add an object to MISP using its template UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and version instead of the internal local ID.
     copy

     $ POST /objects/add with body containing "template_uuid": "<uuid>", "version": <version_number>

     • Adds the zmq_publish role permission to enable or disable ZMQ publishing per user
     • Improves API by allowing objects to be added by template UUID and version in addition to the local ID
     • Enables hard deleting of attributes that were never published to prevent leaking via soft deleted attributes
     • Adds a benchmarking tool to the AppModel to profile aggregate execution time, iterations, and peaked memory usage
     • Rewrites flash message system with 3 different levels of notifications using bootstrap's internal flash messaging look and feel

     +1 more show less

     • Migrates STIX 1 and STIX 2 exports and imports to Python 3

     6 details in Everything

169. v2.4.91 May 16, 2018 · release notes

     MISP v2.4.91 adds attribute-level Galaxy clusters, distribution visualisation, ZMQ attachments, and API-driven Feed/Enrichment management

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.91 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.91

     • Adds distribution and sharing visualisation UI to verify attribute sharing levels within an event
     • Adds ability to attach MISP Galaxy clusters at the attribute level, not just on events
     • Adds MISP notice list feature for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification./compliance alerts based on attribute category or type (JSON format)
     • Extends API to manage Feeds (add/edit/delete) and allows GET requests to view API documentation
     • Extends ZMQ feed protocol to support base64 encoded attachments

     +1 more show less

     • Enables Event Enrichment via misp-modules from the event menu, globally accessible via API and CLI

     6 details in Everything

170. v2.4.90 Apr 27, 2018 · release notes

     MISP v2.4.90 adds Extended Events, CLI server settings, role resource limits, and user export UI

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.90 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.90

     └──▷ USE IT
     Retrieve all current server settings via the CLI to audit configuration.
     shell copy

     /var/www/MISP/app/Console/cake Admin getSetting

     Enable the Import Services plugin for MISP via the command line.
     shell copy

     /var/www/MISP/app/Console/cake Admin setSetting "Plugin.Import_services_enable" 1

     Trigger a user data export for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. compliance via the new UI button.
     steps copy

     In the Users menu, click the 'Export My Data' button to download your MISP information.

     • Adds Extended Events feature to extend events without modifying the original event data
     • Adds Admin getSetting and Admin setSetting CakePHP console commands to manage server settings from the CLI
     • Adds max memory usage and execution time settings per user role in the UI
     • Adds a new User Export button in the UI for GDPR data portability
     • Updates Cortex integration to allow configuration of TLS options and ensures Cortex 2 compatibility

     5 details in Everything

171. v2.4.89 Mar 24, 2018 · release notes

     MISP v2.4.89 adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0 import from UI, mass-delete API endpoint, and a new event graph editor for visualizing objects and attributes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.89 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.89

     └──▷ HOW TO FIND IT
     Mass delete multiple attributes in one API call without needing to iterate through them individually.
     📍curl -X GET 'https://<MISP_HOST>/api/attributes/deleteAttributes?uuid=<uuid1>&uuid=<uuid2>' -H Authorization: <API_KEY> -H Accept: application/json -H Content-Type: application/json
     Import external STIX 2.0 threat intel data directly into a MISP event without using the command line or Python scripts.
     📍In the MISP web UI, navigate to Events › Add Event, select the Import tab, choose STIX 2.0 as the format, upload the file or paste the content, and submit.
     Visualize connections between objects and attributes within a MISP event to analyze relationships and edit data graphically.
     📍In the MISP web UI, open an existing Event, click on the Graph tab to launch the new event graph editor.
     • GET /api/attributes/deleteAttributes now supports mass deletion of attributes via the API
     • Adds STIX 2.0 data import directly from the web interface
     • New graphical event graph viewer/editor for MISP events, allowing visualization and editing of objects, attributes, and their relationships

     3 details in Everything

172. v2.4.88 Feb 21, 2018 · release notes

     MISP v2.4.88 adds ssdeep correlation, STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 1.1 import, flexible sharing group APIs, and module access via API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.88 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.88

     └──▷ HOW TO FIND IT
     Import a STIX 1.1.1 XML file directly from the MISP web interface to ingest external threat intel.
     📍Navigate to Events › Add Event › Import and select STIX 1.1.1 XML as the format.
     Use curl to add an organization to a sharing group via the new flexible API endpoints.
     copy

     $ curl -X POST 'https://<misp>/sharingGroups/addOrg/<sg_id>/<org_id>/0' -H 'Authorization: <auth_key>'

     • Adds ssdeep_correlation_threshold config key to control fuzzy hashing match sensitivity
     • Adds STIX 1.1.1 XML import via the user interface
     • Enables returning raw parsing data from freetext import instead of creating attributes
     • Adds application-wide keyboard shortcuts for navigation
     • Updates sharing group management APIs with endpoints for adding/removing orgs and servers

     +1 more show less

     • Makes MISP modules accessible from the API

     6 details in Everything

173. v2.4.87 Jan 28, 2018 · release notes

     MISP v2.4.87 adds arbitrary HTTP headers to feeds, regex in warning-lists, and a ZMQ tags channel.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.87 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.87

     • Feed system supports arbitrary HTTP headers for authentication and caching, with a new basic auth widget
     • enforcewarninglist API option filters false-positives using new regex-based warning-list patterns
     • New ZMQ publish-subscribe channel dedicated to tag-related activities

     3 details in Everything

174. v2.4.86 Jan 16, 2018 · release notes

     MISP v2.4.86 adds instance-level MISP-modules access control, share group API support, and optional org visibility limits.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.86 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.86

     • Adds ability to limit organisation list visibility so only site admins and sharing group editors can see the full list
     • Adds limit_org setting for individual modules (expansion, import, export) to restrict accessibility to a single organisation
     • Exposes share groups as manageable entities via the API, enabling programmatic creation and management

     3 details in Everything

175. v2.4.85 Dec 22, 2017 · release notes

     MISP v2.4.85 adds enforceWarninglist API control, user-scope tags, CLI auth reset, and quick sync feed parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.85 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.85

     • Adds /enforceWarninglist:1 URL parameter and "enforceWarninglist":1 key to /attributes/add for filtering imported attributes via the API
     • Adds Feed quick sync feature allowing attribute calls using precalculated hashes without parsing the complete feed
     • Adds ability to restrict tags to a single user in addition to existing organisation-level restrictions
     • Adds CLI command /var/www/MISP/app/Console/cake Authkey [email@of.user] for resetting user authentication keys
     • Adds new attribute types: x509-fingerprint-sha256, x509-fingerprint-md5, stix2-pattern, and whois-registrant-org

     5 details in Everything

176. v2.4.83 Dec 6, 2017 · release notes

     MISP v2.4.83 adds org-level email domain restrictions, ZMQ/Syslog audit logging, and enhanced tag filtering.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.83 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.83

     • Adds email_domain_restrictions configuration at the organisation level to limit which email domains users within that organisation can use for login
     • Enables full audit logging via ZMQ or Syslog with proper severity levels for all audit log entries
     • Enhances tag filtering to support positive lookup on events/attributes, negative lookup on events, and blocked attribute filtering within matched events

     3 details in Everything

177. v2.4.82 Nov 10, 2017 · release notes

     MISP v2.4.82 adds ZMQ channels for objects, selectable CSV columns via query params, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form./Feed format enhancements.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.82 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.82

     └──▷ TRY IT
     Export specific event columns to CSV for targeted analysis
     copy

     $ GET https://<misp-instance>/events/csv/download/<event-id>?attributes=timestamp,type,uuid,value

     Include object-level details like UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and name in CSV export
     copy

     $ GET https://<misp-instance>/events/csv/download/<event-id>?attributes=timestamp,type,uuid,value&object_attributes=uuid,name

     • Adds GET /events/csv/download/<event-id>?attributes=... parameter to select specific CSV export columns
     • Adds object_attributes query parameter to MISP CSV export to include object-level columns
     • Expands ZMQ publish-subscribe channels to deliver updates for MISP objects in addition to events and attributes
     • Improves STIX 2.0 export to include custom objects, Person SDO, tool SDO with exploit-kit galaxy mapping, course-of-action SDO, and object inclusion
     • Enhances STIX 1.x export to include reporter in incidents, producer in indicators, MISP TLP as tlpMarking, and File objects

     +1 more show less

     • Adds objects, attribute tags, and object references to the MISP feed format with quick-hash-list support

     6 details in Everything

178. v2.4.81 Oct 10, 2017 · release notes

     MISP v2.4.81 adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0 export, API-accessible server settings, and shortcut keys for the correlation graph.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.81 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.81

     • Adds STIX 2.0 as a supported export format
     • Makes server settings accessible via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.
     • Enables advanced sample upload support in the attachment uploader API

     3 details in Everything

179. v2.4.80 Sep 28, 2017 · release notes

     MISP v2.4.80 introduces MISP objects, enabling complex combined attributes and relationships within events

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.4.80 https://github.com/MISP/MISP.git
     # already have the repo? check out this version:
     $ git checkout v2.4.80

     • Adds support for MISP objects to represent complex/combined entities linked via relationships in addition to standard attributes
     • Enables extended file import for binaries (PE, ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., MachOS) using PyMISP and LIEF to automatically create parsed object structures

     2 details in Everything