MISP — The Cyber Toolchain

MISP v2.5.50

Sat, 10 Oct 2026 09:48:00 GMT

MISP 2.5.50 adds phishunt.io feed, object-relation usage stats, Overmind UI overhaul, and migrates legacy discussions/templates to modern replacements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `objectRelationUsage` statistics operation reporting how frequently relations are populated across MISP objects, grouped by the latest version of each object template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `MISP.redis_host`, `Plugin.ZeroMQ_redis_host`, and `SimpleBackgroundJobs.redis_host` settings as CLI-only — these can no longer be changed through the web interface or API, reducing risk from a compromised admin session. • Restricts `download_attachments_on_load` setting to CLI-only configuration, removing it from the web interface and API. • Adds the phishunt.io feed of active phishing URLs as a new built-in feed. • Migrates legacy event discussions (Thread/Post) to analyst notes, preserving author organisation, timestamps, and visibility information. • Migrates legacy signature allowedlists into an enabled custom regular-expression warninglist covering all attribute types; filtering now applies only when `enforceWarninglist` is enabled. • Replaces the legacy template system with event templates, converting organisation-authored templates to active event templates. • Adds bulk actions in the Overmind event attribute index. • Adds warninglist match indicators next to attributes in Overmind views. • Adds PDF downloads from event report quick actions in Overmind. Breaking changes: • The `MISP.redis_host`, `Plugin.ZeroMQ_redis_host`, `SimpleBackgroundJobs.redis_host`, and `download_attachments_on_load` settings can no longer be changed via the web interface or API — they must be managed through server configuration or CLI. • The legacy Thread/Post discussion workflow trigger is removed; workflows that relied on it are logged during migration and will no longer fire. • Signature allowedlist filtering no longer unconditionally removes matching values from `restSearch`, TAXII push, OpenIOC, and Bro exports — exclusion now applies only when `enforceWarninglist` is enabled. • The legacy ability to populate an existing event from a template is removed; event templates now only create new events. • Legacy discussion, template, and allowedlist routes are removed; integrations using those routes must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.48

Tue, 29 Sep 2026 08:11:29 GMT

MISP v2.5.48 adds XLSX export for events/attributes/sightings and tag removal from misp-module enrichment results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds XLSX export for events, attributes, and sightings via `restSearch` and the per-event and mass export pickers, with `escape_formulas_literal:1` to switch formula-safe cells to literal apostrophe form instead of `quotePrefix` cell style.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `remove_tags` list support in enrichment and import module result rows, letting modules strip tags from existing attributes instead of creating duplicates, with removed tags surfaced in the resolution screen and `EventShell` enrichment output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.47

Thu, 17 Sep 2026 11:41:47 GMT

MISP v2.5.47 adds PostgreSQL support, AI-assisted analysis, a ledger-based migration system, and major Overmind UI improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Plugin.AI_*` settings under a new **AI** tab in server settings to configure the AI-assisted analysis integration, gated by the new `perm_ai_tools` role permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `cake Admin migrationStatus`, `cake Admin migrationApply` (with `--dry-run` to preview SQL), and `cake Admin migrationCreate` console commands for the new ledger-based migration system. • Adds `INSTALL/POSTGRESQL.sql` and a `PostgresObserverExtended` datasource to support fresh installs on PostgreSQL 16, with install steps documented in `docs/CONFIG.postgresql.md`. • Adds four AI-assisted analysis actions — summarise event, summarise report, recommend tags, and extract indicators — via the `ai_connector` misp-module; all AI-derived content is tagged with `ai-computer-assisted` provenance tags. • Adds two workflow action modules: **Summarise report with AI** and **Extract indicators with AI**. • Migrates database schema management from a single `db_version` integer to a `schema_migrations` ledger under `app/Lib/Migration/Migrations/`, with pending and failed migrations now exposed as `migrations_pending` and `migrations_failed` fields in the diagnostic payload. • Adds `elastic-detection-rule`, `kql-analytics-rule`, `kunai-rule`, and `splunk-rule` MISP objects for detection rule sharing. • Adds a new **More filters** expandable section to the users, servers, organisations, workflows, logs, galaxy clusters, collections, and event attribute indexes in Overmind. • Adds a new MITRE ATLAS Case Study galaxy and updates MITRE ATLAS to the 2026.08 release in misp-galaxy. • Adds MITRE D3FEND techniques and relations, and moves the MITRE Fraud Framework (F3) to version 1.1 with relationships in misp-galaxy. • Adds TweetFeed and several Threatbase feeds to the default MISP feed list. • Adds a collection card and *add to collection* action to the Overmind event view. • Adds a JSON field component to Overmind forms, used by the decaying model modal. • Adds an add button on the Overmind event reports tab and an improved markdown editor for event report previews. • Unregisters the `phar` stream wrapper in both entry points as a defence-in-depth hardening measure. • Adds `docs/dev/ai_integration.md` documenting the AI integration contract and actions, and includes a fake module server for testing without an LLM. Breaking changes: • Fleet monitoring that alerted on `actual_db_version` differing from `expected_db_version` must move to the new `migrations_pending` and `migrations_failed` diagnostic fields; the version pair can no longer diverge as the `db_version` counter is frozen at 159. • `runUpdates` (and site-admin login) now stops on the first migration failure instead of marking the failure as done and continuing. • The earlier CTIInfoExtractor endpoint and its settings are removed and replaced by the new `Plugin.AI_*` AI integration. • Tag names that collide under the new case-insensitive collation on `tags.name` are merged into the oldest tag, with every reference repointed — instances with such collisions will have tags merged automatically on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.46

Thu, 10 Sep 2026 08:04:11 GMT

MISP v2.5.46 adds SSRF hardening with UrlEgressValidator, 50x sightings query speedup, and expanded Overmind UI workflows including a first MISP Tutorial.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a shared `UrlEgressValidator` that enforces a common outbound URL policy — validating schemes and resolved addresses and blocking loopback, link-local, and private destinations across all remote-resource retrieval paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `CurlClient` with host pinning, controlled and validated redirects, response size limits, and TLS peer verification enabled by default. • Reduces event report count queries from one per event to one or two grouped queries per page — delivering roughly 19× to 35× improvements for that operation. • Batches sightings retrieval inside MispAttribute::fetchAttributes() instead of querying per attribute, reducing a 5,000-attribute case from 8.1 seconds / 10,661 queries to 0.149 seconds / 6 queries — more than a 50× improvement. • Updates MITRE ATT&CK galaxies in `misp-galaxy` to include Detection Strategies and Analytics concepts alongside refreshed tactics, techniques, and sub-techniques. • Expands Overmind event quick-action cards with merge attributes, enrich event, contact reporter, delegate publishing, execute ad-hoc workflows, and recorrelate events operations. • Adds warning-list filtering in Overmind correlation graphs. • Adds Galaxy support inside Tag Collections in Overmind. • Ships the first version of the MISP Tutorial inside Overmind. • Adds card views for additional indexes, server-specific card views, and multiple cards per row in Overmind. • Adds responsive correlation graph timelines and collapses correlated events by default in Overmind. • Refreshes `misp-warninglists` with new sources including network and security scanners, Network Telescope-derived scanner ranges, Cortex/Xpanse infrastructure, and Telegram-related infrastructure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.45

Tue, 25 Aug 2026 13:53:44 GMT

MISP v2.5.45 adds LDAP revamp with nested groups and proxy-header auth, a /gpg.asc endpoint, and CLI worker management. • Adds `ldapNestedGroups` setting to resolve nested LDAP group membership for role and org mapping. • Adds `ldapOrgGroupMapping` and `ldapRoleGroupMapping` settings whose precedence follows settings order, supporting role and organisation mapping via directory field or group membership. • Adds LDAP sync of MISP accounts via the `User check_validity` task, schedulable as an admin task. • Adds authentication against a header asserted by a trusted proxy as an LDAP auth option. • Adds a setting to disable MISP accounts for users flagged `ACCOUNTDISABLE` in `userAccountControl`. • Adds a pytest suite under `tests/ldapauth/` with an OpenLDAP service running in CI for LDAP authentication coverage. • Serves the instance GPG key at `/gpg.asc` with caching. • Enables managing Supervisor-backed workers directly from the CLI. • Adds an organisation merge feature in the UI. • Adds an import action on the event index and server preview views. • Adds a freetext feed preview index and import modals; feed migration to Bootstrap 5 (Overmind) is now complete. • Migrates Server settings, Workflow indexes (ad-hoc, triggers, modules), workflow editor, Decaying Model index, misp-module enrichment, and registration/user settings/password flows to the Bootstrap 5 Overmind UI. • Adds new Bootstrap 5 views for Jobs, Tasks, AnalystData, Feeds, TaxiiServers, CryptographicKeys, and GalaxyClusterRelations. • Enforces per-org module restrictions on all getEnabledModule() paths. • Enforces Event modify ACL on attribute enrichment requests. • Enforces `distribution=0` filter in REST search `fetchEvent`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.43

Mon, 13 Jul 2026 14:23:31 GMT

MISP 2.5.43 adds collection sync between instances, environment-variable settings, Pivotick pivot explorer, and TAXII Bearer auth. • Adds collection synchronisation between MISP instances in both pull and push directions, with per-server `pull_collections` / `push_collections` toggles, feature negotiation with pagination, and a `collections.locked` origin-protection flag. • Supports environment variables as a third settings source alongside config file and database, enabling cleaner containerised and IaC deployments. • Introduces Pivotick as an initial drop-in replacement for the legacy event graph, including a draft drag-and-drop reference editor. • Adds Bearer authentication for TAXII servers and a streamlined add flow for basic auth; the TAXII 'API key' field is renamed to Token and obfuscated in the server view. • Extends the Overmind (Bootstrap 5) UI to user index, categories & types, application/audit/access logs, galaxies/galaxy clusters/galaxy relationships, and proposals screens, plus inline tag/galaxy addition from event view. • Adds HoneyLabs default feeds covering active exploiters and malware infrastructure. • Adds zeromq supervisor setting and status check. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.42

Mon, 22 Jun 2026 12:39:46 GMT

MISP v2.5.42 adds scheduled TAXII push, OIDC PAR toggle, Overmind UI advances, and a new SiberKapan threat-intel feed. • Adds scheduled TAXII push as a new task type, with single-server and all-enabled push modes, a per-server enabled flag, and proxy support. • New option to disable OIDC Pushed Authorization Requests (PAR) for environments that cannot support it. • Overmind UI: tags and galaxy clusters can now be added directly from the Event View. • Overmind UI: correlation graph integrated into the Insight UI. • Overmind UI: object index and event-report views/forms migrated, including attachment add and event-report add form. • Overmind UI: new colour scheme, bolder MISP element icons, item-count badges in index views, and clickable breadcrumbs. • Adds SiberKapan (Turkey-focused threat-intel platform) to the default feeds. Breaking changes: • The rdkafka config file path/name is now strictly validated and the setting is restricted to CLI-only configuration — any site-admin web-based rdkafka config path will no longer be accepted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.42

Mon, 22 Jun 2026 12:39:46 GMT

MISP v2.5.42 adds scheduled TAXII push, OIDC PAR toggle, Overmind UI advances, and a new SiberKapan feed. • Adds scheduled TAXII push as a task type, supporting single-server and all-enabled push modes with a per-server enabled flag and blocking of pushes for disabled servers. • Adds proxy support for TAXII push operations. • Adds an option to disable OIDC Pushed Authorization Requests (PAR) for deployments where PAR is unsupported or unwanted. • Adds SiberKapan (Turkey-focused threat-intelligence platform) to the default MISP feeds list. • Integrates the correlation graph into the Overmind/Insight UI. • Enables adding tags and galaxy clusters directly from the Event View in the Overmind UI. • Migrates object index, event-report views and forms (including attachment add and event-report add) into the Overmind UI. • Introduces a new colour scheme, bolder MISP element icons, item-count badges in index views, and clickable breadcrumbs across the Overmind UI. Breaking changes: • The rdkafka config file path/name is now strictly validated and the setting is restricted to CLI-only configuration, meaning rdkafka config paths can no longer be set via non-CLI means. • The `unique_ips` field on authkeys is now derive-only and can no longer be seeded on key creation; any tooling or scripts that set `unique_ips` at key-creation time will have that value ignored or rejected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.41

Wed, 17 Jun 2026 14:34:30 GMT

MISP v2.5.41 adds event index mass tagging, async server updates, new threat intel feeds, and a reworked Overmind UI. • Adds mass tagging and galaxy cluster attachment to multiple selected events at once from the event index. • Major rework of the Overmind (Beta) UI Event View, Collections, and List pages. • Supports configurable login button text for OIDC authentication. • Surfaces hidden server setting behaviours (CLI-only, file-only, redacted) in the server settings view. • Enables async background-job updates via /servers/updateJSON. • Adds PrecisionSec OSINT Threat Intelligence and Rectifyq MISP Feeds as default feeds. • Shows current server time when adding a scheduled task. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.41

Wed, 17 Jun 2026 14:34:30 GMT

MISP 2.5.41 adds event-index mass tagging, async server updates, new threat feeds, and a major Overmind UI rework. • Adds mass-action tagging and galaxy-cluster attachment to multiple selected events at once from the Event index. • Major rework of Event View, Collections, and List views in the Beta (Overmind) UI. • Enables configurable login button text for OIDC authentication. • Surfaces hidden server setting behaviours (CLI-only, file-only, redacted) in the Server Settings UI. • Adds async background-job support to the /servers/updateJSON endpoint. • Adds two new default threat intelligence feeds: PrecisionSec OSINT Threat Intelligence and Rectifyq MISP Feeds. • Displays the current server time when scheduling a new scheduled task. • Reduces sync overhead by requesting only the event-tags fingerprint instead of the full tag list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.40

Thu, 11 Jun 2026 15:54:57 GMT

MISP 2.5.40 adds Overmind UI migration for Event views, ACL-aware ATT&CK widget, and admin upgrade-error surfacing. • Begins migration of Event View and Event Report views to the new Overmind UI (work in progress). • ATT&CK dashboard widget (AttackWidget) now counts techniques via an ACL-aware Event find, ensuring results respect user permissions. • Adds a supervisor-configuration scheduler during upgrade and surfaces upgrade errors directly to admins. • Warns admins when the `check_sec_fetch_site_header` setting is unset, flagging elevated risk on multi-homed/multi-tenant instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.39

Fri, 05 Jun 2026 07:38:55 GMT

MISP 2.5.39 adds analyst dashboard widgets, WebGL globe visualizations, ATT&CK heatmap redesign, and expanded STIX interoperability. • New analyst-focused dashboard widgets: trending vulnerabilities, threat actors, and ATT&CK techniques; new-data KPI cards; event cards; recent event reports; recent analyst notes and opinions; recent local galaxy clusters; and 'overlap with my org' correlation-based views. • WebGL globe support for attack-flow visualizations, with selectable globe skins and idle auto-rotation. • Live light/dark dashboard theme switching — including chart retheming — with persisted user preference and no-flash boot. • ATT&CK heatmap redesigned with parent/sub-technique aggregation, inactive technique hiding, readable labels, and a clearer red intensity ramp. • Dashboard widgets gain typed configuration controls for dimensions, country/sector filters, `exclude_own_org`, event stream filters, and galaxy type filtering. • 'Save as template' now saves via AJAX in the dashboard slide-in panel, keeping users on the current board. • New `misp-iconify` icon set used for dashboard stat glyphs. • Updated `misp-stix 2026.6.1` brings full TLP marking support shared across import and export paths, expanded patterning-language support, more deterministic byte-stable conversions, and regenerated mapping documentation. • Supports EM SPACE (U+2003) in FreeText import for broader indicator parsing coverage. • Required publish permission enforced for publishing galaxy clusters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.39

Fri, 05 Jun 2026 07:38:55 GMT

MISP 2.5.39 ships a redesigned analyst dashboard, new threat-intel widgets, STIX TLP/patterning expansions, and a WebGL attack-flow globe. • Adds light/dark dashboard theme switching with persisted user preference, no-flash boot, and live chart retheming. • Adds WebGL globe visualization for attack-flow data, with selectable globe skins and idle auto-rotation. • New analyst dashboard widgets: trending vulnerabilities, threat actors, and ATT&CK techniques; new-data KPI cards; event cards; recent event reports; recent analyst notes and opinions; recent local galaxy clusters; and 'overlap with my org' correlation views. • Redesigned ATT&CK heatmap with parent/sub-technique aggregation, inactive technique hiding, readable labels, and a clearer red intensity ramp. • Dashboard widgets gain typed configuration controls for dimensions, country/sector filters, `exclude_own_org`, event stream filters, and galaxy type filtering. • 'Save as template' now operates via AJAX in the slide-in panel, keeping users on the current board. • New `misp-iconify` icon set introduced for dashboard stat glyphs. • Updated STIX engine (misp-stix 2026.6.1) adds full TLP marking support across import and export paths, expanded patterning-language support, more deterministic byte-stable conversions, and regenerated mapping documentation. • Adds support for EM SPACE (U+2003) in FreeText import, broadening freetext attribute parsing. • Requires publish permission to publish galaxy clusters, enforcing stricter access control on cluster publication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.38

Wed, 20 May 2026 14:49:14 GMT

MISP 2.5.38 adds a workflow blocklist action module, TAXII 2 spec conformance, and Overmind UI Sync tab migration. • New Workflows Blocklist action module writes event attributes to a blocklist file, with removal-by-tag, atomic writes with one-generation backup, and optional rolling filesystem snapshots. • TAXII 2 updated to spec and schema v148 conformance. • Overmind UI Sync tab migration: Servers, SharingGroup, SharingGroupBlueprints, Sightingdb, TaxiiServers, Communities, and Cerebrate views ported to the Overmind theme. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.37

Wed, 29 Apr 2026 08:37:20 GMT

MISP v2.5.37 ships a ground-up Event Templating system, a new `suricata` attribute type, STIX 2.1 defaults, new workflow triggers, and expanded galaxy/taxonomy coverage. • Introduces a completely redesigned Event Templating system with JSON-schema-backed templates (`event-template-v1`), a drag-to-reorder builder UI, inline validation via `/event_templates/validate_definition`, and REST import/export with full object-template dependency tracking. • New `misp-event-templates` submodule provides a managed library catalogue with ten starter templates (e.g. `ransomware-incident`, `credential-exposure`, `supply-chain-compromise`) and first-touch auto-update. • Migration helper `app/Console/cake Admin migrateOldTemplates` converts legacy templates to the new event-template format, including handling for complex File / CnC objects. • Adds a dedicated `suricata` attribute type alongside `snort`, enabling first-class modeling and validation of Suricata IDS rules, with corresponding support in PyMISP. • STIX 2 export now defaults to version 2.1 and adds a new library entry point for exporting MISP Object collections to STIX 2.x, switching from MISP's custom `cti-python-stix2` fork to the upstream library bundled with `misp-stix`. • Ad-hoc workflows now support passing in environment variables and capturing module-returned data under `_env.misp_module_results` for use by downstream nodes. • New `analyst-data:after-save` workflow trigger added. • New search performance diagnostics tool to profile attribute search behaviour on large datasets; performance shell updated to use approximations for usability on very large instances. • Overmind UI gains full coverage for Tags, Tag Collections, Taxonomies, Templates, Object Templates, Object Relationships, REST Client, Automation & Export Views, Correlation Graph (rewritten in vanilla JS), and Event Templates. • New `cloud-sovereignty` and `ai-computer-assisted` taxonomies added to `misp-taxonomies`. • New misp-galaxy galaxies added: SPARTA, MITRE Fraud Framework, VERIS framework, RMM tools, operating systems, IT-equipment types, software vendors, and taxonomy of fraud. • New misp-objects templates added: `rulezet-bundle`, `ruleset-metadata`, `dga-domain`, `drone-RID-observation`, `contact-list`, `fbi-most-wanted`, `terminal-output`, `malicious-website`, `exif`, `software`, `service`, `container`, `physical-object`, `item`, `mfa-auth`. • New misp-warninglists script to fetch Windows binary hashes and generate a warninglist from them. • LDAP plugin gains support for `memberOf` queries. Breaking changes: • The custom `cti-python-stix2` submodule has been removed; MISP now uses the upstream `stix2` library bundled with `misp-stix`, and STIX 2 export defaults to version 2.1 instead of 2.0. • All menu entry points to the legacy `/templates/*` controller have been removed from the global menu, navbar helper, and side menus on both default and Overmind themes; the controller and view stack will be fully removed in 2.5.38. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.36

Fri, 03 Apr 2026 13:48:51 GMT

MISP v2.5.36 adds interactive map geolocation visualisation, a terminal REPL shell, and expanded Overmind UI coverage. • Adds interactive geolocation map rendering for objects with geographic coordinates directly in the event view, enabled via `Plugin.Geolocation_enabled`. • Adds accuracy-radius visualisation for geolocation objects, displayed as a toggleable circle on the map. • Adds native GeoJSON rendering, enabling complex geographic shapes and features to be displayed on maps. • Adds GPX track support so UAV and other GPS Exchange Format tracking data can be plotted as tracks on the map. • Adds configurable tile server support via `Plugin.Geolocation_url` (defaults to `https://geo.circl.lu`). • Adds a new interactive CLI REPL shell (`app/Console/cake CLI `) for browsing and managing events, attributes, objects, tags, users, organisations, and roles from the terminal. • Adds Warninglists, Noticelists, Collections, Correlation Exclusions, Allowedlists, and Regexp modules to the Overmind Bootstrap 5 UI. • Adds full CRUD support with modal-based add/edit/delete for Collections and Collection Elements in the Overmind UI. • Adds global action buttons for the attribute index in the Overmind UI. • Adds sticky table headers across all Overmind index views. • Adds support for environment variable overrides for configuration values in the MISP installer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.35

Thu, 19 Mar 2026 07:28:13 GMT

MISP v2.5.35 adds decomposed AJAX event view endpoints, cursor-based attribute search pagination, and Overmind UI mass-select actions. • Adds new AJAX endpoints (view2(), viewAttributes(), viewObjects(), viewRelatedEvents(), viewWarninglistHits()) that decompose the monolithic event view into asynchronously loaded components for faster rendering. • Introduces a new correlation dispatcher enabling per-page correlation loading instead of loading all correlations for an entire event at once. • Adds a new `EventTest` reference UI theme demonstrating the decomposed endpoints with paginated attributes, quick filters, and a flatten toggle. • Switches `restsearch` to cursor-based pagination, eliminating performance degradation on deep pagination of large attribute datasets. • Adds a benchmark suite and comparison tool for tracking and documenting attribute search pipeline performance. • Adds mass-select actions for publication, deletion, and export within the Event Index in the Overmind UI. • Transitions Overmind UI from jQuery to Vanilla JS and integrates Tom Select for improved dropdown and selection interactions. • Hardens Debian 12/13 and RHEL 9.4 installer scripts following SC3 audit: credentials stored at `/root/misp_settings.txt` with `600` permissions, `mktemp` used for API key capture, and hard-fail on Composer checksum mismatch. • Updates MISP-STIX to include indicator and observable fingerprinting capabilities. Breaking changes: • The default ordering for `restsearch` has changed to accommodate the new cursor-based pagination logic (can be overridden if a specific order is required). • MISP-STIX minimum version requirement has been updated; instances must upgrade MISP-STIX to remain compatible with the new search pipeline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.34

Fri, 06 Mar 2026 15:52:33 GMT

MISP v2.5.34 adds a visual debug mode section in the Overmind theme. • Adds a visual debug mode section within the Overmind theme for easier diagnostics visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.33

Mon, 02 Mar 2026 10:55:54 GMT

MISP v2.5.33 adds a new theme system with Overmind UI, faster sync caching endpoint, sightings-free pull sync, and a new attribute lookup API. • New theme system (`MISP.enable_themes`) lets users opt into the modern `Overmind` development UI or the gradual `BetaUI` redesign, both built on Bootstrap 5 and Font Awesome 7. • New client-side caching endpoint for synchronization bypasses heavy `restSearch` logic, reducing memory footprint and speeding up large-instance sync. • New `/attributes/getAttributeByB64Value` endpoint enables efficient attribute lookups by Base64 value. • New settings to gate arbitrary URLs in event reports and workflows, controlling SSRF attack surface. • Freetext extraction now supports Chrome and Edge browser extension IDs. • Workflow modules `threat-level-if` and `aggregate-if` receive new enhancements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.32

Wed, 14 Jan 2026 21:16:00 GMT

MISP v2.5.32 adds three new workflow modules/triggers, bucketed attachment storage, and configurable password-reset emails. • New 'Aggregate Comparator' workflow module to aggregate and compare field values for use in IF conditions. • New 'Timestamp Filter' workflow module enabling filtering of events based on timestamp values. • New 'Event Deletion Trigger' (`trigger-event-before-delete`) to act on event deletion in workflows. • New bucketed storage system for file attachments to prevent filesystem issues caused by too many files in a single directory. • Forgot password email text is now configurable via the server settings interface. • New OIDC auth setting to skip or enforce global MISP proxy settings. • Faster JSON decoding from files via `simdjson_decode_from_stream`. Breaking changes: • The `toggle` field is renamed to `enable` in the `ids-operation` workflow module — any workflow using the old `toggle` field will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.31

Tue, 23 Dec 2025 15:58:49 GMT

MISP v2.5.31 adds NOCACTI threat feeds, refreshed knowledge bases, and widens the OpenAPI spec for galaxy cluster exports. • Adds NOCACTI Adversary Infrastructure / Intrusion feeds as new built-in threat intelligence sources. • Updates taxonomies, galaxies, object templates, warning lists, and GeoOpen to latest versions. • Expands OpenAPI spec for `exportGalaxyClusters`: documents additive `default`/`custom` inclusion behavior and allows `distribution` to be passed as an array. • Changes default sighting visibility to "Everyone" (previously "Event Owner"). • Sync users can now update sharing groups they can see and push updates via different sync connections than the original source. Breaking changes: • Default sighting visibility is now set to "Everyone" instead of "Event Owner" — instances relying on the previous default to restrict sighting visibility to the event owner will expose sightings more broadly after upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.30

Sat, 13 Dec 2025 09:59:25 GMT

MISP v2.5.30 ships an opt-in beta UI/UX mode, faster org-logo loading, and new MMDB/vulnerability-lookup workflow action modules. • Adds opt-in beta UI/UX mode (via user settings) with a redesigned Event Index featuring responsive layout, distribution widgets, humanized timestamps, and consolidated action dropdowns. • Redesigns top navigation bar with reorganized clustering and fly-out menus in the new beta mode. • New dedicated endpoint for organization logo loading uses cached images instead of live base64 decoding, significantly speeding up Event Index rendering. • New workflow Action modules enable automatic tag enrichment from MMDB geolocation data and vulnerability information from vulnerability-lookup.org. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.29

Sat, 13 Dec 2025 09:26:26 GMT

MISP v2.5.29 ships a beta UI/UX mode with redesigned Event Index and new MMDB/vulnerability-lookup workflow action modules. • New opt-in beta UI/UX mode available via user settings, featuring a redesigned Event Index with responsive layout, distribution widgets, humanized timestamps, consolidated action dropdowns, and a reorganized fly-out navigation bar. • New dedicated endpoint for organization logo loading in the Event Index uses cached images instead of live base64 decoding, significantly faster rendering. • New Action modules for Workflows enable automatic tag enrichment based on MMDB geolocation data and vulnerability information from vulnerability-lookup.org. Breaking changes: • The `url` field in Bookmarks has been renamed to `text`; any integration or script referencing the `url` field by name will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.28

Thu, 11 Dec 2025 13:46:19 GMT

MISP v2.5.28 adds MISP version to OpenAPI spec, Gridstack 12 dashboard, and an OpenBSD 7.8 installation guide. • Adds MISP version field to the OpenAPI specification. • Migrates the dashboard to Gridstack 12. • Adds installation guide for OpenBSD 7.8. • Adds CSIRT.SK to the Slovak MISP Community defaults and meta community vetting process. • Redacts creator user information in Collections data for non-site administrators. • Optimizes tag filtering logic by dynamically choosing between `EXISTS` and `UNION` query strategies based on attribute filter weight. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.27

Thu, 27 Nov 2025 19:20:15 GMT

MISP v2.5.27 adds a flowintel case-creation workflow module and zstd-compressed request support with SimdJSON encoding. • New `flowintel-create-case` workflow module enables automated case creation in flowintel directly from MISP workflows. • Supports zstd-compressed requests, expanding compression options for high-volume data ingestion. • Adds SimdJSON-accelerated encoding (`simdjson_encode`, `simdjson_encode_to_stream`, `SimdJsonBase64Encode`) for events and large arrays when `simdjson_php` is available, unlocking faster throughput at scale. • New attribute fetcher pipeline with early query optimisation for more efficient attribute retrieval. • JSON schema updated to reflect latest MISP 2.5 features, enabling validation of new event structures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.26

Thu, 20 Nov 2025 16:59:57 GMT

MISP v2.5.26 adds a UUID attribute type, JSON syslog output, UUID-based event linking, and new DB indices for performance. • Adds a dedicated UUID attribute type to satisfy FlowIntel and object template requirements, replacing ad-hoc text fields for unique identifiers. • New option to prioritize UUID-based event linking over traditional IDs, improving consistency across distributed MISP instances. • New option to emit syslog messages in JSON format for structured logging and easier downstream processing. • Introduces new database indices to significantly improve overall MISP performance. • Updates misp-stix with better STIX 2 input handling to tolerate invalid STIX 2 output from non-compliant TIP platforms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.25

Sun, 16 Nov 2025 17:01:15 GMT

MISP v2.5.25 adds three new hideNseek LAB threat intelligence feeds and improved screen-reader accessibility for server settings. • Adds three new 'hideNseek LAB' Threat Intelligence Feeds: JSON, CSV, and IP Blocklist formats available as default feeds. • Enables screen-reader users to switch server-setting cells to edit mode via an ARIA button, removing the requirement to double-click. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.216

Tue, 04 Nov 2025 14:39:28 GMT

MISP v2.4.216 adds a 2.5 upgrade script and tightens access controls for sharing group blueprints. • Tightens access control logic for sharing group blueprints Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.23

Wed, 15 Oct 2025 11:51:37 GMT

MISP 2.5.23 adds first-publication tracking, SQL EXPLAIN/ANALYZE endpoints, and a new preRelease admin shell function. • Extends the `/benchmarks/sqlMetrics` endpoint with `/explain` and `/analyze` path parameters to run SQL EXPLAIN or ANALYZE on slow queries. • Adds a `preRelease` function to the admin shell for dumping the current DB schema and `describeTypes.json`. • Adds OpenAPI documentation for sharing group blueprints and sharing group blueprints `viewOrgs`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.22

Thu, 02 Oct 2025 13:40:02 GMT

MISP v2.5.22 adds locked-event creation on feed pulls and expands Event Report View to show full event family trees. • Supports creating locked events on feed pulls, giving analysts control over event mutability when ingesting threat feeds. • Event Report View now surfaces all children of the current event and all children of the parent event, enabling full visibility into extended event hierarchies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.21

Thu, 11 Sep 2025 07:25:55 GMT

MISP v2.5.21 adds on-demand event recorrelation for site admins, available via UI and API. • Adds on-demand recorrelation of any event for site admins, accessible through the UI or via the API endpoint `/events/recorrelate/{event_id}`. • Expands AttributeValidationTool to support more vulnerability ID types. • Updates misp-galaxy, misp-objects, taxonomies, and misp-stix to their latest versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.19

Fri, 29 Aug 2025 09:26:28 GMT

MISP 2.5.19 adds top correlations support to the on-demand correlation engine. • Adds support for *top correlations* in the on-demand correlation engine, enabling ranked correlation views on demand. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.18

Wed, 20 Aug 2025 09:17:21 GMT

MISP v2.5.18 adds an on-demand correlation engine, a built-in task scheduler, and high-performance indexing for No-ACL correlations. • New OnDemand Correlation Engine fetches correlating values live without persistent storage, reducing disk usage and eliminating the need to re-run correlation jobs. • New built-in Task Scheduler (site-admin only) lets administrators create and manage recurring actions for feeds, servers, workflows, and summaries — accessible at `/tasks` — replacing external cron-based scheduling. • Scheduler tasks support manual on-demand triggering via a play button, per-task execution logs, and per-user run context. • High-performance indexing support added for No-ACL correlations, with a CLI tool available to apply the required indexes. • Adds a new `last_run_at` column on tasks and improved job status handling in the task scheduler. • Adds a periodic user summary scheduled task for generating regular reports. • Forgejo CI integration added with a dedicated worker file and Forgejo-compatible YAML workflow. Breaking changes: • The `process_id` field in task/job handling is replaced with `last_job_id`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.214

Sat, 19 Jul 2025 06:00:09 GMT

MISP v2.4.214 adds `highPerformance` and `indexLogs` DB script options, NDJSON error logs, and a SQL slow log endpoint. • Adds `cake Admin runDBScript` with `highPerformance` and `indexLogs` options to apply performance-enhancing database indexes • Generates error logs in NDJSON format for easier parsing and integration with modern logging systems • Adds a new SQL slow log endpoint for benchmarking, allowing filtering by controller/action and pagination Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.16

Wed, 16 Jul 2025 16:17:14 GMT

MISP v2.5.16 adds a performance toolkit with new DB index scripts, NDJSON error logs, and a SQL slow-query benchmarking endpoint. • New `cake Admin runDBScript highPerformance` command re-indexes events, attributes, objects, and default correlations for faster queries on large instances. • New `cake Admin runDBScript indexLogs` command adds indexes to the log table for rapid log searching and auditing. • New SQL Slow Log endpoint enables benchmarking by identifying slow SQL queries, filterable by controller/action with pagination and configurable slow-query threshold. • New purge function clears old SQL benchmark logs to keep logging data manageable. • Error logs can now be generated in NDJSON format for easier parsing and integration with modern logging pipelines. • Error log entries now include the user that caused the exception and the exact codebase location where it occurred. • New default OSINT feed from `phish.co.za` (Phishing.Database) added for phishing indicator coverage. • Updated `misp-galaxy`, `misp-object`, and `warning-lists` components to their latest versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.15

Tue, 24 Jun 2025 06:24:07 GMT

MISP v2.5.15 delivers bi-directional correlation rules, role-based API result limits, and faster object restSearch queries. • Bi-directional correlation rule exclusions: existing data now avoids correlating against newly added data when exclusion rules apply, ensuring consistent suppression in both directions. • Role-based API result limits: administrators can configure a maximum number of results returned per API request at the role level for granular resource control. • Filter attributes by `object_relation` field in search queries, adding a new dimension to attribute lookups. • Galaxy view now displays the count of attributes linked to each galaxy cluster. • New 'Import Choice' button surfaced above the attribute list directly on the event view page. • Significant speed-up for object `restSearch` queries via optimized query builder prioritizing event table lookups and new caps on object lookups. • Database schema updated to support larger TAXII server API keys. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.213

Sun, 22 Jun 2025 17:46:33 GMT

MISP v2.4.213 adds bi-directional correlation rules, role-based API result limits, and object_relation attribute filtering. • Bi-directional correlation rule exclusions: existing data now correctly avoids correlating against newly added information when exclusion rules apply, not just the reverse. • Role-based API result limits: administrators can now configure a maximum number of results returned per API request at the role level for granular resource control. • New attribute filter on `object_relation`: attributes can now be searched and filtered by their `object_relation` field. • Import Choice button added directly above the attribute list on the event view page for faster import access. • Galaxy view now displays a count of attributes linked to each galaxy cluster. • TAXII server API key field enlarged in the database schema to support longer key values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.13

Fri, 06 Jun 2025 14:15:49 GMT

MISP v2.5.13 revamps search with POST/token-based pagination and adds new event-filtering and warninglist API capabilities. • Searches now use POST requests backed by a Redis token-based system, enabling flawless pagination on complex queries and independent concurrent search tabs. • New event index and REST API filtering by whether an event is `extending` or `extended` by another event. • Warninglist filtering now supported on the `/attributes/search` endpoint. • API accepts desired response format via the `Accept` header, removing the need to hard-code content negotiation in requests. • Attachments can now be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object. • Event reports can now be looked up by UUID. Breaking changes: • The `extend[ing/ed]` parameter for merging data has been renamed to the `include_*` syntax; existing API calls using `extending` or `extended` for merge operations must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.211

Fri, 06 Jun 2025 14:12:51 GMT

MISP v2.4.211 revamps search with POST/token pagination, adds event filtering by extend relationships, and warninglist filtering in attribute search. • Attribute and log searches now use POST requests backed by a Redis token system, enabling pagination on complex queries and multiple independent search tabs simultaneously. • New event index and REST API filtering by whether an event is `extending` or `extended` by another event. • Warninglist filtering now supported in the `/attributes/search` endpoint. • API now respects the `Accept` header to set the desired response format. • Attachments can be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object. • Event reports can now be looked up by UUID. Breaking changes: • The `extend[ing/ed]` parameter for merging data has been renamed to `include_*` syntax; existing API calls using `extending` or `extended` for merging must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.12

Wed, 14 May 2025 16:17:30 GMT

MISP v2.5.12 adds extended vulnerability validation, split event indicators, and optional extended-event index display. • Extends validation for `vulnerability` attributes across all supported ID formats via vulnerability-lookup integration. • Splits 'Known Identifier' from 'False Positive' indicators in the event view for clearer analyst workflows. • Introduces optional display of extended events in the event index. • Adds a default value for `extendedEvents` in the event index to prevent undefined behavior. • Updates `misp-stix`, `misp-galaxy`, and `warning-list` components to their latest versions. • Improves support for combining multiple authentication methods (OTP/OIDC). • Switches OpenPhish feed to a stable, officially supported GitHub-based URL. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.210

Wed, 14 May 2025 16:14:16 GMT

MISP 2.4.210 adds split Known Identifier/False Positive indicators, extended vulnerability validation, and optional extended-event index display. • Splits 'Known Identifier' from 'False Positive' indicators in the event view for clearer analyst triage. • Extends vulnerability attribute validation to cover all supported ID formats via vulnerability-lookup. • Adds optional display of extended events in the event index. • Updates misp-stix, misp-galaxy, and warning-list components to their latest versions. • Improves support for combining multiple authentication methods (OTP/OIDC). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.11

Wed, 14 May 2025 15:30:13 GMT

MISP v2.5.11 adds ad-hoc workflow debugging, OIDC identity provider selection, user IP tools, and UUID-based collection management. • Adds ability to run debugged ad-hoc workflows on specific event IDs directly from the Workflow Editor. • Introduces `_env` dictionary in Jinja rendering to expose environmental context (e.g., `base_url`) within workflow templates. • Supports filtered/unfiltered overrides in workflow execution. • Adds OIDC identity provider selection and `mixedAuth` configuration for flexible authentication setups. • Adds new `userIP` and `IPUser` tools to the user controller for IP-based user lookups. • Enables editing, viewing, and deletion of Collections by UUID. • Extends OpenAPI documentation coverage for Collections. • Makes `event.info` collation case-insensitive at the database level. • Adds `PUT` method support to CRUD `add` components. Breaking changes: • The `event.info` column collation is now case-insensitive, which may affect existing queries or indexes that relied on case-sensitive matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.209

Wed, 14 May 2025 14:47:22 GMT

MISP v2.4.209 adds ad-hoc workflow debugging on events, OIDC identity provider selection, and new user IP lookup tools. • Adds ability to run debugged ad-hoc workflows directly on specific event IDs in the Workflow Editor. • Introduces `_env` dictionary in Jinja rendering to expose environmental context (e.g., `base_url`) within workflows. • Supports filtered/unfiltered overrides in workflow execution. • Adds OIDC identity provider selection and `mixedAuth` configuration for flexible authentication setups. • Introduces `userIP` and `IPUser` tools in the user controller for IP-based user lookups. • Enables editing, viewing, and deletion of Collections by UUID. • Extends OpenAPI documentation for Collections. • Adds missing `PUT` method support in CRUD `add` components. • Makes `event.info` collation case-insensitive at the database level. Breaking changes: • The `event.info` field collation is now case-insensitive, which may affect queries or integrations that relied on case-sensitive matching of event titles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.208

Wed, 14 May 2025 13:52:07 GMT

MISP v2.4.208 adds LDAP filter escaping config, auth plugin loading from config, and updated threat-intel content packages. • Adds a new configuration option to escape LDAP filters in `LdapAuth`, hardening directory-based authentication. • Introduces support for loading authentication plugins (e.g., `OidcAuth`) based on configuration settings rather than requiring manual bootstrap code. • Updates bundled content packages: `misp-stix`, `misp-objects`, `warning-lists`, and `misp-galaxy`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.10

Wed, 14 May 2025 08:48:05 GMT

MISP v2.5.10 adds LDAP filter escaping, auth plugin config loading, and S3 prefix validation. • Adds a new configuration option to escape LDAP filters in `LdapAuth`, hardening directory-based authentication. • Introduces support for loading authentication plugins dynamically based on configuration settings. • Adds validation for S3 bucket prefix when deleting events. • Adds warning logging for remote server version mismatches during sync. • Updates bundled threat-intelligence components: `misp-stix`, `misp-objects`, `warning-lists`, and `misp-galaxy`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.8

Wed, 19 Mar 2025 13:07:46 GMT

MISP v2.5.8 adds new workflow modules, reworked attribute search with query-string support, and smarter event sync distribution handling. • Adds `filter-tag` workflow module to filter data based on tags. • Adds `notify_user_toast` workflow module to create in-app notification toasts for users. • Adds `add_analyst_data` workflow module to create analyst data directly from workflows. • Adds CRUD and highlighting support for `relationship_types` in object relationships. • Adds a new default distribution setting for galaxies. • Adds `remove_missing_tags` support on the Event level during pull synchronisation. • Adds `perm_sync_internal` flag so internal-instance pulls no longer downgrade distribution — the remote instance now controls distribution decisions. • Major rework of attribute search: parameters now passable as query strings, search form converted to GET, results easily downloadable, pagination improved, and behaviour made consistent with restsearch. • Adds event-report filtering support to the `if-tag` workflow module. • Adds display of the number of events to be synced when testing sync rules on the server index. • Adds support for the `highlighted` field in object-relationship `/add` and `/edit` endpoints. • Adds support for more HTML attributes in workflow editor form inputs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.206

Wed, 19 Mar 2025 12:54:30 GMT

MISP v2.4.206 adds new workflow modules, reworked attribute search, and improved sync permission controls. • New `filter-tag` workflow module enables filtering pipeline data based on tags. • New `notify_user_toast` workflow module creates in-app notification toasts for users. • New `add_analyst_data` workflow module lets workflows create analyst data entries. • Adds CRUD and visual highlighting support for `relationship_types` in object relationships. • New `perm_sync_internal` permission flag allows internal pulls without distribution downgrade, letting the remote instance control downgrade logic. • Adds `remove_missing_tags` support at the Event level during event pull/sync. • Reworked attribute search now accepts parameters as query strings, uses a GET form, supports direct downloading of results, improves pagination, and aligns with restsearch behavior. • Adds new default distribution setting for galaxies. • The `if-tag` workflow module now supports filtering on event reports. • Server sync test now shows the number of events to be synced when testing sync rules. • Workflow editor adds support for more HTML attributes in form inputs. • Object relationship `/add` and `/edit` endpoints now support the `highlighted` field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.4.205

Fri, 21 Feb 2025 11:09:08 GMT

MISP v2.4.205 adds quick overcorrelation search, a sync-rule test widget, and org-UUID-based sync filtering. • Adds quick search for overcorrelations to speed up data investigation and correlation management. • New Test Sync Rules widget lets users evaluate how many events are filtered under current synchronization rules before applying them. • Sync filtering now uses organization UUIDs instead of names, reducing ambiguity in event propagation rules. • Expands Galaxy Cluster search scope to include fields beyond synonyms, improving search flexibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.7

Fri, 21 Feb 2025 11:08:44 GMT

MISP v2.5.7 adds quick overcorrelation search, a sync-rule test widget, and org-UUID-based sync filtering. • Adds quick search for overcorrelations, enabling faster investigation and management of over-correlated data. • New Test Sync Rules widget lets users evaluate how many events would be filtered under current synchronization filtering rules before applying them. • Sync filtering now uses organization UUIDs instead of names, reducing ambiguity in multi-org synchronization configurations. • Expands Galaxy Cluster search scope beyond synonyms to additional fields, improving search flexibility and accuracy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp

MISP v2.5.6

Mon, 13 Jan 2025 08:30:23 GMT

MISP v2.5.6 adds the Threatmon MISP Community and delivers correlation engine performance improvements via split queries. • Adds the Threatmon MISP Community to the platform's community integrations. • Improves correlation engine performance by splitting attribute correlation lookups into two distinct queries on `value1` and `value2` for optimized MySQL performance. • Reduces memory usage when fetching index data from Redis cache. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/misp