Cyware Intel Exchange, a threat intelligence platform widely used by ISACs and sharing communities. Pages here cover replacing it with self-hosted MISP or OpenCTI.
Comparing Cyware Intel Exchange with MISP, the open-source standard in many sharing communities: sharing groups and distribution levels, feed formats including the MISP format Cyware itself supports, automation, member onboarding and who runs the server.
Cyware Intel Exchange against self-hosted OpenCTI for SOC and CTI teams: STIX 2.1 normalization in both, connectors and enrichment, playbooks that push intelligence to detection tools, TAXII dissemination, and the operating effort of each.
Moving from Cyware Intel Exchange to MISP: exporting intelligence in STIX or MISP format, importing events, rebuilding sharing groups and feeds, and moving member organizations of a sharing community without breaking their integrations.
Moving Cyware Intel Exchange data and feeds to OpenCTI: exporting STIX 2.1 bundles, importing them with relationships, re-creating ingestion as connectors, and replacing Intel Exchange playbooks with OpenCTI playbooks or a SOAR tool.
Cost of ownership by component: Cyware subscriptions for the hub and any connected member instances, against MISP and OpenCTI on your own infrastructure, migration, member support and the people who run the sharing platform.
For ISACs, ISAOs and national CERTs choosing a sharing platform: what members need to connect, MISP's sharing groups, distribution levels and sync between servers, OpenCTI for analysis, governance of a self-hosted hub and the support members expect.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.