MISP workflows and automation
Designing MISP workflows that block publishing on missing context, normalize TLP tags, stop enrichment of sensitive data and post to webhooks or chat, starting from the published blueprints.
MISP features
Platform features that shape a MISP deployment beyond basic event storage: workflows, feeds, knowledge bases, streaming and the newer PostgreSQL option.
MISP threat intelligence feeds setup
Choosing from the default feed catalog, adding CSV and freetext feeds, and deciding per feed whether to cache for lookups, correlate or import as events, so the instance does not drown in low-value data.
MISP taxonomies, galaxies and warning lists
Selecting the taxonomies, galaxies and warning lists to enable, mapping MITRE ATT&CK galaxies to events and using warning lists to cut false positives before indicators reach detection tools.
MISP ZeroMQ and Kafka event streaming
Publishing MISP events, sightings and tag changes over ZMQ or Kafka for downstream consumers and the live misp-dashboard, and what has to be enabled for each.
MISP on PostgreSQL
What the PostgreSQL support added in MISP 2.5.47 means for new installs, why existing MySQL or MariaDB instances are not migrated, and how to choose a database for a new MISP deployment.
