# MISP vs OpenCTI

| Attribute | MISP | OpenCTI |
|---|---|---|
| **vioscaleAI score** | 42 (13% (low)) | 56.3 (16% (low)) |
| activity.commits_last_30d | 0 | - |
| adoption.github_stars | 440 | - |
| content.faq | `[{"answer":"A software solution that enables security teams to collect, store, distribute, and analyze cyber threat indicators, malware information, and incident data in structured formats, with built-in correlation, automated exports, and real-time synchronization across organizations. It is indexed under Threat Intelligence.","source":"https://www.misp-project.org","question":"What is MISP?","confidence":0.6},{"answer":"MISP is open source, so it can be self-hosted and used at no licence cost. Pricing changes often, so verify at source before relying on it.","source":"https://www.misp-project.org","question":"Is MISP free to use?","confidence":0.6},{"answer":"MISP supports the web and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://www.misp-project.org","question":"What platforms does MISP support?","confidence":0.6},{"answer":"Yes. MISP can be deployed cloud / SaaS, on-premise and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://www.misp-project.org","question":"Can MISP be self-hosted?","confidence":0.6},{"answer":"We have confirmed 11 integrations for MISP, including Wazuh, Slack, PagerDuty, VirusTotal, Shuffle, Maltiverse, STIX and OpenIOC, plus 3 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://www.misp-project.org","question":"What does MISP integrate with?","confidence":0.6},{"answer":"We have independently confirmed GDPR for MISP. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as MISP not holding them. Always confirm compliance directly before you rely on it.","source":"https://www.misp-project.org/security/","question":"What security certifications does MISP have?","confidence":0.7},{"answer":"MISP is available worldwide. Its primary markets are the United States, the EU and the United Kingdom.","source":"https://www.misp-project.org","question":"Where is MISP available?","confidence":0.75}]` | - |
| deployment.options | `{"cloud":true,"hybrid":true,"on_prem":true,"self_hosted":true}` | - |
| description.long | A collaborative tool for security teams to gather structured threat intelligence, analyze relationships and patterns across indicators, and distribute insights to trusted partners and security tools. It supports real-time synchronization across multiple MISP instances and integrates with broader security infrastructure through APIs and industry standard formats. | - |
| features.capabilities | `{"pricing_model":"open_source","deployment_model":"self_hosted_platform","siem_xdr_enrichment_api":true,"mitre_attck_framework_mapping":true}` | - |
| integrations.count | 7 | - |
| integrations.list | `[{"name":"Wazuh"},{"name":"Slack"},{"name":"PagerDuty"},{"name":"VirusTotal"},{"name":"Shuffle"},{"name":"Maltiverse"},{"name":"STIX"},{"name":"OpenIOC"},{"name":"Suricata"},{"name":"Snort"},{"name":"Zeek"},{"name":"RPZ","native":true,"direction":"outbound"},{"name":"MITRE ATT&CK","native":true,"direction":"bidirectional"}]` | - |
| language.primary | TeX | - |
| market.availability | `{"primaryMarkets":["US","EU","GB"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true,"web":true}` | - |
| pricing | `{"type":"open_source","summary":"Free and open source","freeTier":true,"sourceUrl":"https://www.misp-project.org","retrievedAt":"2026-08-19T22:02:12.892Z"}` | - |
| pricing.free_tier | yes | - |
| pricing.model | open_source | commercial |
| pricing.price_level | free | - |
| pricing.transparent | yes | - |
| security.disclosure_policy | yes | - |
| security.gdpr | yes | - |
| security.iso27001 | - | yes |
| security.soc2 | - | yes |

## Capabilities (Threat Intelligence)

| Capability | MISP | OpenCTI |
|---|:--:|:--:|
| **Capabilities** |  |  |
| Deployment model | Self hosted platform | - |
| Proprietary ioc feeds | - | - |
| Stix taxii protocol support | - | - |
| Dark web forum monitoring | - | - |
| Brand impersonation protection | - | - |
| Vulnerability cve intelligence | - | - |
| Malware sandbox analysis | - | - |
| SIEM XDR enrichment API | ✓ | - |
| Automated firewall rule sync | - | - |
| Mitre attck framework mapping | ✓ | - |
| SOC2 type ii | - | - |
| ISO 27001 | - | - |
| Pricing model | Open source | - |

*Source: vioscaleAI. Generated 2026-10-16T19:22:08.927Z. "-" = undocumented, not absent.*