Clusters and elements to attach to MISP events or attributes (like threat actors)

A simple ReST server to lookup threat actors (by name, synonym or UUID) and returning the corresponding MISP galaxy information about the known threat actors.

Pythonic way to work with the galaxies defined there: https://github.com/MISP/misp-galaxy

Scripts for importing threat feeds and CTI articles, blogs, and reports into MISP.

A complete MISP threat-intel deployment project using Docker on Kali Linux, featuring APT18 event creation, feed activation, custom tagging, Python-based feed parsing, PostgreSQL + Grafana statistics, and fully working email alerting.