Adopt it if you run a security team or CSIRT that collects and shares threat indicators and can self-host. Skip it if you have no dedicated security staff — free software still needs a full-time operator.
Confidence
Medium. Based on 9 public sources; independent user reviews scarce.
Ratings
Value for money
Ease of use
Feature depth
Support quality
Security posture
Pricing
Free
Open source
ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Best for
→CSIRTs and CERT teams
→Critical infrastructure security teams
→Threat intel sharing communities
→Malware analysts tracking IOCs
Not for
×Small teams without dedicated security staff
×Anyone wanting plug-and-play SaaS
×Organizations that can't self-host and patch
×Buyers needing vendor SLAs by default
Gotchas - check before you buy
medium
Free license, real cost is admin time: setup, tuning, syncs, patching.
medium
Community support by default; commercial support is a separate purchase.
medium
Open standards ease exports, but building sharing communities takes sustained effort.
low
Frequent hotfix releases mean regular patching of your instance.
Pros and cons
Pros
+Free and open source for collecting, storing, and sharing threat indicators.
+Ships with taxonomies, galaxies, objects, and MITRE ATT&CK cluster mappings.
+Confirmed security vulnerabilities usually fixed within 48 hours.
+Transparent CVE publication, even for minor bugs.
+Actively maintained: 2.5.44 hotfix shipped July 13.
Cons
−Self-hosted; needs correct setup and ongoing maintenance.
−History of XSS and authentication-bypass CVEs.
−No turnkey SaaS; you run and patch the instance yourself.
−Formal support requires separate commercial arrangements.
Sources & method
- 6 sources - Transparent disclosure culture; fixes within ~48 hours; several historical XSS/auth CVEs, all patched.
official x2review x2security x1news x1
CVE-2017-14337 — authentication bypass, Before 2.4.80, X.509 CertAuth with an external REST API returning an empty value granted unauthenticated access as an arbitrary user.
CVE-2017-13671 — persistent XSS, Persistent XSS via comments in versions before 2.4.79; affected only users of the same instance.
CVE-2015-5721 — PHP object injection, Versions before 2.3.90 allowed PHP object injection via crafted serialized data in template flows.
Key stats
Value for money: 5/5
Rating
Free
Starting price
6
Sources
Analyzed
Value for money: 5/5. Free, open source, no license fees.
Ease of use: 2/5. Needs correct setup and self-hosting.
Support quality: 3/5. Community default; commercial support sold separately.
Security posture: 4/5. 48-hour fixes, transparent CVEs, past XSS/auth bugs.
Free Price Open source software
Yes Free tier Fully open source
2.5.44 Latest release Hotfix release, Jul 13
7+ Published CVEs 2015–2017 advisories, openly disclosed
Pricing
Open source
Free
Collect, store, share indicators
Taxonomies, galaxies, objects
Sync and sharing communities
Security
Transparent disclosure culture; fixes within ~48 hours; several historical XSS/auth CVEs, all patched.
CVE-2017-14337 — authentication bypassBefore 2.4.80, X.509 CertAuth with an external REST API returning an empty value granted unauthenticated access as an arbitrary user.²
CVE-2017-13671 — persistent XSSPersistent XSS via comments in versions before 2.4.79; affected only users of the same instance.²
CVE-2015-5721 — PHP object injectionVersions before 2.3.90 allowed PHP object injection via crafted serialized data in template flows.²
What users say
The one practitioner quote found calls it a favorite, flexible open source tool for intel feeds when set up correctly.
“is far my favorite tool for Intel feeds. Its open source, flexible, and if set up correctly can”
Support quality: 3/5. Community default; commercial support sold separately.
Security posture: 4/5. 48-hour fixes, transparent CVEs, past XSS/auth bugs.
Security notes
Transparent disclosure culture; fixes within ~48 hours; several historical XSS/auth CVEs, all patched.
CVE-2017-14337 — authentication bypass. Before 2.4.80, X.509 CertAuth with an external REST API returning an empty value granted unauthenticated access as an arbitrary user.2
CVE-2017-13671 — persistent XSS. Persistent XSS via comments in versions before 2.4.79; affected only users of the same instance.2
CVE-2015-5721 — PHP object injection. Versions before 2.3.90 allowed PHP object injection via crafted serialized data in template flows.2
What to use instead
OpenCTI: Open source threat intel platform with a more modern interface. https://www.opencti.io
ThreatQ: Commercial threat intel platform with vendor support. https://www.threatq.com
Anomali ThreatStream: Enterprise commercial TIP with managed onboarding. https://www.anomali.com/products/threatstream
Raw STIX/TAXII feeds: Just consuming feeds? Plain STIX/TAXII feeds may suffice. https://oasis-open.github.io/cti-documentation/
3.MISP community releases https://misp-community.org
4.Cyspace Global Technology LinkedIn post https://www.linkedin.com/posts/cyspaceglobal_misp-open-source-threat-intelligence-platform-activity-7267451297732145153-MEnH
5.NTT Data: active cyber defense with MISP https://www.nttdata.com
Comments
One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.
No comments yet.