MISP

MISP is a threat intelligence platform for collecting, storing, distributing, and sharing cyber security indicators and threats. It serves incident analysts, security and ICT professionals, and malware reversers who need to exchange structured findings from incident and malware analysis.

Atomic data points are organized into rich objects with automatic correlation that surfaces links between events. It supports structured reporting, warning lists, sightings, and an OpenAPI-described REST API, and imports or exports MISP JSON, STIX 1 and 2, CSV, OpenIOC, and IDS rules for Suricata, Snort, and Zeek.

Instances can synchronize with one another to build trusted sharing communities, and GnuPG and S/MIME secure notification encryption and signing. It is self-hosted, whether on premise or on infrastructure you run in the cloud.