Learn MISP. Share intelligence. Build stronger communities.
Open training materials for analysts, administrators, developers, and trainers. Explore threat intelligence and OSINT, practise with MISP, or adapt the LaTeX sources for your own workshops.
Browse the slides · Try an exercise · Watch a recording · Build your own deck
| You want to… | Start with… |
|---|---|
| Learn the basics | Short introduction and MISP usage |
| Prepare a workshop | Exercises, sample events, and trainer checklist |
| Read the complete training | Download the combined PDF |
| Create or adapt slides | MISP theme and template |
Choose a topic below. Each deck includes a PDF for reading and LaTeX sources for adaptation. Folder prefixes are retained in the source links so you can find the same material in your checkout.
| Topic | Slides | LaTeX source |
|---|---|---|
| A short introduction to information sharing | Source | |
| Introduction to cybersecurity information sharing | Source | |
| Using MISP | Source | |
| Administration | Source | |
| The MISP standard | Source | |
| MISP best practices | Source |
| Topic | Slides | LaTeX source |
|---|---|---|
| Integrating MISP with other tools | Source | |
| mail2misp | Source | |
| Taxonomies and tagging (MISP 2.5) | Source | |
| MISP modules | Source | |
| MISP Galaxy | Source | |
| Object templates (MISP 2.5) | Source | |
| Integrated dashboard (MISP 2.5) | Source | |
| PyMISP | Source | |
| Feeds | Source | |
| Decaying indicators | Source | |
| Decaying indicators — short version | Source | |
| MISP for digital forensics | Source |
| Topic | Slides | LaTeX source |
|---|---|---|
| Contributing to MISP | Source | |
| Introduction to MISP development | Source | |
| REST API (MISP 2.5) | Source | |
| Core development — hands-on | Source | |
| Developing a restSearch export module | Source | |
| Galaxy 2.0 | Source | |
| The MISP data model | Source | |
| MISP workflows | Source | |
| MISP workflows — short version | Source | |
| MISP and STIX | Source | |
| Contributing modules with an AI agent | Source | |
| Building dashboard widgets (MISP 2.5) | Source | |
| Command-line tools | Source | |
| Deployment | Source | |
| Automation | Source |
| Topic | Slides | LaTeX source |
|---|---|---|
| Best practices in threat intelligence | Source | |
| Turning data into actionable intelligence | Source | |
| Turning data into actionable intelligence — training | Source |
| Resource | Read | Source |
|---|---|---|
| Complete training collection | Build script | |
| Training cheat sheet | LaTeX | |
| Trainer feature checklist | LaTeX | |
| Data model overview | — | |
| MISP Ten Pillars | — |
More presentations are available in events, MUG, and complementary materials.
The training archive preserves retired courses and supporting materials for historical reference. They are outside the standard training, excluded from the default build and combined PDF, and may describe obsolete interfaces or integrations. Start with the archived Viper integration course.
Bring the training into a MISP instance with practical scenarios and example events. Pre-built training VMs are available for workshops.
| Material | What you can practise |
|---|---|
| Exercise collection | Investigations, information sharing, and analysis |
| Human-operated ransomware exercise | Pivoting between events and assessing attribution |
| Movie exercise · PDF | Exploring relationships through a fictional scenario |
| Sample events | Graphs, timelines, YARA tracking, and indicator decay |
| Common Exercise Format | Structuring reusable exercises, injects, and scoring |
- MISP Book - PDF ePub Kindle mobi HTML
- Best Practices in Threat Intelligence PDF HTML
- MISP Galaxy (HTML) - PDF
- MISP Galaxy dedicated website
- MISP Taxonomies (HTML) - PDF
- MISP Objects template (HTML) - PDF
- Guidelines to setting up an information sharing community such as an ISAC or ISAO - PDF
- Official MISP Install Guides
Recorded sessions pair the slides with demonstrations in a live MISP instance. Dates identify the recordings; older sessions may show earlier interfaces.
- MISP Workflow - 16th December 2022
- MISP Best Practices for encoding threat intelligence (3 hours - online) - 15th December 2022
- MISP Training Administration and Deployment of MISP software - 14th September 2022
- MISP Training Threat Intelligence Introduction for Analysts and Security Professional - 13th September 2022
- Fundamentals MISP given FIRSTdotOrg 2021 Virtual Symposium African and Arab regions - 18th December 2021
- MISP General Usage Training - Part 1 of 2
- MISP General Usage Training - Part 2 of 2
- MISP Training Usage - Training given the 2nd March 2021 - 2h50 min
- MISP Training Administration and Building Communities- Training given the 3rd March 2021 - 2h56min
- MISP Training Module 1 - An Introduction to Cybersecurity Information Sharing
- MISP Training Module 2 - General usage of MISP
- MISP covid-19 sharing community - introduction
- Farsight Passive DNS and MISP - Part I
- Farsight Passive DNS and MISP - Part II
- Farsight Passive DNS and MISP - Part III
Short recordings for demonstrations and self-paced practice:
All Beamer decks use the MISP 2.0 visual identity, with a shared logo, palette, and reusable template. Start with the theme guide to build a single deck, add a partner logo, or create a presentation.
For the complete publication workflow, run from the repository root:
bash build.shThe script writes individual PDFs and notes handouts under output/ and creates
misp-training.pdf. It also regenerates tracked publication files.
See the build validation report for verified coverage
and known errors in historical material.
Use a recent TeX Live installation with Beamer, TikZ, Fira Sans, and Fira Mono.
The theme guide lists the additional
TeX packages, font maps, and minted requirements used by the full collection.
The publication script also uses pdfunite and exiftool.
Put themes/ first in TEXINPUTS when compiling manually; build.sh does this
automatically. To select XeLaTeX in TeXShop, place an engine hint in the
source header:
% !TEX TS-program = xelatex
% !TEX encoding = UTF-8 UnicodeThe FiraMath font releases are also available for decks that use them.
Improvements to explanations, examples, translations, and workshop materials are welcome. Edit the relevant LaTeX sources, build the affected deck, and open a pull request describing the change. See the contributing slides for more about working with the MISP community.
Training materials are dual-licensed under GNU Affero General Public License 3.0 or later and Creative Commons Attribution-ShareAlike 4.0 International. Choose the license that fits your use case and retain attribution when reusing the materials. Theme code and visual assets also carry their own notices; see the theme guide.
The training materials are supported and co-financed by CIRCL — Computer Incident Response Center Luxembourg and by the Connecting Europe Facility (CEF) under CEF-TC-2016-3 — Cyber Security, through Improving MISP as building blocks for next-generation information sharing.
In alphabetical order: