Not a second MISP, but the fraction that concerns us
A medium-sized MISP instance holds hundreds of thousands to millions of attributes. Copying them would be a data graveyard with a lot of noise. The module therefore reads in a streaming fashion, block by block, matches immediately against your own inventory and keeps only what fits: the watch list and the verdict are stored, not the foreign database. Every discarded line is counted with a reason instead of silently swallowed, so that a good assessment can be told apart from a type list that is too narrow. The hard anchor is ISO 27001 A.5.7; Section 30(2) BSIG does not mention threat intelligence, and the module does not claim it does.
MISP delivers page by page. Every page is normalised, assessed and held against the relevance threshold immediately. Never more than one page sits in memory, and only what concerns your own sector, technologies or geography reaches the database.
Advancing the fetch cursor on an error skips indicators without anyone noticing. So it stays put, the next run starts 15 minutes before the cursor, and duplicates are caught by the watch list key. After an authentication error the source pauses for two hours instead of locking someone else’s account.
A hit is not a row in a list but a hit on a specific system: matching against SIEM, CSAF, ASM and client management yields an incident and a measure, optionally via the rule chain with containment and a firewall rule.
The fraction of the threat landscape that concerns your organisation, as hits on systems rather than as a copy of someone else’s database.
Schedule a no-obligation demo – we will show you the module with your own use cases.
