We are pleased to announce MISP Modules v3.1.3, introducing eight new expansion modules across seven integrations, alongside improvements to existing modules and dependency management.
This release strengthens MISP's capabilities in internet infrastructure discovery, IP reputation, vulnerability intelligence, SSL/TLS assessments, and historical infrastructure analysis.
With the upcoming evolution of MISP 3.0, we continue expanding the enrichment ecosystem to make intelligence investigation, correlation, and pivoting more accessible to security analysts.
New Expansion Modules
Version 3.1.3 introduces several integrations covering complementary sources of security and threat intelligence.
| Module | Intelligence Source | Description | Investigation Use Cases |
|---|---|---|---|
| NeutrinoAPI IP Blocklist | NeutrinoAPI | Queries IP blocklist intelligence to provide additional reputation context. | Malicious infrastructure identification, IP reputation |
| Qualys SSL Labs | SSL Labs API v4 | Retrieves SSL/TLS configuration and security assessment information. | TLS security analysis, exposed service assessment |
| ZoomEye | ZoomEye API v2 | Enriches IP addresses and hostnames with internet-wide infrastructure intelligence. | Infrastructure discovery, exposed services, OSINT pivoting |
| DShield / SANS ISC | SANS Internet Storm Center | Provides intelligence about suspicious IP addresses and observed network activity. | Scanning activity, suspicious infrastructure investigation |
| Pulsedive | Pulsedive | Enriches indicators with threat intelligence context and associated infrastructure information. | IOC enrichment, threat intelligence pivoting |
| VulDB | VulDB | Retrieves additional vulnerability intelligence. | Vulnerability research and enrichment |
| Plum Island History | Plum Island Discovery API | Retrieves historical information about IP addresses and infrastructure. | Historical infrastructure investigations |
| Plum Island Search | Plum Island Discovery API | Provides infrastructure discovery through the search API. | Infrastructure discovery and pivoting |
These additions allow analysts to combine different intelligence perspectives directly within MISP, reducing the need to switch between external investigation platforms.
Infrastructure and IP Intelligence
The integration of ZoomEye, NeutrinoAPI, DShield, and Plum Island extends MISP's infrastructure investigation capabilities.
Analysts can combine internet-wide visibility, reputation information, observed network activity, and historical infrastructure data to better understand suspicious IP addresses and related assets.
The two Plum Island modules are particularly interesting for investigations involving infrastructure that evolves over time, allowing analysts to explore historical observations alongside current intelligence.
Vulnerability and Security Intelligence
Two new integrations expand vulnerability and security assessment capabilities:
- VulDB introduces another source of vulnerability intelligence, complementing existing enrichment services.
- Qualys SSL Labs provides SSL/TLS security assessment information through API v4.
The SSL Labs module includes an explicit consent requirement before initiating any analysis request, ensuring that active scans are only performed when authorized.
Threat Intelligence Pivoting
The new Pulsedive integration adds another source of indicator intelligence and related infrastructure context.
It also preserves PTR (reverse DNS) pivots, allowing analysts to retain valuable relationships between IP addresses and hostnames during investigations.
Combined with the new infrastructure discovery modules, these capabilities create additional opportunities for identifying relationships between indicators.
Improvements to Existing Modules
Beyond the new integrations, v3.1.3 introduces several improvements to reliability, authentication, and investigation workflows.
| Module | Improvements |
|---|---|
| Sherlock | Exposes subprocess progress and failure diagnostics, improving visibility and troubleshooting during username investigations. |
| VulnDB / Flashpoint | Updated authentication to support OAuth 2.0 client credentials. |
| Pulsedive | Preserves PTR pivots and normalizes lookup configuration. |
| ZoomEye | Improves hostname coverage and credential handling. |
| NeutrinoAPI | Normalizes credentials and rejects special-use IP addresses. |
| DShield | Adds special-use IP address validation. |
| Qualys SSL Labs | Requires explicit scan consent before analysis requests. |
The distinction between VulDB and VulnDB is worth highlighting: VulDB is a new integration, while the existing VulnDB module has been updated for Flashpoint authentication.
Additional maintenance includes dependency updates and simplification, contributing to a more maintainable module ecosystem.
Strengthening Intelligence Pivoting in MISP
A central objective of recent MISP Modules releases is to provide analysts with more opportunities to pivot between different types of intelligence.
Investigations rarely focus on a single indicator. An IP address might reveal associated hostnames, exposed services, historical infrastructure, reputation information, or related vulnerabilities.
The new integrations extend these possibilities:
IP addresses → Hostnames → Exposed services → Historical infrastructure → Reputation intelligence → Vulnerabilities
By combining complementary sources, MISP helps analysts build a more complete picture of suspicious activity and infrastructure.
These capabilities are especially valuable for CSIRTs, SOCs, threat intelligence teams, vulnerability researchers, and OSINT investigators.
Supporting MISP 3.0
The continued development of MISP Modules is an important part of the broader evolution of the MISP ecosystem.
With MISP 3.0, the objective is to offer more efficient investigation workflows, improved visualization, and stronger integration with external intelligence sources.
MISP Modules provides the enrichment and expansion capabilities needed to connect MISP with a growing ecosystem of intelligence services.
The increasing diversity of integrations also benefits other open-source security projects that rely on MISP Modules for enrichment and intelligence processing.
Release Summary
| Category | Highlights |
|---|---|
| Release | v3.1.3 – 3 November 2026 |
| New expansion modules | 8 modules across 7 integrations |
| New intelligence sources | NeutrinoAPI, Qualys SSL Labs, ZoomEye, DShield, Pulsedive, VulDB, Plum Island |
| Updated modules | Sherlock, VulnDB / Flashpoint |
| Additional improvements | Authentication, input validation, reverse DNS pivots, subprocess diagnostics |
| Maintenance | Dependency updates and simplification |
Get the Release
MISP Modules is an open-source project developed and maintained by the MISP community.
- Source code: https://github.com/MISP/misp-modules
- Release v3.1.3: https://github.com/MISP/misp-modules/releases/tag/v3.1.3
- Documentation: https://misp.github.io/misp-modules/
We welcome contributions, bug reports, and suggestions for additional intelligence integrations.
Thanks to all contributors for their continued work on expanding the MISP ecosystem.
Happy threat hunting and pivoting!