MISP Modules v3.1.4 introduces a major expansion of enrichment and automation capabilities, with 19 new modules and actions, including integrations with leading SOAR platforms, threat intelligence services, and security tools.
This release continues to strengthen the MISP 3.0 ecosystem by connecting threat intelligence with operational security workflows, enabling analysts to enrich indicators, investigate threats, and automate response activities directly from MISP.
Highlights
- New SOAR integrations: Cortex XSOAR 8, Shuffle, Torq, n8n, and Tines, supporting both enrichment and workflow execution.
- Palo Alto Cortex XDR integration: IOC lookup and publication capabilities.
- Cisco security intelligence: New integrations with Cisco PSIRT openVuln and Cisco Umbrella Investigate.
- Additional threat intelligence sources: SiberKapan, DarkEye, DECTRAX, and Flowintel.
- Sigma rule export: Generate Sigma detection rules with optional Windows IOC generation.
- Improved existing modules: NetAPI, VirusTotal Graph, CrowdStrike, CAPE, and CSV import.
- Reliability and security improvements: Better input validation, API compatibility, error handling, and regression testing.
New Modules and Integrations
Threat Intelligence and Enrichment
| Module | Type | Description |
|---|---|---|
| SiberKapan | Expansion | IP address intelligence lookup using SiberKapan. |
| DarkEye | Expansion | Domain exposure intelligence and enrichment. |
| DECTRAX | Expansion | Threat intelligence enrichment using autonomous cyber deception and honeypot telemetry. |
| Flowintel | Expansion | Case lookup and enrichment using Flowintel investigation data. |
| Cisco PSIRT openVuln | Expansion / Hover | Look up CVEs, Cisco advisory IDs, and bug IDs using the openVuln v2 API. |
| Cisco Umbrella Investigate | Expansion / Hover | Domain categorization and risk scoring using the Umbrella Investigate v2 API. |
| Cortex XDR IOC Lookup | Expansion | Retrieve existing indicators and associated intelligence from Cortex XDR. |
| Cortex XSOAR 8 Indicator Lookup | Expansion | Search indicators within Cortex XSOAR 8. |
| Shuffle Datastore Lookup | Expansion | Query Shuffle Datastore records. |
| Torq Observable Lookup | Expansion | Enrich observables using Torq. |
| n8n Data Table Lookup | Expansion | Query n8n Data Tables for additional intelligence. |
| Tines Records v2 Lookup | Expansion | Retrieve intelligence from Tines Records v2. |
Security Automation and Workflow Actions
MISP 3.0 workflows can now interact with additional SOAR platforms, enabling automated investigation and response processes.
| Module | Type | Description |
|---|---|---|
| Cortex XSOAR 8 Incident Creation | Workflow | Create incidents directly in Cortex XSOAR 8. |
| Shuffle Workflow Execution | Workflow | Trigger Shuffle workflows from MISP. |
| Torq Case Creation | Workflow | Create cases in Torq. |
| n8n Webhook | Workflow | Execute n8n automations through webhooks. |
| Tines Cases v2 Creation | Workflow | Create cases through the Tines Cases v2 API. |
| Cortex XDR IOC Publication | Workflow | Publish MISP indicators into Cortex XDR using its public JSON IOC API. |
These integrations help bridge the gap between threat intelligence analysis and operational response, allowing organisations to reuse intelligence directly within their existing automation platforms.
Detection Engineering
| Module | Type | Description |
|---|---|---|
| Sigma Rule Export | Export | Export Sigma detection rules, including optional Windows IOC generation. |
The new Sigma export module provides an additional path for transforming threat intelligence into actionable detection content.
Improvements to Existing Modules
Cortex XDR
The new Cortex XDR integration includes additional validation and safety mechanisms:
- Support for native IOC hash types (MD5 and SHA-256).
- Explicit rejection of unsupported SHA-1 IOC lookups and publication.
- Support for the documented non-expiring IOC value (
expiration_date=-1). - Preflight validation before IOC publication.
- Deadline enforcement before write operations.
- Improved handling of partial publication outcomes.
- Documentation covering supported IOC types and licensing requirements.
VirusTotal Graph
- Fixed Graph export parsing and compatibility with API v3.
- Improved expansion handling by skipping non-expandable graph nodes.
Cisco Integrations
- Cisco PSIRT: Improved handling of unavailable optional URLs (
NA/N/A) without rejecting otherwise valid advisories. - Cisco Umbrella: Improved internationalized domain handling using IDNA2008 and non-transitional UTS-46 processing.
Other Improvements
| Module | Improvement |
|---|---|
| NetAPI | Added IP address lookups against the compromised IP feed. |
| CrowdStrike | Improved enrichment diagnostics, Intel lookup error handling, and Falcon Intelligence configuration documentation. |
| Cuckoo / CAPE | Fixed standalone CAPE JSON report imports and updated mappings for current report fields. |
| CSV Import | Improved REST upload validation and documented the base64 data contract. |
Quality and Maintenance
This release also includes improvements to the overall reliability of MISP Modules:
- Expanded API contract and regression tests for new integrations.
- Improved validation of external API responses and inputs.
- Additional documentation for newly supported services.
- Improved CI dependency management across supported Python versions.
- Fixed overlapping dependency lock selections.
- Improved module compatibility with external API changes.
Community Contributions
Many thanks to all contributors who helped extend MISP Modules in this release, including:
- Oktay ALVER — SiberKapan integration.
- Juan Manuel Tejada — DarkEye expansion module.
- Sadman-TheDentian — DECTRAX threat intelligence integration.
- Slava Olesik — NetAPI compromised IP lookup enhancements.
- Alexandre Dulaunoy — New integrations, workflow actions, security improvements, and maintenance.
Upgrade
MISP Modules v3.1.4 is available from the official repository:
https://github.com/MISP/misp-modules
This release is particularly relevant for MISP 3.0 deployments, where the growing collection of enrichment modules and workflow actions enables deeper integration between threat intelligence, detection engineering, and security automation.
MISP Modules continues to evolve as an open-source integration ecosystem, connecting threat intelligence with the tools and workflows used by security teams every day.