MISP

v2.4.194MISP Project / CIRCL

The reference open-source TI platform. Stores events with attributes, tags (TLP, MITRE ATT&CK) and correlations. The range's MISP replays the intel feed populated by the Threat Intel pipeline (CISA KEV, Feodo Tracker, URLhaus).

Category: Threat intelligence & case management
Package: misp
Runs on: Linux
Commands: misp-cli, misp
Console: https://misp.range.local

Events and attributes come from the range's authored intel feed. Nothing pushes to or pulls from a real MISP peer.

Install it

The scripts below install the real MISP Project / CIRCL package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-misp.sh

Windows installer (PowerShell)

Install-misp.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Upstream install script

Read the script before you run it
```
curl -fsSL https://misp.range.local/install.sh -o install.sh
```
Piping an unread script straight into a shell is how estates get owned.
Run the installer
```
sudo bash install.sh
```

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install MISP
```
sudo apt install -y misp
```

Check it worked

Confirm it landed on PATH
```
which misp-cli
```
Check the version
```
misp-cli --version
```
The range reports 2.4.194.

Remove it

Take it off again
```
sudo apt remove --purge misp
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install MISP inside it
```
wsl sudo apt install -y misp
```

Inside the range

Tick it on the launch screen
Under MISP's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y misp
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use MISP

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.