MISP gives threat intelligence teams a powerful way to store, correlate and share intelligence. But the platform is only useful when your team knows how to use it well.
Our MISP training is practical and hands-on. Your team works through lab scenarios based on real-world use cases, building the skills they need to use MISP in their day-to-day work.
Facilitated by some of the world’s foremost CTI experts.
We have taught MISP Kickstart publicly, at two of the conferences closest to this work, and privately for individual teams.
Delivered in person in Brisbane to a sold-out room at AUSCERT 2025.
Delivered at hack.lu in Luxembourg, where much of the MISP community gathers each year.
Delivered privately for major organisations.
MISP Kickstart is our practical introduction to MISP. Over two half-days, live and online, your team sets up, configures and uses its own MISP instance.
Attendees work through lab scenarios drawn from real-world use cases rather than theory. Everyone leaves with a working instance, the course materials and a certificate of completion.
You’ll understand its background, functions, and its role in Cyber Threat Intelligence (CTI) sharing. Additionally, you’ll be primed on CTI sharing fundamentals.
This module walks you through the process of downloading and importing the MISP Appliance, and logging in for the first time.
This module introduces MISP terminology and guides you through setting up your organisation, including a hands-on lab for configuring the primary organisation.
This module provides a comprehensive understanding of threat data ingestion in MISP, emphasising practical skills in data enrichment.
This module focuses on enhancing your proficiency in analysing threat data, providing practical insights into identifying patterns, mitigating false positives, leveraging MISP Sightings, and utilising MISP for in-depth malware analysis.
You’ll gain practical experience in configuring sharing settings, defining access levels, and participating in collaborative threat intelligence efforts.
In Module 7, we will conduct a comprehensive review of key concepts covered throughout the course, reinforcing your understanding of critical elements.
Give your team practical experience with the core workflows they need to start using MISP more effectively in their day-to-day threat intelligence work.
Install, configure and upgrade a MISP instance, and manage organisations, users and permissions.
Add intelligence manually, configure threat feeds and custom feeds, and enrich it using the sources available to your team.
Correlate events, manage false positives, record sightings, and use MISP to support malware analysis.
Sharing groups and communities, distribution levels, and where STIX/TAXII fits.
Tell us about your team and we’ll come back with a quote.