DocsMISP & OpenCTI

MISP & OpenCTI

Both platforms can pull ThreatIntellix data automatically, using whichever import mechanism they already support, with no ThreatIntellix-specific plugin needed for either.

OpenCTI: via TAXII 2.1

OpenCTI has a built-in TAXII 2.1 connector. Add a new TAXII connector pointed at https://taxii.your-deployment.example/taxii2/, with your API key as the Bearer token. See the TAXII integration guide for the full endpoint reference. Nothing MISP/OpenCTI-specific needed beyond that; it's a standard TAXII 2.1 server.

MISP: via TAXII, or via native Feed

MISP also has a TAXII import module (Sync Actions → TAXII Servers) that works the same way as OpenCTI's above. If you'd rather not enable MISP's TAXII module, ThreatIntellix also publishes a native MISP Feed, the simpler format MISP's own Feed subscription mechanism understands directly, no TAXII involved.

In MISP: Sync Actions → Feeds → Add Feed.
Source format: MISP Feed.
URL: https://taxii.your-deployment.example/misp-feed/
Under Headers, add Authorization: Bearer sk_live_... (MISP's feed fetcher supports custom HTTP headers per feed).
Enable the feed and run "Fetch and store all feed data" (or let MISP's scheduled feed cache job pick it up).

Feed contents

Each CISA KEV entry becomes one MISP Event with a single vulnerability-type Attribute carrying the CVE ID. manifest.json lists every event's metadata; each event's full record is at /misp-feed/<event-uuid>.json.

{
  "a1b2c3d4-...": {
    "Orgc": { "name": "ThreatIntellix" },
    "Tag": [{ "name": "cisa-kev" }, { "name": "tlp:clear" }],
    "info": "CISA KEV: TrueConf Server Code Injection Vulnerability",
    "date": "2026-08-20",
    "analysis": "2",
    "threat_level_id": "2",
    "timestamp": "1755781200"
  }
}