MISP Modules v3.0.13 - More pivots, more integrations, more actionable intelligence

MISP Modules v3.0.13 is a substantial release, bringing a new wave of OSINT and threat intelligence enrichment capabilities, new ways to export indicators into operational security tools, and new workflows for publishing IOCs directly to security platforms.

The objective is simple: make it easier to pivot from an observable to useful context, and from intelligence to action. This release also includes important security fixes, improvements to existing integrations, and better visibility into module usage.

Highlights

• Seven new export integrations for Cisco IOS ACLs, Linux nftables, OpenBSD PF, Zeek, QRadar, Elastic ECS, and Splunk.
• Three IOC publishing workflows for QRadar, SentinelOne, and CrowdStrike Falcon.
• New enrichment and pivoting capabilities using OpenCTI, Malpedia, Sherlock, DNS enumeration, Lookyloo, OpenPGP keyservers, and SpamCop.
• More complete vulnerability intelligence, with Vulnerability-Lookup relationships returned alongside MISP objects.
• A per-module query statistics endpoint to improve operational visibility.
• An important SSRF-related security fix in html_to_markdown, alongside several reliability and data-quality improvements.

New export modules: turn intelligence into operational controls

This release considerably expands the options for using MISP indicators beyond MISP itself.

Integration	What's new
Cisco IOS ACL (#958)	Generate Cisco IOS access-control lists with deny and permit-log modes. Generated ACL names respect the IOS XE length limit.
Linux nftables (#957)	Export indicators as nftables rules with blocking and logging modes.
OpenBSD PF (#956)	Export rules for OpenBSD's Packet Filter, with blocking and logging modes.
Zeek Intel Framework (#949)	Export indicators for Zeek's intelligence framework, with handling aligned to Zeek's HTTP URL decoding and port observations.
IBM QRadar reference sets (#948)	Export indicators for QRadar reference sets; a separate publishing action is also available.
Elastic ECS (#945)	Generate threat indicators in Elastic Common Schema (ECS) Bulk NDJSON format, with additional handling for URL credentials and oversized index terms.
Splunk CSV lookups (#944)	Export indicators from MISP events and objects as CSV lookup data for Splunk.

These modules make it easier to bring shared threat intelligence into network filtering, network monitoring, SIEM, and detection workflows using formats those tools can consume.

New IOC publishing actions

In addition to file-based exports, v3.0.13 introduces workflows to publish indicators to external security platforms:

• CrowdStrike Falcon (#946) — IOC publishing action, including enforcement of Falcon's normalized domain IOC length limit.
• SentinelOne Threat Intelligence (#947) — IOC publishing workflow action.
• IBM QRadar (#948) — Reference-set publishing module, complementing the new QRadar export.

Together, the new export and publishing modules help shorten the path between analysis in MISP and downstream defensive operations.

New OSINT, enrichment, and pivoting modules

OpenCTI, Malpedia, and Lookyloo

• OpenCTI (#951) — New observable expansion module, including a fix for hostname observable mapping.
• Malpedia (#942) — New query and expansion module for malware intelligence, with improved defaults when MISP module settings are unset.
• Lookyloo (#939) — New indicator lookup and capture enrichment modules to support web investigation workflows.

DNS, identities, and OpenPGP

• Comprehensive DNS enumeration (#943) — New DNS record enrichment with complete RDATA and additional pivots. The bundled DNS object template is kept aligned with its canonical upstream definition.
• Sherlock username lookup (#940) — New expansion module for username investigations, with literal usernames preserved in text attributes.
• OpenPGP keyserver enrichment (#936, #938) — Expand PGP key IDs and user ID (UID) metadata, with optional signature packet extraction for further pivots. Parsing was also improved to handle optional HKP index fields and non-critical extension packets.
• SpamCop (#934) — New dedicated expansion module, with improved handling of DNSBL lookup errors.

These additions extend investigations across infrastructure, malware, web activity, online identities, and cryptographic identifiers.

Enhancements to existing integrations

• Vulnerability-Lookup (#955) — Exposes vulnerability relationships alongside returned output objects, allowing enrichment results to retain more of their context.
• APIVoid (#953) — Expansion module migrated to API v2.
• RDAP (#937) — Hostname and subdomain lookups now resolve to the registered domain using the ICANN section of the Public Suffix List before querying RDAP. The result clearly identifies which registered domain was queried, without incorrectly presenting a subdomain as separately registered. IP lookups remain unchanged.
• Whisper (#932) — Updated to whisper-misp 0.0.2, with graph.whisper.online as the default API host, corrected parameter binding, client-identification headers, and automatic UUID backfilling for direct API queries without attribute UUIDs.
• ScanMalware (#935) — Better distinguishes degraded certificate-transparency responses from genuine empty results, reports only hosts observed or loaded as scripts during browser scans, and consistently handles trailing dots in scanned hostnames.

Security, correctness, and observability

Security fix: html_to_markdown

A critical URL safety-check improvement (#908) extends protections against server-side requests to unsafe address ranges. Newly blocked cases include unspecified addresses, carrier-grade NAT/shared address space, IPv6 unique-local and link-local addresses, and their IPv4-mapped forms where applicable. The change includes tests for both literal addresses and resolved hostnames.

gcve-1-2026-20287

Other fixes

• Reverse DNS (#886) — When no nameserver is configured, including when MISP sends an empty configuration object, the module now consistently uses its documented default resolver (8.8.8.8).
• GoAML export (#889) — Corrected a dictionary-name typo in export module introspection.
• PGP keyserver — More robust parsing of optional HKP index fields and non-critical extension packets.

Module usage statistics

A new per-module query statistics endpoint (#954) provides additional visibility into how individual modules are queried.

Upgrade notes

We recommend upgrading to v3.0.13, especially for deployments using html_to_markdown or the updated enrichment modules. When enabling new export or publishing integrations, review the target platform configuration and validate the generated output or publishing behavior before using it in production workflows.

Thanks to the contributors

Thank you to everyone who contributed new modules, fixes, testing, and reviews, including Alexandre Dulaunoy, Sami Mokaddem, elhoim, Jonas Lejon, and elakkuvan, as well as the broader MISP community.

MISP Modules is open source. Contributions, new integrations, bug reports, and feedback are always welcome: github.com/MISP/misp-modules.