MISP Modules v3.1.2 Released: More Enrichment, More Automation, and a Better Analyst Experience

We are pleased to announce MISP Modules v3.1.2, a substantial update to the ecosystem of integrations powering enrichment, import, export, and automated workflows in MISP.

This release expands what analysts can do directly from MISP: pivot on infrastructure and vulnerabilities, investigate suspicious files, import additional evidence formats, generate operational outputs, and trigger actions across external services. It also brings a redesigned MISP Modules web interface, improved support for MISP 3.0, optional query caching, and important security hardening.

The release includes 20 module additions or new module capabilities, 13 major feature expansions to existing integrations, and numerous reliability and security fixes. The tables below distinguish new additions from enhancements to existing modules.

New modules and module capabilities

The following additions cover everything from quick OSINT pivots to malware analysis, network evidence processing, export, and automated response.

Module or capability	Type	What it adds
DMARC aggregate report	Import	Imports DMARC aggregate reports into MISP for analysis of email authentication reporting data.
PCAP	Import	Extracts files, email-related information, and network indicators from packet captures, using TShark.
Legacy OpenIOC import	Import enhancement	Provides a legacy OpenIOC import path with native MISP output, supporting MISP 3.0 migration.
CCCS YARA metadata validator	Validation	Validates YARA rule metadata against the Canadian Centre for Cyber Security (CCCS) conventions.
DuckDuckGo Search	Expansion	Adds a search-based OSINT pivot as an alternative to Google Search, without requiring an API key.
NetAPI Lookup	Expansion	Enriches domains with compromised-feed listings, Top 1M ranking information, and a structured reputation object.
Offline phone-number information	Expansion	Provides phone-number information without a remote lookup service.
MobSF	Expansion	Connects MISP to Mobile Security Framework analysis for mobile application investigations.
geoPlugin	Expansion	Adds IP geolocation enrichment using geoPlugin.
RIPEstat	Expansion	Adds infrastructure and network-related pivots through the RIPEstat API.
MWDB hash query	Expansion	Looks up file hashes in MWDB to support malware investigations.
Manalyze	Expansion	Performs local PE analysis on attachments and malware samples.
URL shortener resolution	Expansion	Resolves shortened URLs, using IDNA2008 hostname normalization.
binGraph	Expansion	Produces binary visualizations for attachments and malware samples.
FIRST EPSS	Expansion	Retrieves EPSS intelligence directly for vulnerability-related analysis.
Pandora file submission	Submission	Adds configurable file submission to Pandora for further analysis.
BPF capture filter	Export	Generates packet capture filters for tcpdump and libpcap.
Generic CSV	Export	Adds a generic CSV export format, also available through web result downloads.
Signal	Workflow action	Enables Signal messaging actions in MISP workflows.
IRC	Workflow action	Enables IRC messaging actions in MISP workflows.

The OpenIOC entry is a newly added import path for an existing format, rather than a claim that OpenIOC itself is new. NetAPI enrichment is domain-only in this release; IP attributes are not supported by that module.

Major enhancements to existing modules

New modules are only part of the story. Version 3.1.2 also extends existing integrations, making them more useful for investigation and response workflows.

Existing module	New or expanded functionality
dnstwist	Domain permutation enrichment for identifying related and lookalike domains.
Censys Enrichment APIs	Additional Censys enrichment API support.
DomainTools	Iris enrichment adapters using the provider reference, with clarified API coverage and support documentation.
ESET reports	Retrieval of threat intelligence PDF reports, represented as MISP report objects.
FortiSandbox	Hash ratings and sample submission support.
Doppel	Alert and takedown workflow actions.
GLIMPS Malware	Analysis lookups and sample submission support.
CAPE Sandbox	Sample submission and sandbox report enrichment.
Triage	Retrieval of existing sandbox analysis reports.
GreyNoise Vulnerability	Dedicated CVE intelligence lookups.
DNSlytics	Domain dataset search capabilities.
Criminal IP	IP and domain report enrichment.
ANY.RUN	Additional threat intelligence lookup capabilities.

These integrations broaden the paths available to an analyst: a domain can lead to infrastructure relationships, a file can lead to sandbox results, and a vulnerability can be enriched with exploitation-related intelligence—all without manually moving data between tools.

A redesigned web interface for MISP Modules

The MISP Modules website receives significant attention in this release, with a more guided experience and styling aligned with MISP 3.0.

Key additions include:

• Guided enrichment workspace: a redesigned interface for exploring enrichment results and configuring modules.
• Improved investigation history: investigation trees and sessions are presented as clearer, connected paths.
• More readable results: updated MISP branding and visual enrichment result cards.
• Import module workflows: import modules can now be tested and executed through the website.
• Export module workflows: website support for exports, including result downloads and an OSINT feed input.
• Safer exported results: embedded credentials are replaced with placeholders.
• More robust configuration: fixes for external-tool API key schema upgrades, login form state, and Flask 3.0 import limits.

The goal is to make MISP Modules useful not just as a backend service but also as a practical investigation environment for analysts testing enrichments, examining results, and following pivots.

New controls for enrichment and deployment

Optional per-module query caching. Administrators can opt in to caching module query results, reducing repeated work for suitable lookups.

Server-local module configuration defaults. Operators can provide optional local defaults, simplifying configuration in deployments where the same settings are reused.

Better documentation for custom modules. Updated guidance explains how custom modules are discovered, loaded, and enabled in MISP. Documentation also covers systemd environment setup for the legacy Redis cache.

Better handling of real-world investigation data

Several improvements focus on preserving context and turning raw data into useful MISP objects:

• Inline forwarded emails: optional heuristic extraction of forwarded messages from plain text and Outlook-style HTML, with linked email objects, preservation of the original carrier as evidence, and reconstructed attributes marked for review.
• IPinfo: support for current Lite and Core/Plus API endpoints alongside legacy configurations; privacy, abuse, and company context is retained in referenced annotations.
• Have I Been Pwned: enrichment support is enabled and API requests are hardened.
• CrowdSec CTI: corrected classification mapping, preservation of background-noise scores including zero, and more resilient API handling.
• Farsight passive DNS: improved SOA contact extraction using the public suffix list, with invalid derived email addresses rejected while raw records remain available.
• Cytomic Orion: first_seen is populated on objects to improve timeline analysis.
• Local GeoIP: improved configuration and loading of local geolocation databases.
• Email parsing: forwarded URL objects are reused, folded headers are accepted, and bracketed subject metadata is preserved.

Security and reliability improvements

Security hardening is a major part of v3.1.2, not an afterthought.

Server-side request forgery protection

The sourcecache module now validates URLs before archiving them. It restricts fetching to HTTP and HTTPS hosts that resolve exclusively to globally routable addresses and rejects malformed or ambiguous URLs. Additional checks cover IPv6, IPv4-mapped addresses, NAT64, 6to4, and hostnames resolving to internal addresses. These changes address server-side request forgery (SSRF) risks, including access to loopback and cloud metadata endpoints.

Cross-site request forgery protection

Website operations that change module status or delete investigation history now require POST requests with CSRF tokens, rather than state-changing GET requests.

More predictable errors and exports

• backscatter_io now accepts ip-dst-only lookups and rejects requests with no IP value.
• iprep reports missing API keys instead of failing unexpectedly or issuing invalid requests.
• eql returns a clear unsupported-attribute error instead of crashing.
• qintel_qsentry and yeti tolerate responses without tags.
• AssemblyLine, X-Force Exchange, and Signal workflow actions handle failed or partial responses more reliably.
• CEF exports correctly apply defaults when MISP sends unset settings as null.
• YARA exports handle combined attributes and malware samples correctly.
• Mass EQL exports generate separate, properly escaped queries.
• ThreatConnect exports handle composite ip|port and filename|md5 values without failing the whole export.
• MWDB submissions receive additional validation, and module and website dependencies have been refreshed.

Why this release matters

MISP Modules is increasingly more than a catalogue of enrichment endpoints. It connects threat intelligence, evidence processing, analysis tools, and operational actions in a common ecosystem.

With v3.1.2, analysts gain more ways to start from an observable and move toward useful context: infrastructure intelligence from RIPEstat or Censys; vulnerability insight from FIRST EPSS or GreyNoise; file analysis through Manalyze, MobSF, Pandora, or sandbox integrations; and automated follow-up through workflow actions. New import and export capabilities make it easier to bring evidence into MISP and turn investigation results into operational artifacts.

Together with the redesigned web interface and MISP 3.0-oriented improvements, this release continues the effort to make integrations easier to discover, safer to operate, and more directly usable during an investigation.

Get MISP Modules v3.1.2

• Source code: https://github.com/MISP/misp-modules
• Project website: https://www.misp-project.org/

Thanks to everyone who contributed features, bug reports, reviews, tests, and fixes to this release, including Slava Olesik, Andrei Bacescu, elhoim, and the wider MISP community.

MISP Modules v3.1.2 is another step toward a more connected, analyst-friendly, and extensible open-source threat intelligence ecosystem.