MirrorNest
← All guides

MISP

MISP is a threat intelligence platform for storing, correlating, and sharing indicators of compromise between organizations and analysts, distributed as an official production-ready Docker Compose stack.

Target: Any Docker hostSecurityThreat IntelligenceOfficial homepage ↗Official docs ↗
This guide is synthesized from MISP's own official documentation, linked above — always cross-check exact package/version names there before running these commands on a production server, since distro and project versions move over time.

  1. 1Clone the official misp-docker repository

    git clone https://github.com/MISP/misp-docker.git
    cd misp-docker

  2. 2Prepare the environment file

    cp template.env .env

    Customize .env (base URL, admin email, etc.) before starting the stack.

  3. 3Pull and start the stack

    docker compose pull
    docker compose up -d

    Requires Docker Engine 25+ (or Podman 4.9+) and Compose plugin 2.17+.

  4. 4Log in and change the default password immediately

    The stack ships with a well-known default admin account that must be rotated right away.

    Open http://localhost — default login is [email protected] / admin.