# MISP and OpenCTI Workflows

> Model, curate and share intelligence in MISP and OpenCTI without leaking data or flooding consumers with noise.

Canonical: https://codelivly.com/rooms/cti-misp-and-opencti-workflows
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Prepare analysts to work in the two open-source platforms most often found in sharing communities, MISP and OpenCTI, and to apply a tool-neutral curation discipline in any threat intelligence platform.

**Prerequisites.** Modules 1 and 2 of this path. Familiarity with indicator types and TLP.

**Outcomes.** By the end of the module you can:
- read and build MISP events, attributes, objects, tags and galaxy clusters, and set to_ids deliberately
- choose MISP distribution levels and sharing groups and align them with TLP
- explain OpenCTI's STIX 2.1 based model, observables versus indicators, connector types and indicator decay
- run a curation workflow and anticipate what is lost when converting between MISP and STIX

**Practical completion objective.** In the lab, triage a synthetic MISP event export against a warninglist and a sharing decision, and submit a pre-publication triage note with distribution and TLP decisions.

## Lessons

1. The MISP Data Model: Events, Attributes, Objects and Context (15 min)
2. MISP Distribution, Sharing Groups and Publishing (15 min)
3. OpenCTI: A STIX 2.1 Knowledge Graph in Practice (15 min)
4. Curating Intelligence in a Threat Intelligence Platform (15 min)
5. Lab: Triage a MISP Event Before Sharing (45 min)

## Related

- [Learning path: Threat Intelligence Operations and Sharing](https://codelivly.com/learning-paths/cti-operations-and-sharing)
- [All rooms](https://codelivly.com/rooms)