Compare
Keep MISP. We are the layer above it, not a replacement.
MISP is the standard, and every CERT and ISAC you work with speaks it. Wahukeza ingests MISP feeds, publishes one, and adds the things MISP does not try to be: sensors, scoring, enforcement and tenancy.
Side by side
Different jobs, one standard.
Claims about MISP reflect its public documentation as of September 2026. Corrections welcome.
| MISP | Wahukeza | |
|---|---|---|
| What it is | The open standard and reference platform for sharing threat information; the lingua franca of CERTs and ISACs. | An operating layer above the standard: collection, correlation, enforcement and tenancy, with MISP feeds in and out. |
| Relationship | - | Interoperate, don’t compete. Ingest any MISP feed; publish a MISP feed any instance can pull; sharing groups push and pull over the MISP REST API, mapped to MISP sharing groups. Keep your MISP. |
| Multi-tenancy | Organisations and sharing groups within one instance; per-client isolation typically means per-client instances. | Database per tenant with a control plane and per-tenant jobs. |
| Operations | Frequent releases; production hosting is a real infrastructure project; upgrades are the recurring cost. | Compose or Helm, a migration runner, signed images with SBOMs; or a tenant on Wahukeza-operated instances. |
| First-party collection | None built in; events come from members and feeds. | Deception Fabric, Endpoint Intelligence, Phishing Reporting, customer scam reports, sightings, artifact pipeline. |
| Scoring | Attribute-level tags, sightings and decaying models by configuration. | Confidence and severity recomputed from source grade, recency, relations, honeypot activity and edge sightings, with an explainable ML triage model on top in Advanced AI Intelligence. |
| Enforcement output | Exports in many formats; enforcement delegated to modules and scripts. | Vendor-native blocklists with ETag polling and a sightings API closing the loop. |
| Standards | MISP format; STIX import/export. | STIX 2.1-native model, TAXII 2.1 server and client, a TAXII 2.1 inbox for sharing groups, MISP feed both ways, MISP REST push/pull. |
| Commercial | Free; hosted offerings from third parties by subscription. | Four packages, modules individually, unlimited analysts; quote after a scoping workshop. |
Together
How the two run side by side.
MispFeedClient
MISP → Wahukeza
Point a connector at any MISP feed. Events become indicators through the write path, graded and licensed like every other source.
GET /api/misp/feed
Wahukeza → MISP
Your MISP pulls our feed (including the first-party feed) as a manifest and events, scoped by API key tier.
MISP REST
Sharing groups, both ways
A sector sharing group pushes to and pulls from a MISP instance over its REST API, mapped to MISP sharing groups, with TLP and expiry per observable.
TAXII 2.1
Or over TAXII
Collections in either direction, and a TAXII 2.1 inbox where group members can contribute, if that is how your sharing community is wired.
Connect your MISP in the demo.
Bring the URL of a MISP feed you already consume; we will show it graded, correlated with a sensor, and served back as a blocklist.