---
title: MISP
description: Collect MISP Threat Intelligence Data for Cloud SIEM
breadcrumbs: Docs > Integrations > MISP
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# MISP
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}
  MISP Dashboard IntroMISP Geographic Intelligence
## Overview{% #overview %}

The MISP integration for Datadog enriches your security logs with threat intelligence data from MISP, providing context for faster triage. This integration connects Datadog with your MISP instance to automatically pull and analyze key indicators including IPs, hashes, and domains.

Datadog ingests the threats, enabling deeper visibility into potential risks within your environment. You can correlate this data with logs, metrics, and Cloud SIEM alerts to identify and respond to malicious activity faster.

**Note:** You must enable [Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem.md) on your Datadog account to use this integration.

This integration includes:

- **Threat Intelligence Feeds:** Import IP, hash, and domain risk lists directly into Datadog for continuous enrichment.
- **Cloud SIEM Correlation:** Combine MISP intelligence with Datadog logs to detect and prioritize threats.

## Setup{% #setup %}

### Overview{% #overview-1 %}

The MISP integration forwards threat indicators from a self-hosted [MISP](https://www.misp-project.org/) instance into Datadog's Threat Intelligence catalog, where they can be matched against your logs, traces, and security signals.

A lightweight connector runs **inside your environment**, alongside MISP. It polls MISP's REST API for new, updated, and deleted indicators (IPs, domains, and file hashes), transforms them into Datadog's expected format, and pushes them to the Datadog Threat Intelligence API. No inbound network access to MISP is required.

### Prerequisites{% #prerequisites %}

- A running MISP instance with the REST API enabled, reachable from the host that will run the connector.
- A Datadog API key and application key with permission to write to Reference Tables.
- Docker 20.10+ (or Docker Compose v2+) on the host that will run the connector.

### Step 1: Get a MISP API key{% #step-1-get-a-misp-api-key %}

The connector authenticates to MISP with an API key (also called an `Authkey`).

1. Log in to your MISP web UI as the user the connector should impersonate. Datadog recommends using a dedicated read-only user.
1. Go to **Administration > List Auth Keys** (or **My Profile > Auth keys** for non-admin users).
1. Click **Add authentication key**, choose the user, set an optional comment (for example, `Datadog connector`).
1. Click **Submit** and copy the generated key. MISP only displays it once.

Verify the key:

```bash
curl -H "Authorization: <your-misp-api-key>" \
     -H "Accept: application/json" \
     https://<your-misp-instance>/users/view/me
```

A `200 OK` response confirms the key is valid.

### Step 2: Get your Datadog keys{% #step-2-get-your-datadog-keys %}

1. In Datadog, go to **Organization Settings > API Keys** and copy (or create) an API key.
1. Go to **Organization Settings > Application Keys** and copy (or create) an application key. The application key must belong to a user with the `reference_tables_write` permission.

### Step 3: Run the connector{% #step-3-run-the-connector %}

The connector is published on Docker Hub at [datadog/misp-threat-intel-connector](https://hub.docker.com/r/datadog/misp-threat-intel-connector). You can run it directly with `docker run`, or with Docker Compose using the snippet below.

**Option A: `docker run`**

```bash
docker run -d --restart unless-stopped \
  --name misp-threat-intel-connector \
  -e MISP_URL=https://your-misp-instance \
  -e MISP_API_KEY=your-misp-api-key \
  -e DATADOG_API_URL=https://api.datadoghq.com/api/v2/security/threat-intel-feed \
  -e DATADOG_API_KEY=your-datadog-api-key \
  -e DATADOG_APP_KEY=your-datadog-app-key \
  -v checkpoint_data:/opt/connector/data \
  datadog/misp-threat-intel-connector:latest
```

**Option B: Docker Compose**

1. Create a `docker-compose.yml` file:

   ```yaml
   services:
     connector-misp-threat-intel:
       image: datadog/misp-threat-intel-connector:latest
       restart: unless-stopped
       env_file: .env
       volumes:
         - checkpoint_data:/opt/connector/data
   
   volumes:
     checkpoint_data:
   ```

1. Create a `.env` file next to it with your settings:

   ```bash
   cat > .env <<'EOF'
   MISP_URL=https://your-misp-instance
   MISP_API_KEY=your-misp-api-key
   DATADOG_API_URL=https://api.datadoghq.com/api/v2/security/threat-intel-feed
   DATADOG_API_KEY=your-datadog-api-key
   DATADOG_APP_KEY=your-datadog-app-key
   EOF
   ```

1. Start the connector:

   ```bash
   docker compose up -d
   ```

The connector runs an initial sync immediately, then continues every 15 minutes. A Docker volume (`checkpoint_data`) persists the sync checkpoint so syncs resume after restarts.

### Configuration: MISP connection{% #configuration-misp-connection %}

| Variable          | Required | Default | Description                                                                                                                                                  |
| ----------------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `MISP_URL`        | Yes      | (none)  | Base URL of your MISP instance, for example, `https://misp.local`.                                                                                      |
| `MISP_API_KEY`    | Yes      | (none)  | MISP REST API authentication key (see Step 1).                                                                                                               |
| `MISP_SSL_VERIFY` | No       | `true`  | Whether to verify the TLS certificate served by MISP. Set to `false` only if MISP uses a self-signed certificate.                                  |
| `MISP_TAGS`       | No       | (none)  | JSON list of MISP tags to filter events by. Only events tagged with at least one of these will be exported. Example: `["tlp:white", "datadog:export"]`. |
| `MISP_PAGE_SIZE`  | No       | `1000`  | Number of events fetched per page from the MISP REST API. Lower this on very large instances if you hit memory or timeout limits.                            |

### Configuration: Datadog connection{% #configuration-datadog-connection %}

| Variable          | Required | Default | Description                                                                                                                                                                                                                   |
| ----------------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DATADOG_API_URL` | Yes      | (none)  | Threat Intelligence API endpoint for your Datadog site. Use `https://api.datadoghq.com/api/v2/security/threat-intel-feed` for US1, or substitute your site domain (`datadoghq.eu`, `us3.datadoghq.com`, etc.). |
| `DATADOG_API_KEY` | Yes      | (none)  | Datadog API key.                                                                                                                                                                                                              |
| `DATADOG_APP_KEY` | Yes      | (none)  | Datadog application key.                                                                                                                                                                                                      |

### Configuration: Threat intent mapping{% #configuration-threat-intent-mapping %}

MISP does not expose a built-in indicator intent (benign / suspicious / malicious). The connector maps any MISP label you choose to a Datadog intent level. Each variable accepts a JSON list of exact label strings.

| Variable                           | Required | Description                                               |
| ---------------------------------- | -------- | --------------------------------------------------------- |
| `DATADOG_THREAT_INTENT_BENIGN`     | No       | MISP labels that should be exported as `benign`.     |
| `DATADOG_THREAT_INTENT_SUSPICIOUS` | No       | MISP labels that should be exported as `suspicious`. |
| `DATADOG_THREAT_INTENT_MALICIOUS`  | No       | MISP labels that should be exported as `malicious`.  |

Example:

```bash
DATADOG_THREAT_INTENT_BENIGN='["misp:threat-level=\"low-risk\""]'
DATADOG_THREAT_INTENT_SUSPICIOUS='["misp:threat-level=\"medium-risk\""]'
DATADOG_THREAT_INTENT_MALICIOUS='["misp:threat-level=\"high-risk\""]'
```

Indicators with no matching label default to `suspicious`. When an indicator matches multiple levels, the highest one takes precedence (`benign` < `suspicious` < `malicious`).

### Configuration: Connector options{% #configuration-connector-options %}

| Variable          | Required | Default                               | Description                                                                                                          |
| ----------------- | -------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `CHECKPOINT_PATH` | No       | `/opt/connector/data/checkpoint.json` | Path inside the container where sync checkpoints are persisted. Must reside on a mounted volume to survive restarts. |
| `LOG_LEVEL`       | No       | `INFO`                                | Log verbosity. One of `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`.                      |

### Validation{% #validation %}

After starting the connector, check the container logs:

```bash
docker compose logs -f connector-misp-threat-intel
```

Look for log lines confirming the connector is fetching events from MISP and pushing batches to Datadog. Within a few minutes, the imported indicators appear in Datadog under **Security > Threat Intelligence** with the source set to `misp`.

### Troubleshooting{% #troubleshooting %}

- **`401 Unauthorized` from MISP**: The API key is invalid, expired, or belongs to a disabled user. Generate a new key from the MISP web UI.
- **`401` or `403` from Datadog**: The API or application key is missing the Reference Tables write permission. Verify the application key's owner has the right role.
- **TLS errors on connection to MISP**: Set `MISP_SSL_VERIFY=false` if MISP uses a self-signed certificate, or install the certificate's CA into the container.
- **No indicators appear in Datadog**: Confirm that events in MISP carry the indicator types the connector exports (`ip-dst`, `ip-src`, `domain`, `sha256`, `md5`) and, if `MISP_TAGS` is set, that they carry one of the required tags.

## Uninstallation{% #uninstallation %}

To uninstall the MISP integration:

1. In Datadog, navigate to **Integrations**, select the MISP tile, and click **Uninstall Integration**.
1. Delete all associated MISP accounts in Datadog.
1. Out-of-the-box (OOTB) assets are automatically removed.
1. If you cloned or customized any assets, delete those manually.

Once this integration has been uninstalled, any previous authorizations are revoked. Make sure that all API keys associated with this integration have been disabled by searching for "MISP" on the **API Keys** page.

## Support{% #support %}

Need help? Contact [Datadog Support](https://app.datadoghq.com/help).