In the SOCs( Security Operation Centers) we support across West Africa, we keep running into the same limitation: Wazuh detects abnormal behaviors, but it has no idea whether the IP, hash, or domain involved is known to be malicious. The analyst investigates blindly, wastes time on false positives, and sometimes misses confirmed threats that the global CTI community has already flagged hours earlier.
This is exactly where MISP (Malware Information Sharing Platform) changes the game. By integrating it with Wazuh, you transform a reactive SIEM into a context-aware detection platform, capable of correlating every local event with collective threat intelligence. In this article, we break down MISP’s added value, the types of indicators you can leverage, the technical integration with Wazuh, and five use cases we have deployed in the field.
Why MISP is the missing piece of your SOC
MISP is not just an “IoC database.” It’s a collaborative threat intelligence platform, maintained by CIRCL (Luxembourg) and used by more than 6,000 organizations worldwide, including national CSIRTs, banks, telecom operators, and many government agencies.
Its added value rests on four pillars that few commercial platforms offer simultaneously.
Structured and standardized sharing. MISP uses open standards (STIX 2, MISP format, OpenIOC) to exchange indicators with other instances. An organization can consume public feeds, receive alerts from sectoral partners, and contribute its own observations in return. This two-way circulation of intelligence is one of the most powerful levers against attackers who themselves pool their tools and tactics.
Context around every indicator. A standalone IoC (an IP, a hash) has limited value. MISP attaches each indicator to an event that describes the context: attack campaign, threat actor, targeted sector, TTPs (techniques, tactics, procedures) referenced in MITRE ATT&CK. This context is what allows an analyst to quickly qualify the severity of an alert.
Galaxies and taxonomies. MISP includes more than 70 galaxies (catalogs of APT groups, malware families, exploit kits) and dozens of taxonomies (TLP classifications, kill chain, confidence levels). These metadata enable fine-grained correlation, for example “alert if an IoC is associated with an active ransomware group and rated high confidence.”
A mature REST API. MISP exposes a complete and well-documented REST API. This is what makes integration with Wazuh or any other SIEM, EDR, or firewall not just possible, but truly industrializable.
The IoC types MISP makes actionable in Wazuh
The MISP-Wazuh integration is not limited to malicious IP addresses. That’s one of the reasons it’s so powerful: it lets you enrich a wide variety of events detected by Wazuh.
Here are the main indicator categories we leverage with our clients.
Network indicators. Source/destination IP addresses, CIDR ranges, domain names, full URLs, hostnames. These IoCs are matched against the connection logs sent by Wazuh agents, firewalls, and proxies. Typical case: detecting an outbound connection to a known command-and-control server.
File indicators. MD5, SHA1, SHA256, SHA512, imphash hashes. Wazuh has a FIM (File Integrity Monitoring) module that automatically calculates hashes of files created or modified on endpoints. Matching against MISP allows real-time identification of a malicious binary the moment it touches the disk.
Email indicators. Sender addresses, subjects, attachment hashes, and return addresses. Combined with a connector on the email gateway, they enable detection of ongoing targeted phishing campaigns.
System indicators. Mutex names, Windows registry keys, file paths, process names, Windows services. Particularly useful for detecting malware persistence on an endpoint via the Sysmon rules integrated into Wazuh.
Cryptographic indicators. SSL/TLS certificate fingerprints, code signatures, and PGP keys. They allow detection of encrypted traffic to malicious infrastructure, or a binary signed with a compromised certificate.
Behavioral indicators and TTPs. Beyond atomic IoCs, MISP references attack patterns linked to MITRE ATT&CK. Combined with Wazuh correlation rules, they enable behavioral detection that’s more resilient to attackers changing their infrastructure.
This diversity is the real added value: no matter where in the kill chain a threat manifests, network, file, email, or system, MISP provides the lens to read it.
Wazuh-MISP integration architecture
The architecture we deploy rests on a simple principle: Wazuh queries MISP in real time whenever an alert contains a potentially malicious indicator.
The flow works as follows:
- Wazuh agents deployed on endpoints and servers send their events (system logs, FIM, telemetry) to the Wazuh Manager.
- Network devices (firewalls, proxies, IDS) send their logs to the Manager via Syslog or dedicated decoders.
- When the Manager detects an event containing an exploitable IoC, the integrator module triggers a request to the MISP REST API.
- MISP responds in milliseconds: is the indicator known? Which event, actor, or malware family is it linked to?
- If there’s a positive match, Wazuh enriches the alert with CTI context and raises its severity.
- The enriched alert is indexed in the Wazuh Indexer, visualized in the dashboard, and can trigger an automated response via a SOAR (Shuffle, for example) or Wazuh Active Response.
On the MISP side, the platform continuously synchronizes with external CTI communities: CIRCL feeds, ANSSI, abuse.ch, sectoral partners, and private MISP instances shared between organizations. This ensures the indicator database stays fresh, a critical point, since IoC value degrades quickly.
Wazuh Active Response: from context to automated action
This is where the MISP-Wazuh integration takes on its full operational dimension. Detecting a threat is good. Responding to it automatically in seconds is what makes the difference between a contained incident and a major crisis.
Wazuh natively offers a mechanism called Active Response: a system that executes scripts or commands on agents or the manager whenever an alert exceeds a certain severity threshold or matches a specific rule. Block an IP at the firewall, disable a user account, isolate an endpoint from the network, kill a malicious process all of this is possible out of the box.
The problem, without MISP, is that Active Response relies entirely on the trust you place in your own detection rules. Automatically blocking an IP because it generated 10 connections in 5 minutes is risky: it could be legitimate behavior. As a result, many teams leave Active Response disabled or configured very conservatively, fearing false positives.
MISP fundamentally changes this equation. When CTI enrichment confirms that an IoC is associated with a known threat actor, an active ransomware family, or a C2 infrastructure documented by the global community, you’re no longer in doubt. You can trigger an automated response with a high level of confidence, and that’s what makes Active Response truly impactful.
In practice, here’s what this combination enables in the field.
Perimeter IP blocking. When a Wazuh agent detects an outbound connection to an IP, the integrator queries MISP. If the IP is referenced in an active event and rated high confidence, Active Response automatically pushes a blocking rule to the firewall (via the firewall API or via iptables/firewalld on the local agent). The connection is severed in less than 5 seconds, and every other machine attempting the same connection is immediately protected.
Compromised endpoint isolation. When the FIM module detects a new file whose hash matches a malware family referenced in MISP, Active Response can disconnect the host from the network (by disabling the agent’s network interface) while keeping the Wazuh agent running to allow investigation. The malware is neutralized before the analyst even receives the notification.
Malicious file quarantine. Rather than isolating the entire host, you can target the file: move the binary to a quarantine directory, remove execution permissions, and log its hash and path for investigation. Particularly useful on servers where you can’t afford a network disconnection.
User account disablement. If a MISP-enriched alert indicates that an account is being used from a compromised IP (for example, a VPN authenticated from a referenced Tor node), Active Response can revoke the active session and temporarily disable the account in Active Directory.
DNS-level domain blocking. When a malicious domain is detected in DNS logs and confirmed by MISP, Active Response can push a sinkhole rule to the internal DNS resolver, instantly protecting the entire estate.
The principle to remember is simple: MISP provides the confidence, Wazuh provides the action. Without MISP, Active Response stays timid to avoid false positives. With MISP, you can configure aggressive, automated responses on high-confidence IoCs while keeping more cautious responses (simple notification) for medium-confidence IoCs.
To calibrate this properly, I systematically recommend that my clients introduce a gradual rollout: start by activating Active Response in notification mode only (no actual action), observe for 2 to 4 weeks the relevance of triggers based on MISP enrichments, then progressively shift to blocking actions. This approach virtually eliminates the risk of disruptive false positives.
Operational and strategic benefits
Beyond the use cases, the integration produces measurable effects.
For operational teams, the signal-to-noise ratio improves significantly. On the deployments I’ve supported, teams report a notable reduction in time spent investigating false positives, and a rapid skill ramp-up for junior analysts who now have explicit context for every alert. Mean time to detect (MTTD) drops mechanically.
For management, the integration materializes a tangible cybersecurity investment. It transforms a “black box” SIEM into an active defense platform aligned with the real threats targeting the organization. It also facilitates compliance: being able to demonstrate that you consume and share threat intelligence is a strong argument during audits or maturity assessments (NIST CSF, ISO 27001, ITU-T X.1500).
For the community, MISP is not just a consumer of threat intelligence; it’s also a sharing platform. A sufficiently mature organization can contribute its own observations to sectoral or national communities. In the West African context where I work, this is particularly structural: pooling intelligence is one of the most effective levers for closing the capability gap against often transnational attackers.
Limitations and points of attention
The effectiveness of the Wazuh-MISP pairing depends directly on the quality of the CTI feeds consumed. A poorly fed MISP will generate noise or worse, false negatives. Source selection and scoring are a continuous effort, not an initial setup.
The integration also requires clear governance: who maintains the enrichment rules? Who reviews the playbooks? Who supervises the health of the MISP instance? Without this governance, the tool drifts and loses its value within months.
Finally, Wazuh and MISP are active open-source projects: you need to plan for ongoing updates and monitoring to keep up with both platforms’ evolution, particularly API changes.
Integrating MISP with Wazuh is not just about adding a technical brick to a SIEM. It’s about moving a SOC from a defensive posture reacting to alerts to a proactive posture, where every event is read in light of the collective intelligence on threats. The diversity of exploitable IoCs, the richness of the CTI context provided by MISP, and the maturity of its API make it, in my view, one of the most cost-effective integrations a SOC can deploy today.