Innomerc Choose your depth. Learn at your own pace.
Understand it
A MISP event groups information about a topic or investigation. An attribute is a typed value, such as a domain. An object groups attributes that describe a more complex entity, such as a file or an email.
An email’s sender, subject and attachment belong together. If you flatten them into unrelated values, another analyst may lose the relationship that made the observation useful. Structure helps preserve that meaning.
Under the hood
Attribute types tell tools how to interpret values. Object templates define related fields and their roles. Event metadata, comments and references add context that a raw value cannot carry. Stable identifiers help integrations update the right record rather than creating duplicates.
Tags can use taxonomies to express consistent machine-readable labels. Galaxies connect events or attributes to richer concepts. These labels support interpretation, but a threat-actor tag is an analytical assertion that needs evidence, not a fact created by selecting a name.
Practitioner perspective
Define modeling conventions for the team and validate incoming feeds against them. Separate source observations from analyst judgments. Preserve original evidence references while writing concise, shareable context for consumers.
When exporting to another format such as STIX, check which semantics survive conversion. A successful file conversion does not prove that every object relationship, distribution rule or confidence statement was preserved.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Event
Create context for the fictional investigation.
Read every step without animation
Model an email observation
- Event. Create context for the fictional investigation.
- Email object. Group fields that describe the same message.
- Typed attributes. Represent sender, subject and related values with their roles.
- Context labels. Add justified taxonomy and confidence information.
- Consumer. Another analyst receives structure rather than isolated strings.
The relationship between values is part of the intelligence.
Attack view
Poorly modeled intelligence can make an unrelated value look malicious or hide the relationship that made it suspicious. The risk here is analytical error and unsafe downstream action.
Defender view
- Use typed attributes and suitable object templates.
- Document confidence, provenance and relationship meaning.
- Test exports with representative objects before automating consumption.
Common mistakes
- An event is not merely a bag of unrelated IOCs.
- Adding a galaxy label does not establish attribution.
Check your understanding
Active recall: explain this idea in 30 seconds
A MISP event groups information about a topic or investigation. An attribute is a typed value, such as a domain. An object groups attributes that describe a more complex entity, such as a file or an email.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.