A plugin to enable threatbus communication with MISP.

MISP, zeromq, zmq, kafka, threatbus, Threat, Bus, intelligence, TI, dissemination, cif, cif3, ids, opencti, opencti-connector, sightings, threat-bus, threat-hunting, threat-intelligence, threat-intelligence-data, threatintel, zeek
pip install threatbus-misp==2021.8.26


Threat Bus

The missing tool to interconnect open-source security applications.

PyPI Status Build Status Total alerts Language grade: Python Development Status Latest Release License

Getting StartedContributing GuidelinesWriting PluginsLicense

Key Features

  • Connect Open-Source Security Tools: Threat Bus is a pub-sub broker for threat intelligence data. With Threat Bus you can seamlessly integrate MISP intelligence with the Zeek intel framework or report sightings from IDS deployments to some data base.

  • Plugin-based Architecture: The project is plugin-based and can be extended easily. We welcome contributions to adopt new open source tools!

  • Snapshotting: The snapshot feature allows subscribers to directly request threat intelligence data for a certain time range from other applications. Threat Bus handles the point-to-point communication of all involved apps.

Getting Started

Start Threat Bus

venv/bin/threatbus -c config.yaml

Start Zeek as Threat Bus App

zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek

Start Zeek and request a Snapshot

zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek -- "Tenzir::snapshot_intel=-30 days"


Install threatbus and all plugins that you require. Optionally, use a virtual environment.

virtualenv venv           # optional
source venv/bin/activate  # optional
pip install threatbus
pip install threatbus-inmem
pip install threatbus-misp
pip install threatbus-zeek
pip install threatbus-<plugin_name>


Use the Makefile to run unit and integration tests.

make unit-tests
make integration-tests

The integration tests require a local Zeek installation.

Plugin Development

Setup a virtual environment and install threatbus and some plugins with the --editable flag:

virtualenv venv
source venv/bin/activate
pip install --editable .
pip install --editable plugins/backbones/threatbus-inmem
pip install --editable plugins/<desired-plugins>

Configuration & Extension

A plugin must define a setup.py. Whenever a plugin is installed, you have to add a corresponding configuration section to threatbus' config.yaml. That section has to be named after the name in the entrypoint declaration of the plugin's setup.py file.

Please adhere to the plugin naming conventions and always prefix your plugin name with threatbus-.

Plugins can either be apps or backbones. Application plugins (apps) add new functionality to threatbus and allow communication to a threat-intelligence-enabled app (e.g., Zeek or Suricata). Backbone plugins add a new storage and distribution backend to threatbus (e.g., in-memory or Kafka).


  • plugin folder structure:
    ├── apps
    |   └── threatbus-zeek
    │       ├── setup.py
    |       └── threatbus_zeek.py
    └── backbones
        └── threatbus-inmem
            ├── setup.py
            └── threatbus_inmem.py
  • setup.py
    from setuptools import setup
      entry_points={"threatbus.app": ["myapp = threatbus_myapp"]},
  • config.yaml entry for threatbus

Threat Bus API

Plugins specifications are available in threatbus/appspecs.py and threatbus/backbonespecs.py, respectively. For any plugin, you should at least implement the run function.

App plugins are provided two callback functions to use for subscription management. Internally, Threat Bus will propagate subscription requests to all installed backbone plugins.

The subscription callback allows applications to request an optinal snapshot time delta. Threat Bus will forward snapshot requests to all those apps that have implemented the snapshot feature (see threatbus/appspecs.py).


Threat Bus comes with a 3-clause BSD license.