MISP Project

CTI Transmute

CTI-Transmute is a tool for converting Cyber Threat Intelligence (CTI) data between MISP and STIX formats. It provides a set of API endpoints that allow automated conversion of data, making it easier to integrate different threat intelligence platforms and workflows. This project is maintained by the MISP Project community and aims to standardize CTI data exchange.

Recent Public Conversions View all

Loading…

No public conversions yet.

[[ item.name ]]

[[ item.description ]]

[[ item.author || 'Anonymous' ]] [[ formatDate(item.created_at) ]]

API Endpoints

Click a card to navigate to the corresponding conversion page, or use the endpoints directly via API.

MISP to STIX POST

Convert a MISP event collection into STIX 2.0 or 2.1 bundle format.

STIX to MISP POST

Import a STIX bundle and convert it back into MISP event format.

List Converters GET

Browse all available conversion operations and their accepted parameters.

Demo

Watch a walkthrough of CTI-Transmute covering the main features and usage.

CTI-Transmute demo video

Presentation given at FIRST-CTI 2026 in Munich about this tool.

Open Source

Maintained by the MISP Project community

REST API

Automate conversions via simple HTTP endpoints

Standards

STIX 2.0 & 2.1 · MISP Standard Format