Why CTI-Transmute?

Bridge the gap between
MISPMISP and STIX

Cyber Threat Intelligence lives in many formats. CTI-Transmute is the open-source tool that makes MISP and STIX speak the same language — instantly, reliably, and for free.

Start Converting
View on GitHub
The Problem
MISP and STIX are the two dominant CTI standards — but they don't talk to each other natively, forcing teams to write fragile custom scripts or lose data in manual re-entry.
The Solution
CTI-Transmute provides a battle-tested, community-maintained conversion engine exposed as a simple REST API and web interface — no scripts, no data loss.
How It Works

Three steps. No setup required.

01

Paste or upload your JSON

Drop in a raw MISP event or a STIX bundle — from a file, clipboard, or live MISP instance via the API.

02

Choose your direction

Select MISP → STIX or the reverse. Pick the STIX version (2.0 or 2.1) when converting from MISP.

03

Get your result instantly

Download the converted JSON, push it to MISP, share it publicly, or keep it private in your history.

Key Features

Everything a threat intelligence team needs, out of the box.

Open Source

Maintained by the MISP Project community. Transparent, auditable, and free forever. Contributions welcome.

Standards Compliant

Full support for STIX 2.0 and 2.1, and the official MISP standard format — no proprietary extensions.

REST API

Automate conversions at scale. Integrate CTI-Transmute into your SOAR, pipeline, or custom tooling with simple HTTP calls.

MISP Taxonomy Tags

Over 12 000 MISP taxonomy tags available. Tag your converts, auto-detect tags from JSON, and push them back to MISP.

Collaborative Evaluation

Rate converts on accuracy, quality, and completeness. Community consensus tags surface the best-validated intelligence.

History & Sharing

Every conversion is saved. Share publicly with the community or keep it private. Browse, search, and revisit past work.

Who It's For

SOC Analysts

Ingest STIX bundles from threat feeds directly into MISP, or export MISP events to share with partners who use STIX — without touching a single line of code.

STIX → MISP

Threat Intel Teams

Standardise your CTI output across teams and tools. Evaluate conversion quality collaboratively and maintain a searchable history of all your conversions.

Browse history

Platform Developers

Integrate bidirectional MISP ↔ STIX conversion into your platform via the REST API. Simple HTTP endpoints, JSON in, JSON out.

API docs

Ready to convert?

Free, open-source, and running right now. No account required to try it out.

Start Converting
Back to Home