zsazsa is a CTI program management and production platform built around MISP. It links collection, triage, analyst workflows, requirement management, publishing and stakeholder delivery in one place, rather than as loose documents and disconnected scripts.
Analysts move from collection to published output, align their work to PIR and GIR priorities, distribute with channel and TLP controls, and use stakeholder feedback to track how the program matures over time.
Active PIRs and GIRs, stakeholder counts, analyser pipeline freshness, and pending scraper events awaiting analysis.
Roles, organisations, TLP clearance, per-product subscription modes and notification channel preferences, so distribution matches real organisational needs.
Full PIR and GIR lifecycle editing with decision context, priority, scope and ownership. Scope fields sync with focus points and MISP galaxies.
A cached view of scraper and additional MISP servers. Browse events, refresh, flag for follow-up, import newsletters such as the ETDA CTI robot by paste or automatically over IMAP, and generate LLM summaries back into MISP.
Flash intel alerts, vulnerability advisories, daily threat briefings, threat landscape reports, indicator feeds and threat actor profiles, each with draft, review, approval and publish flows.
Pipeline and program statistics plus a CTI-CMM maturity metrics across five domains.
Distribution is built around stakeholders, roles, product subscriptions, audiences and notification channels. A stakeholder receives a product only when their role is in the audience, they're subscribed to that product type, and their TLP clearance is high enough.
zsazsa keeps its data in MISP, using events, object templates, attributes and event reports. Each record is one MISP event, with its data held inside a custom object, so teams can open and check the raw records directly in MISP whenever they need to, or use the MISP event history for a log of recent changes.
All zsazsa: tags are applied as local tags, so they never sync to connected MISP instances. Your program data stays in your own MISP and every record stays easy to trace.
zsazsa is open source and runs on top of your existing MISP servers. Clone it, point it at your servers, and start producing intelligence.