zsazsa is a CTI program management and production platform built around MISP. It links collection, triage, analyst workflows, requirement management, publishing and stakeholder delivery in one place, rather than as loose documents and disconnected scripts.
Analysts move from collection to published output, align their work to PIR and GIR priorities, distribute with channel and TLP controls, and use stakeholder feedback to track how the program matures over time.
Active PIRs and GIRs, stakeholder counts, analyser pipeline freshness, 24-hour processing outcomes and pending scraper events awaiting analysis.
Roles, organisations, TLP clearance, per-product subscription modes and notification channel preferences, so distribution matches real organisational needs.
Full PIR and GIR lifecycle editing with decision context, priority, scope and ownership. Scope fields sync with focus points and MISP galaxies.
A cached view of scraper and additional MISP servers. Browse events, refresh, flag for follow-up, import newsletters and generate LLM summaries back into MISP.
Flash Intel Alerts, vulnerability advisories, daily threat briefings and threat landscape reports, each with draft, review, approval and publish flows.
Pipeline and program metrics plus a CTI-CMM maturity signal panel across five domains, mapping observable indicators to CTI0 to CTI3 levels.
Distribution is built around stakeholders, roles, product subscriptions, audiences and notification channels. A stakeholder receives a product only when their role is in the audience, they're subscribed to that product type, and their TLP clearance is high enough.
zsazsa keeps its data in MISP, using events, object templates, attributes and event reports. Each record is one MISP event, with its data held inside a custom object, so teams can open and check the raw records directly in MISP whenever they need to.
All zsazsa: tags are applied as local tags, so they never sync to connected MISP instances. Your program data stays in your own MISP and every record stays easy to trace.
zsazsa is open source and runs on top of your existing MISP servers. Clone it, point it at your servers, and start producing intelligence.