From Intel to Action: Building a High-Speed Early Warning System with MISP and AI

Actionable intelligence is only as good as your ability to share it — quickly, reliably, and with the right context. In this talk, we’ll explore how MISP can be used not just as a threat intel repository, but as a powerful engine for real-time collaboration and operational impact.

We’ll cover how to make MISP highly available, build and sustain a community around it, and create qualitative events that provide the necessary context for detection, decision-making, and response. You’ll also see how we’re integrating AI into our workflows to improve speed, reduce manual effort, and enrich intelligence automatically — without sacrificing quality.

Whether you’re just getting started with MISP or looking to take your threat sharing to the next level, this talk will give you concrete ideas to make it work in high-pressure, real-world environments.