Practical MISP for CSIRTs: From Threat Feeds to Actionable Intelligence
2–3 November 2026 • PrideInn Azure, Westlands • Free for Approved FIRST participantsThis full-day, hands-on FIRST training introduces participants to practical Cyber Threat Intelligence (CTI) workflows using MISP (Malware Information Sharing Platform).
Rather than focusing only on CTI theory, participants will work through a realistic CSIRT workfl ow: collecting indicators, structuring them in MISP, consuming external threat feeds, enriching indicators, assessing relevance, and securely distributing actionable intelligence to constituents and trusted partners.
Participants will learn how a national or sectoral CSIRT can use MISP as part of its operational threat intelligence capability - receiving intelligence from multiple sources, improving it through enrichment and contextualisation, and sharing relevant intelligence with SOCs, government agencies, critical infrastructure operators, sectoral CSIRTs and regional partners.
The workshop will also introduce the governance considerations required when operating a CTI-sharing capability, including FIRST Traffic Light Protocol (TLP), information-sharing policies, confidence levels, distribution controls, and trusted communities.
Pre-requisites
Participants do require basic MISP and formal CTI experience.
Participants should also, have:
- Basic familiarity with cybersecurity, incident response, SOC operations or security monitoring.
- Basic understanding of Indicators of Compromise (IOCs), such as IP addresses, domains, URLs and fi le hashes.
- Familiarity with web-based security tools and interfaces.
- A laptop capable of connecting to the provided training environment.
- A modern web browser.
Basic knowledge of APIs, SIEM platforms or threat intelligence platforms is useful but not mandatory.
Who Is This Workshop For
The workshop is designed for technical and managerial personnel involved in cybersecurity operations, incident response and information sharing, including:
- National CSIRT/CERT personnel.
- Sectoral CSIRT/CERT teams.
- Security Operations Centre (SOC) analysts.
- Incident responders.
- Cyber Threat Intelligence analysts.
- Cybersecurity agencies and regulators.
- Critical infrastructure security teams.
- Government cybersecurity practitioners.
- Academic and research institutions supporting cybersecurity operations.
- Personnel responsible for coordinating cybersecurity information sharing with constituents or trusted partners.
The training is particularly relevant to organisations seeking to establish or strengthen a national, sectoral or organisational threat intelligence-sharing capability.
What Will You Learn
By the end of the workshop, participants will be able to:
- Understand the role of MISP in a CTI ecosystem
- Structure threat intelligence in MISP
- Consume and manage threat intelligence feeds
- Build and publish threat feeds
- Enrich threat intelligence
- Share intelligence with constituents and trusted communities Integrate CTI into incident response
Business/Organization Benefits
Organisations represented in the workshop will gain practical knowledge for establishing a more structured and sustainable CTI capability.
The training can help organisations:
- Reduce dependence on manually exchanged IOC lists and spreadsheets.
- Establish repeatable threat intelligence workfl ows.
- Improve the quality and consistency of intelligence shared with constituents.
- Improve collaboration between national, sectoral and organisational security teams.
- Establish controlled information-sharing communities.
- Reduce duplication through correlation and centralised intelligence management.
- Improve the speed at which indicators move from discovery to defensive action.
- Introduce consistent use of FIRST TLP, MITRE ATT&CK, taxonomies and information-sharing policies.
- Better integrate CTI into SOC and incident-response processes.
- Build foundations for national and regional cybersecurity information-sharing communities.
For national and sectoral CSIRTs, the workshop additionally demonstrates how MISP can support the CSIRT's role as a trusted intelligence broker between multiple organisations and sectors.
General Information
Format: Instructor-led, hands-on technical workshop
Duration: Full day
Delivery: In-person
Experience Level: Introductory to Intermediate
Training Approach: Approximately 30% concepts and 70% hands-on exercises
The workshop is structured around a progressive operational scenario rather than isolated demonstrations.
Trainer Profile
Lawrence Muchilwa is a cybersecurity practitioner and FIRST Africa Regional Liaison with extensive experience supporting national and sectoral CSIRTs across Africa. His work spans cyber threat intelligence, incident response, CSIRT capability development, cyber diplomacy, and practical cybersecurity training. He has designed and delivered hands-on programs for CSIRT and SOC teams across multiple countries, with a strong focus on MISP, threat intelligence sharing, FIRST TLP, MITRE ATT&CK, and strengthening trusted regional cybersecurity collaboration.
Workshop Itinerary
Day 1 [MORNING]:
SOC Foundations — Mission, Governance, Operating Model & Telemetry Strategy
We begin with the strategic foundations of the SOC: its institutional mandate, governance structure, and daily operating model, followed by a detection-driven approach to telemetry collection.
- Welcome and workshop overview
- SOC mandate, institutional role, and constituency mapping
- Governance structure, steering committee, and regulatory monitoring alignment
- Tiered SOC structure, roles, responsibilities, and escalation workflows
- Detection-driven telemetry strategy and identity-first monitoring
- Log onboarding prioritization, data quality, and normalization
- Hands-on: Draft SOC mission and charter; design escalation matrix; build phased telemetry onboarding roadmap
DAY 1 [AFTERNOON]:
Threat-Driven Detection Engineering & Detection Quality
The afternoon focuses on the full detection lifecycle — from threat-informed design through validation, deployment, tuning, and continuous improvement.
- Threat-informed detection strategy and coverage modeling with ATT&CK Navigator
- Detection engineering lifecycle: design, validation, deployment, tuning, improvement
- Detections-as-code concepts: versioning, testing, auditability
- Threat intelligence as input to detection development and enrichment
- Alert classification (True Positive / False Positive / Benign Positive / Undetermined) and outcome tagging
- Detection tuning methodology and the continuous improvement loop
- Hands-on: Map an attack scenario to detection logic and telemetry requirements; alert classification and tuning simulation
DAY 2 [MORNING]:
Triage, Investigation & Incident Response Integration
Day two moves into the operational heart of the SOC: structured triage, hypothesis-driven investigation, and integrated incident response.
- Alert prioritization models and investigation methodology
- Hypothesis-driven analysis, structured decision-making, and case documentation standards
- Coordination with digital forensics and specialized investigation functions
- Incident response lifecycle: containment, eradication, recovery
- Playbook design principles and post-incident improvement cycle
- Hands-on: Investigation decision-tree walkthrough with case documentation; build a phishing or credential-compromise response playbook
Day 2 [Afternoon]:
Resilient & Future-Ready SOC — Metrics, AI Augmentation & Capability Roadmap
The final session addresses modern SOC challenges, AI-augmented operations, performance measurement, and consolidates all workshop outputs into a phased capability roadmap.
- Encrypted traffic visibility limitations; cloud and identity-centric attacks
- AI-enabled threats, attacks targeting SOC tooling, and monitoring the monitoring systems
- AI-assisted investigation, automation vs augmentation, and phased AI adoption
- SOC metrics: MTTD, MTTR, detection performance, analyst workload, executive KPIs
- Advanced capability expansion: threat hunting, threat intelligence, purple teaming, digital forensics
- Hands-on: Identify controls to secure SOC infrastructure; identify 3 safe AI augmentation opportunities; build SOC KPI framework and phased 90-day / 12-month capability roadmap
- Wrap-up: consolidating workshop artifacts and next steps
