NO
Information handling

MISP taxonomies

MISP is an open-source threat-intelligence sharing platform. Its taxonomies are standardised tag vocabularies — "machine tags" — that classify and label shared intelligence so it means the same thing to everyone. Improbus tags indicators and reports with MISP taxonomies.

Taxonomies are shared vocabularies. Two of the most important — TLP (distribution) and PAP (permitted actions) — travel with every item we share. MISP taxonomies make classification machine-readable and consistent across partners.

How a taxonomy tag looks

A machine tag has the form namespace:predicate="value" — for example tlp:amber, pap:green, or admiralty-scale:source-reliability="b". Because the vocabulary is fixed, tools and partners interpret every tag identically.

Taxonomies we use

  • tlpControlled distribution — who may receive an item.
  • papPermitted actions — what you may do with it.
  • admiralty-scaleSource reliability (A–F) and information credibility (1–6).
  • estimative-languageAnalytic confidence in an assessment, in plain words.

How Improbus applies it

We tag every shared indicator and report with the relevant MISP taxonomies — always a TLP and a PAP label, plus source and confidence where they apply. Consistent tagging keeps intelligence machine-readable, correctly classified, and safe to exchange across the community.

Summarised in our own words for context. MISP and its taxonomies are open-source and community-maintained; the tags above are a subset of those in common use.
π