CTI Standards and MISP: Ukraine's Threat Intelligence Infrastructure

Effective threat intelligence sharing requires not just willing partners but compatible technical formats and platforms. The STIX/TAXII standard ecosystem and the MISP open-source platform have become the twin pillars of Ukraine's cyber threat intelligence infrastructure, enabling machine-readable intelligence to flow between CERT-UA, government agencies, international partners, and commercial sector defenders—at volumes and speeds that manual processes could never match.

STIX and TAXII Standards Adoption

Structured Threat Information eXpression (STIX) is the dominant machine-readable format for expressing cyber threat intelligence objects: indicators of compromise, threat actor profiles, attack pattern descriptions (mapped to MITRE ATT&CK), malware descriptions, campaigns, and relationships between these objects. Trusted Automated eXchange of Intelligence Information (TAXII) is the transport protocol for STIX content, defining how clients subscribe to and retrieve STIX collections from servers. Together, STIX/TAXII enable automated intelligence sharing that requires no human intermediary once the technical relationship is established.

Ukraine adopted STIX 2.1 as its standard intelligence format in 2023, following guidance from SSSCIP that required all national threat intelligence platforms to support STIX 2.1 import and export. The move to STIX 2.1 (from the earlier 2.0 version) enabled richer relationship modeling and better integration with MITRE ATT&CK technique references, allowing intelligence objects to carry not just indicator data but structured adversary behavior descriptions that inform detection rule development.

MISP Platform Deployment in Ukraine

Ukraine's national MISP instance, administered by CERT-UA, serves as the central hub for government cyber threat intelligence. MISP (Malware Information Sharing Platform & Threat Sharing) was developed by CIRCL (Computer Incident Response Center Luxembourg) and has become the world's most widely deployed open-source threat intelligence platform, used by national CERTs, ISACs, and private sector security teams in over 80 countries. The open-source nature of MISP—free to use, with active community development—made it an accessible choice for Ukraine's threat intelligence infrastructure with minimal licensing cost.

The Ukrainian MISP instance receives feeds from multiple international partners including CIRCL's MISP community feeds, US-CERT feeds distributed through bilateral agreements, and EU-CERT member feeds through the CSIRTs Network sharing arrangement. It distributes intelligence outbound to subscribed Ukrainian government agencies through automated TAXII connections, eliminating the need for individual agencies to maintain their own feed subscriptions and allowing CERT-UA to apply quality control and contextualization before distribution.

Galaxy Clusters for Ukrainian Threat Actors

MITRE ATT&CK Ukraine Mappings

CERT-UA systematically maps observed threat actor behavior to MITRE ATT&CK technique IDs in its public advisories, creating a publicly accessible library of technique usage by Russian threat actors against Ukrainian targets. This mapping practice, maintained consistently since 2022, represents one of the most comprehensive public documentation resources for Russian state actor TTPs available globally. Security teams worldwide use CERT-UA's ATT&CK mappings to develop detection rules for the same techniques that have been operationally used against Ukrainian targets—translating Ukrainian front-line experience into global defensive value.

The ATT&CK Ukraine coverage extends MITRE's own Galaxy database: CERT-UA-identified techniques that were not adequately covered in existing ATT&CK entries have been formally proposed for inclusion through MITRE's community contribution process, several of which have been accepted and incorporated into ATT&CK sub-techniques.

Operational Use in Network Defense

The operational value of MISP+STIX infrastructure becomes concrete in the detection engineering workflow. When CERT-UA publishes a new advisory with indicators and ATT&CK technique references in STIX format, the Ukrainian government's SIEM and EDR platforms can automatically ingest new detection rules derived from those indicators within minutes of publication. This automation—from human analyst intelligence publication to production detection rule activation—represents a cycle time improvement from days (in a fully manual workflow) to under an hour, a critical advantage when facing an adversary that conducts rapid attack campaigns.

FAQ

What is the difference between STIX and MISP?

STIX is a data format standard for expressing threat intelligence objects. MISP is a software platform for storing, managing, and sharing threat intelligence. MISP natively supports STIX import and export, making them complementary: MISP is the platform, STIX is the interoperable format used to exchange data between platforms.

Are CERT-UA's MISP-based intelligence publications publicly available?

CERT-UA's public advisories (TLP:WHITE/GREEN) are published on cert.gov.ua and include STIX representations. Internal MISP feeds for higher-classification intelligence require bilateral agreements and platform access. CERT-UA also contributes to the public MISP community feeds through CIRCL.

What is MITRE ATT&CK and why does CERT-UA use it?

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. Using ATT&CK identifiers in threat reports creates a common language enabling any organization globally to translate Ukrainian intelligence into their own detection tooling without linguistic or formatting barriers.

How do Galaxy Clusters in MISP relate to threat actors?

MISP Galaxy Clusters are curated knowledge bases about threat actors, tool categories, attack patterns, and other intelligence concepts. Threat actor galaxy entries include attributions, known techniques, associated malware, and historical campaign summaries—a structured threat actor dossier that links to related intelligence objects in MISP.

Can Ukrainian private sector companies access CERT-UA threat intelligence feeds?

A subset of CERT-UA intelligence is distributed to vetted domestic private sector entities through a separate MISP community instance. Companies meeting eligibility criteria (Ukrainian registration, critical sector participation, security team capability) can apply for access to private sector intelligence feeds with TLP:AMBER-level content.

Sources

1. CERT-UA — "STIX/TAXII Implementation Guide for National Threat Intelligence Platform," 2023
2. CIRCL — "MISP Documentation and Ukraine CERT Partnership," misp-project.org, 2023
3. MITRE — "ATT&CK for Enterprise: Ukraine Threat Actor Coverage," attack.mitre.org, 2024
4. SSSCIP Ukraine — "National Cyber Threat Intelligence Standards," Directive 2023-09
5. ENISA — "Threat Intelligence Sharing: STIX/TAXII Adoption in European CERT Community," 2023