Next free-source hunt
We check for new free data every weekday.
Datasets / Cyber Threat
github.com/

MISP Galaxy Clusters

Freeauth: noneCC0-1.0#cyber-threat#threat-intel#historical-data#risk✓ verified Nov 1, 2026

MISP Galaxy Clusters

MISP Galaxy is a versioned collection of JSON knowledge-base clusters for threat actors, tools, ransomware, attack techniques and other analytical vocabularies. Cluster files carry names, UUIDs, versions, descriptions, source references and key-value metadata; no account or key is needed.

Coverage

The repository exposed 136 cluster JSON files when checked, ranging from threat-actor and malware families to ATT&CK-like matrices and defensive frameworks. Files are maintained through repository commits, but the provider states no fixed publication schedule or completeness assurance.

Verdict

This is defensive data for normalizing threat names, aliases, techniques and contextual metadata across MISP events or an AI agent's own records. It is a knowledge base rather than a live incident or IOC stream, so cluster updates do not imply new activity. Individual clusters combine multiple sources and may lag, overlap or use different taxonomies; retain UUIDs, versions and source fields when joining data. The files can be used outside MISP, but consumers must handle nested and heterogeneous metadata.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.

Use in your agent

Load a MISP Galaxy threat-actor cluster into Parquet. Checked against the provider's documentation on Nov 1, 2026.

Raw skill file (/skills/misp-galaxy.md)Also in our MCP server: call get_ingestion_skill with {"slug": "misp-galaxy"}.

Access

  • No account or key. Raw cluster JSON files are public downloads from the MISP Galaxy repository.

Request

bash
curl -O 'https://raw.githubusercontent.com/MISP/misp-galaxy/main/clusters/threat-actor.json'

Format

JSON cluster metadata plus a values array; each value can include a UUID, value, description and heterogeneous nested meta fields such as aliases, country, references and classifications.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python
"""MISP Galaxy threat-actor cluster -> pandas -> Parquet. No key."""
import json
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/MISP/misp-galaxy/main/clusters/threat-actor.json"
r = requests.get(URL, timeout=60)
r.raise_for_status()
cluster = r.json()
df = pd.json_normalize(cluster["values"])
for column in df.columns:
    if df[column].map(lambda value: isinstance(value, (list, dict))).any():
        df[column] = df[column].map(
            lambda value: json.dumps(value, sort_keys=True)
            if isinstance(value, (list, dict)) else value
        )
df.insert(0, "cluster_uuid", cluster["uuid"])
df.insert(1, "cluster_version", cluster["version"])
df.to_parquet("misp_threat_actor_cluster.parquet", index=False)
print(len(df), "threat-actor values", "cluster version", cluster["version"])

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 1115 threat-actor values cluster version 358

Limits

  • Rate limit: Not stated for raw file downloads.
  • There is no fixed update schedule or completeness statement.
  • The checked repository directory contained 136 cluster JSON files.

Quirks

  • Cluster meta fields are heterogeneous and frequently contain lists or dictionaries; serialize or normalize them before Parquet output.
  • Use the cluster and value UUIDs as stable join keys and preserve the cluster version for reproducibility.
  • Cluster content is reference knowledge, not evidence that a listed actor, tool or technique is currently active.

Terms and attribution

  • The JSON files are dual-licensed under CC0-1.0 or the repository's BSD-style terms.
  • Choosing the BSD-style option requires retention of its copyright notice, conditions and disclaimer on redistribution.

Sources

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

Related entries