Most threat intelligence feeds share the same three problems: atomic indicators with no context, intelligence that arrives after the campaign has already moved on, and a heavy "curation tax" that leaves analysts stitching together enrichment by hand. Add in duplicate coverage from feeds that all watch the same public sources, and it's easy to end up with a lot of volume and very little actionable value.
In a recent joint webinar, VMRay sat down with Koen Van Impe — a core contributor to MISP, the open-source threat intelligence and information sharing platform — to walk through how VMRay's Unique Signal feed integrates directly into MISP, and how that combination lets CTI teams go from a raw indicator to an automated blocking or hunting action in minutes. This post breaks down the reasoning behind Unique Signal, the mechanics of the MISP integration, and the CTI playbooks you can build on top of it.
Why VMRay Built Unique Signal: The Problems It Solves
VMRay's sandbox platform has long been used across DFIR, SOC, and CTI workflows — from full behavioral deep response analysis, to fast binary verdicts for high-volume automation, to total insight for teams building their own internal threat intelligence tooling. Unique Signal, launched in 2025, grew directly out of what VMRay heard from those customers: well-resourced teams were already trusting VMRay's verdicts and extracted IOCs enough to feed them into detection tools and CTI platforms on their own. The idea was to package that same intelligence into a standalone feed that any organization could consume.
Before building it, VMRay ran interviews with dozens of CTI teams and found the same themes recurring regardless of industry:
Atomic IOCs, No Context
IPs and domains arrive without the who, why, or how — and labels are often missing or inconsistent, making block-vs-hunt-vs-ignore decisions hard.
Intel Arrives Too Late
By the time an indicator lands, the campaign — and the infrastructure behind it — has usually already moved on, aging the IOC out fast.
Duplicated Intelligence
Many feeds re-watch the same public repositories and open-source lists, producing overlapping IOCs rather than genuinely new coverage.
The Curation Tax
Raw feeds need manual enrichment before they're usable, and most CTI teams simply don't have the spare analyst cycles to do it.
A fifth issue sits underneath all of these: the volume-versus-quality tradeoff. Ingesting everything drives up pipeline cost and analyst time, but volume without value just means more false positives and more alert fatigue in the SOC.
Context, Uniqueness, Timeliness, and Automation-Readiness
Unique Signal is built around four principles that directly answer those problems: context, uniqueness, timeliness, and readiness for automation. Uniqueness and timeliness in particular are claims that are easy to make and hard to prove — so VMRay uses an independent third party, Tidal/Tikura, to benchmark both by tracking first-seen dates and source overlap across more than a thousand feeds.
High uniqueness means an indicator isn't just duplicate noise sitting alongside every other feed you already run — it's a signal you can trust for blocking, not just enrichment. High timeliness means the feed covers fast-moving malware infrastructure early enough to still matter operationally. VMRay maintains both metrics at roughly 90%.
How Unique Signal Works Behind the Scenes
The differentiator underneath all of this is VMRay's evasion-resistant sandbox. Samples are pulled from multiple sources, triaged to prioritize the most relevant ones, and detonated in a way that exposes full behavior without tipping off evasion checks — which is what makes the extracted IOCs meaningfully more unique than IOCs pulled from public repositories or reputation-only tools.
Before anything reaches a platform like MISP, every report passes through false-positive checks, enrichment, labeling, and context linking. That filtering layer is what removes the manual "curation tax" that CTI teams would otherwise have to apply themselves.
"Some of the well-resourced teams have been using [VMRay] for threat intel generation, and — without too much analysis paralysis — they trust not only the verdict but also the IOCs extracted from it."
— Ali, VMRay
What MISP Adds: Collection, Curation, and Sharing
MISP — a Malware Information Sharing Platform — is community-driven, fully open source, and supports the entire intelligence lifecycle: collecting raw data and IOCs, processing and analyzing events, transforming that analysis into intelligence, and disseminating it to stakeholders. It also supports feedback loops from those stakeholders, and can be operationalized directly for blocking and detection.
MISP collects data two main ways: through remote services that connect to a MISP community (a group of organizations sharing events with each other, such as an ISAC), or through feeds. VMRay Unique Signal is added as a MISP feed alongside built-in options like CIRCL's OSINT feed, abuse.ch's ThreatFview.io, and others.
Setting Up VMRay Unique Signal as a MISP Feed
Adding Unique Signal to a MISP instance is done through the Feeds menu, and takes only a few configuration fields:
-
Enable the feed and set the provider In MISP's feed settings, enable the feed and label VMRay as the provider so analysts can immediately trace where each event came from.
-
Set the input source and URL Choose "network source" and point MISP to the VMRay Unique Signal API endpoint.
-
Select the source format Unique Signal is delivered in native MISP feed format, so no manual transformation is needed to create events on your server.
-
Add authentication headers and set distribution Add the API key and device ID provided by VMRay, then set the distribution level (e.g. "your organization only") to control how far the resulting events are shared.
Once submitted, MISP begins pulling and processing Unique Signal events automatically, tagging each one with metadata: source (VMRay), confidence level (high, since VMRay is treated as a trusted, high-confidence provider), and workflow state (complete once processing finishes). Each event also carries an attribute count, correlation data linking it to other events, and contextual tags — malware type, threat actor, or attack pattern.
From Indicator to Action: Building CTI Playbooks in MISP
Once Unique Signal data is flowing into MISP, the platform's workflow engine can turn indicators directly into automated actions. The webinar demo walked through several concrete patterns:
False-Positive Flagging
MISP automatically flags indicators like VPN-provider IP addresses as likely false positives for blocking, while still surfacing them for historical or retroactive search.
Retro-Hunt in the SIEM
A workflow verifies indicator credibility, extracts network indicators, and pushes them as a query list to the SIEM to check historical logs for prior exposure.
Malware Sample Enrichment
CERT teams can attach extracted file hashes from an investigation to a MISP event via a public playbook, then pull VMRay's family verdict and context automatically — without running the sample themselves.
Sync to Sentinel / EDR
A second workflow sets an information-credibility rating and pushes the full event — IPs, hashes, and associated context — directly into Microsoft Sentinel for the SOC to act on.
In each case, VMRay's verdict is cross-checked against a second source in the same MISP instance — for example, MalwareBazaar independently confirming a VMRay family classification like Kaisrat or Ramos — which raises confidence before the indicator is pushed anywhere for blocking.
Best Practice: A "Dirty" and "Clean" MISP Architecture
One recurring recommendation from the demo: don't run a single MISP instance that both ingests external feeds and feeds your internal security controls directly. Instead, use two (or three) instances chained together.
An external-facing "dirty" MISP collects and validates raw data from feeds like Unique Signal, applying false-positive checks and contextualization. Once an event has been reviewed and cleaned, it's synchronized to an internal "clean" MISP that connects to production security controls. Pushing unvalidated external data straight into blocking rules is, as the webinar put it, "going to be a nightmare for your SOC."
Beyond architecture, a few organizational policies matter more than the tooling itself: a documented false-positive management process (since what's a false positive for one org may be a legitimate block for another), data normalization across multiple feeds, and a defined enrichment process so analysts aren't improvising context at alert time. MISP itself is described as a stable platform to maintain, with active community and commercial support — but adoption should be staged: start by consuming feeds, learn from how the community shares and validates data, then move into building and running your own playbooks.
How VMRay Measures and Maintains Feed Quality
VMRay tracks a specific set of KPIs to keep Unique Signal's quality consistent over time:
- Volume: around 5,000 detonation reports and 20,000–40,000 IOCs generated per week.
- Uniqueness & timeliness: independently benchmarked and maintained at roughly 90% each.
- Malware family coverage: a target of at least 60% of indicators enriched with an accurate, non-generic family label.
Recent updates layered on top of those KPIs include expanded industry and country-level context (via STIX sighting objects), an MVP of threat actor attribution on select indicators, a multi-layer confidence-control mechanism in VMRay's internal pipeline, and MISP-specific label formatting so context renders correctly against MISP's standards. On the roadmap: broader and more precise industry/victim enrichment, expanded threat actor labeling, and deeper integrations with additional TIPs and EDR platforms.
Who Benefits Most from Unique Signal + MISP?
SOC & CERT Teams
Automated retro-hunts, blocking recommendations, and instant malware family verdicts on samples pulled from live investigations.
MISP Communities & ISACs
A high-confidence, independently benchmarked feed that adds genuinely new coverage rather than re-watching the same OSINT sources.
CTI Teams
Context-rich, automation-ready indicators that cut the manual enrichment work usually needed before a feed is genuinely usable.
Turning a Threat Feed into an Automated Response
The value of Unique Signal isn't just that it's a well-curated feed — it's that MISP gives it somewhere to go. Together they cover the full lifecycle: VMRay's evasion-resistant sandbox produces unique, timely, context-rich IOCs; MISP's workflow engine validates, correlates, and routes them into SIEMs, firewalls, and EDR platforms without manual intervention at each step.
For CTI and SOC teams trying to close the gap between "we have a threat feed" and "we have automated, defensible actions," that combination — a trustworthy source plus a platform built for curation and dissemination — is the difference that matters.
See Unique Signal in Your MISP Environment
Request a VMRay account or book a personalized demo to see the Unique Signal feed and MISP playbooks in action.
Request a Demo More Resources