MISP performance recommendations

The following recommendations are intended to help optimize the performance of the MISP software. By following these guidelines, users can improve the import speed and responsiveness of the software.

MISP hardware recommendations

Ensure that the server configuration meets the minimum system requirements for running MISP. Due to the significant amount of data in Kaspersky Threat Data Feeds, we recommend to use a high-performance configuration:

• Up to 128GB RAM
• 512GB SSD
• 4 CPU x 2 CORES 2.5GHz

MISP software recommendations

Disable correlations

You can disable correlations in two ways:

• Only for the feed being added (starting in MISP v2.4.159)

To disable correlation for a new feed, select the corresponding checkbox in the "Add MISP feed" window.

Disabling correlation

• For the entire platform

To disable correlation for all events in MISP:

1. Go to Administration > Server Settings & Maintenance > MISP.
2. Set the MISP.completely_disable_correlation parameter to true.
3. Restart all MISP services after you have changed the specified parameter.

Disable saving logs to the database

Attribute modifications and objects reference changes are logged in a database by MISP. This builds the event history, but additional database workload can negatively affect performance under intensive fetching of data feeds.

To disable all logs from being saved to the database:

1. Go to Administration > Server Settings & Maintenance > MISP.
2. Set the MISP.log_skip_db_logs_completely parameter to true.
3. Restart all MISP services after you have changed the specified parameter.

We recommend to disable logs saving only for the period when feeds are initially loaded into MISP.

Page top