# Generic MISP AI Module - architecture considerations, second prototype implementation released

**URL:** <https://discourse.ossbase.org/t/generic-misp-ai-module-architecture-considerations-second-prototype-implementation-released/1077>\
**Category:** hackathon.lu\
**Tags:** hackathon-2026, misp, ai\
**Created:** [April 15, 2026, 7:34pm UTC](https://discourse.ossbase.org/t/generic-misp-ai-module-architecture-considerations-second-prototype-implementation-released/1077 "2026-04-15T19:34:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aaronkaplan](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/aaronkaplan/32/69_2.png) [@aaronkaplan](https://discourse.ossbase.org/u/aaronkaplan)\
**Post date:** [April 15, 2026, 7:34pm UTC](https://discourse.ossbase.org/t/generic-misp-ai-module-architecture-considerations-second-prototype-implementation-released/1077/1 "2026-04-15T19:34:49Z")

</div>

# AIPITCH

Two days of specification writing, discussions, architecture designs, writing down use-cases for one topic: combining LLMs and MISP. Where does it make sense? Which types of NLP tasks (use-case categories) would make sense for interacting with MISP?

## Architecture

We came up with an initial architecture: [AIPITCH Kaplan - HedgeDoc](https://hdoc.csirt-tooling.org/Z5I9yfoORS-7hr99PM_n4g)

 ![image](https://discourse.ossbase.org/uploads/default/original/1X/effb6780c690cd4018c9e8ca4501b84056733b99.jpeg)

The architecture was reviewed by 4 people and deemed suitable for an initial implementation. We called this “PoC\_v2” (version 1 was already done some time ago and is in MISP as “CTI Info Extractor”).

The specifications and strong guardrails (`AGENTS.md`, testing loops) resulted in a very first (vibe coded! beware! this is still unreviewed) implementation at [https://github.com/ctitools/aipitch-design](https://github.com/ctitools/aipitch-design).  
We treat this as a sample implementation - suitable for discussing and trying out it.

The assumption here is that there is a `MISP_HOST` (a MISP dev instance) and a `DEVELOPMENT_HOST` (a linux box) which are connected. The `DEVELOPMENT_HOST` cloned misp-modules and runs them:  
`.venv/bin/python -m misp_modules -c ./generic-ai-misp-module -l 127.0.0.1 -p 6666`

Then there are plenty of unit tests and a sample summarization test which can be tested against `MISP_HOST` via the API.

The event report gets sent to the misp module, it summarizes it and returns the summary + metadata + the right [ai-assisted MISP taxonomy](https://github.com/MISP/misp-taxonomies/blob/main/ai-computer-assisted/machinetag.json) tags which get attached to the event.  
The reasoning here is that we want to be able to identify and possibly filter out AI-generated garbage if it’s not suitable.

You can try it out by cloning the [repo](https://github.com/ctitools/aipitch-design). Please note that we currently still see this as a “brainstorming” implementation.

## Next steps

- review the code, adapt, make sure the coverage is good
- review the documentation. It should be there for humans 😉 not for coding agents
- review the data format between the generic AI module and MISP
- add tracing, logging
- add telemetry
- test test test
- implement prompts (system, use-case, user-)
- make sure they are configurable per org/user
- have MISP folks review it properly
- test some more
- push upstream

## User interface impressions

(subject to change!)

 ![image](https://discourse.ossbase.org/uploads/default/original/1X/7c2186794370e937f07f2802b0a7045d353a87bd.png)

(config for the plugin)

 ![image](https://discourse.ossbase.org/uploads/default/original/1X/347042aa823705fe7a4bcbc684a9942f176484a1.png)

(labels get added to the event)

Feedback welcome in the [repo](https://github.com/ctitools/aipitch-design)!

---

<div class="post-metadata">

**Author:** ![alexandercronin](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/alexandercronin/32/614_2.png) [@alexandercronin](https://discourse.ossbase.org/u/alexandercronin)\
**Post date:** [April 20, 2026, 6:57pm UTC](https://discourse.ossbase.org/t/generic-misp-ai-module-architecture-considerations-second-prototype-implementation-released/1077/2 "2026-04-20T18:57:03Z")

</div>

Excellent work Aaron, pleasure discussing this with you. Can you please consider making the repo public or adding me? [alexandercronin (Alex Cronin) · GitHub](https://github.com/alexandercronin)