# Playing with a Threat-Actor explorer (browser-local) from the MISP galaxy dataset

**URL:** <https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118>\
**Category:** MISP Project\
**Tags:** misp-galaxy, cti\
**Created:** [August 3, 2026, 3:58pm UTC](https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118 "2026-08-03T15:58:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 3, 2026, 3:58pm UTC](https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118/1 "2026-08-03T15:58:35Z")

</div>

The [misp-galaxy](https://github.com/MISP/misp-galaxy) dataset contains a lot of details about threat-actor and I wanted to experiment with the new [Pivotick library](https://github.com/Pivotick/Pivotick) from my colleague.

 ![image](https://discourse.ossbase.org/uploads/default/original/1X/2b24c1b1a356fad28ef9383791824c5a88b6c53e.png)

# Navigating over the mess vendor and threat-actor name

We recently introduced in the MISP galaxy the origin of the producer per threat-actor name. So you can filter in the browser per producer directly:

 ![Screenshot from 2026-08-03 17-49-09](https://discourse.ossbase.org/uploads/default/original/1X/50f03aedc3f054e0c177f04cc2d67c00b8436cbf.png)

Prototype running and accessible at (everything will run in your browser so you need a decent recent browser):

> **[MISP Galaxy Threat Actor Explorer](https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html)**

The source code is available at the following location (and as usual all is open-source):

> **[GitHub - adulau/threat-actor-explorer: A Threat-Actor explorer (browser-local) from the...](https://github.com/adulau/threat-actor-explorer)**
>
> A Threat-Actor explorer (browser-local) from the MISP galaxy dataset

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 4, 2026, 3:48pm UTC](https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118/2 "2026-08-04T15:48:52Z")

</div>

Some updates including in the threat-actor filtering, graph visualisation (now the flags are there), anchor reference and so on:

> **[MISP Galaxy Threat Actor Explorer](https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html#actor=f98bac6b-12fd-4cad-be84-c84666932232)**

 ![Screenshot from 2026-08-04 17-21-03](https://discourse.ossbase.org/uploads/default/original/1X/b572f7113a9d286d834393e1a8bf8a15b943ce75.png)

You can also filter per number of relationships, sectors and so on.

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 4, 2026, 8:28pm UTC](https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118/3 "2026-08-04T20:28:40Z")

</div>

# First release v1.0.0 of threat-actor-explorer

> **[Release MISP Galaxy Threat Actor Explorer v1.0.0 released ·...](https://github.com/adulau/threat-actor-explorer/releases/tag/v1.0.0)**
>
> threat-actor-explorer is a standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster in the MISP Galaxy reposito...