Index › Security operations › Threat intel › NordStellar vs MISP

Threat intelligence platforms · September 2026 Edition

NordStellar vs MISP

Four of twelve models named NordStellar first on the direct prompt; zero named MISP. NordStellar was named by eight of the twelve models and MISP by nine and NordStellar carries 13 labels and MISP 24, so the shares are not directly comparable.

NordStellar

accepted challenger

Named in one category this edition.

MISP

accepted challenger

Named in one category this edition.

First-choice share13%11%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.

Negative rate0%8%Negative labels as a share of the product's labels, 0 to 100.

Rank in category#1#2A position in a field of 12; printed, not drawn.

Labels1324A count; the two differ.

The two percentage rows are drawn on one 0 to 100 track, NordStellar reading right to left. Rank and label count are printed, not drawn.Rapid7 Threat Command was named alongside these two in eight of the twelve direct answers. NordStellar vs Rapid7 Threat Command · MISP vs Rapid7 Threat Command

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the threat intelligence platforms page.

By framing

How many of the twelve models made each the first choice, per way of asking, and how many argued against it.

NordStellarFirst choices, of twelve modelsMISP

Direct40

Paraphrase20

Comparative00

Budget-constrained05

Scale-constrained00

Negative012 against MISP

Bars are first choices, 0 to 12 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to twelve.

The direct prompt

The plain question, one answer per model, grouped by where NordStellar and MISP stood in it.

NordStellar first, MISP not the choice

4 of 12 modelsMISP was named in the answer but not as the choice, or not at all.

Grok 4.1 FastNordStellar alternatives: Flare, Rapid7 Threat Command

Mistral SmallNordStellar, Rapid7 Threat Command alternatives: CrowdStrike Falcon, UpGuard

DeepSeek V4 FlashNordStellar, Rapid7 Threat Command alternatives: Cyble Vision

Llama 4 MaverickNordStellar alternatives: Flare, Rapid7 Threat Command

Neither was the first choice, one was named

3 of 12 modelsThe answer put something else first and named one of the two as an alternative.

Gemini 3.5 FlashSOCRadar alternatives: Feedly for Threat Intelligence, Flare, MISP, OpenCTI, Rapid7 Threat Command

Kimi K2Flare, SOCRadar Extended Threat Intelligence alternatives: NordStellar, Rapid7 Threat Command

MiniMax M2.5Anomali, Recorded Future alternatives: AlienVault OTX, Intel 471, MISP, Microsoft Defender for Threat Intelligence

Neither was named

5 of 12 modelsThe answer made no first choice from these two in this category.

Claude Haiku 4.5Cyble Vision alternatives: Recorded Future, SOCRadar, ThreatConnect

GPT-5.4 miniRecorded Future alternatives: Anomali, CrowdStrike Falcon Adversary Intelligence, Cyware, SOCRadar, ThreatConnect, ZeroFox

Perplexity SonarCyble Vision, SOCRadar alternatives: Flare, Rapid7 Threat Command

Qwen 3.7 FlashThreatConnect alternatives: GreyNoise, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future

GLM 4.7 FlashXRecorded Future alternatives: Flare, Rapid7 Threat Command

Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.

Small business

NordStellar leads by two points.

NordStellar#1 of 13

MISP#2 of 13

The full small business standing →

Mid-marketThe figures above

NordStellar leads by two points.

NordStellar#1 of 12

MISP#2 of 12

The full mid-market standing →

Enterprise

NordStellar is not named for this buyer.

NordStellarnot named

MISP#10 of 10

The full enterprise standing →

What the models said about NordStellar

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Three of four in this category shown.

“NordStellar and Rapid7 Threat Command are the top choices due to their balance of features, scalability, and cost.” Mistral Small · direct prompt · first choice

“Rapid7 Threat Command or NordStellar offer the best balance of actionability, coverage, and price” DeepSeek V4 Flash · direct prompt · first choice

“NordStellar or Rapid7 Threat Command as the platform, depending on your specific needs” Mistral Small · paraphrase prompt · first choice

What the models said about MISP

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Five of six in this category shown.

“Avoid open-source TIPs if your security team consists of "generalists"” Gemini 3.5 Flash · negative prompt · soft negative

“Avoid Open-Source TIPs if you lack dedicated engineering support” DeepSeek V4 Flash · negative prompt · soft negative

“For a budget‑constrained company that can dedicate a small server, MISP + TheHive (or OpenCTI) gives you enterprise‑grade intel sharing and investigation without any licensing cost.” MiniMax M2.5 · budget prompt · first choice

“start with OpenCTI Community Edition (for analysis and knowledge management) paired with MISP (for IOC sharing and operational intel)” Kimi K2 · budget prompt · first choice

“MISP offers enterprise-grade threat intelligence management at zero licensing cost and is an excellent starting point” Claude Haiku 4.5 · budget prompt · first choice

Also compared

NordStellar vs Rapid7 Threat Command MISP vs Rapid7 Threat Command The full threat intel standing

Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.