However, our analysts frequently felt the need to add some additional context to their findings / take notes with their observations and screenshot. This methodology came with the following problems: 1. Analysts had to (often did not) manually enter the IOCs into misp once they were done writing their note. 2. Transferring/sharing cases between two analysts was a problem mainly because they had to communicate not only case related information but also how their (very disorganized) note system worked and share large files. 3. It was not easy to reflect the semantics of a relation between two entities as misp handles things using very well defined types that are not super flexible.

With cradle we tried to address these issues. It is by no means a replacement for MISP, but rather they are two products that complement each other. Especially with the external data source integration support we have planned ahead for cradle.