Connectors
...
Actions
Get a Filtered and Paginated List of Attributes
5 min
description retrieve a filtered and paginated list of attributes from misp, including specified request headers endpoint url attributes/restsearch method post inputs json body (object) page (number) limit (number) value (string) value1 (string) value2 (string) type (string) category (string) org (string) tags (array) from (string) to (string) last (number) eventid (string) withattachments (boolean) uuid (string) publish timestamp (string) published (boolean) timestamp (string) attribute timestamp (string) enforcewarninglist (boolean) to ids (boolean) deleted (boolean) event timestamp (string) threat level id (string) eventinfo (string) sharinggroup (array) decayingmodel (string) score (string) first seen (string) last seen (string) includeeventuuid (boolean) includeeventtags (boolean) includeproposals (boolean) requested attributes (array) includecontext (boolean) headerless (boolean) includewarninglisthits (boolean) attackgalaxy (string) object relation (string) includesightings (boolean) includecorrelations (boolean) modeloverrides (object) lifetime (number) decay speed (number) threshold (number) default base score (number) base score config (object) estimative language\ confidence in analytic judgment (number) estimative language\ likelihood probability (number) phishing\ psychological acceptability (number) phishing\ state (number) includedecayscore (boolean) includefullmodel (boolean) excludedecayed (boolean) returnformat (string) headers (object) – required accept (string) – required content type (string) – required output example \[ { "response" { "attribute" \[ { "id" "12345", "event id" "12345", "object id" "12345", "object relation" "sensor", "category" "internal reference", "type" "md5", "value" "127 0 0 1", "to ids" true, "uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "timestamp" "1617875568", "distribution" "0", "sharing group id" "1", "comment" "logged source ip", "deleted" false, "disable correlation" false, "first seen" "1581984000000000", "last seen" "1581984000000000", "data" "string", "event uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "decay score" \[ { "score" 10 5, "base score" 80, "decayed" true, "decayingmodel" { "id" "12345", "name" "phishing model" } } ], "event" { "id" "12345", "org id" "12345", "distribution" "0", "info" "logged source ip", "orgc id" "12345", "uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "date" "1991 01 15", "published" false, "analysis" "0", "attribute count" "321", "timestamp" "1617875568", "sharing group id" "1", "proposal email lock" true, "locked" true, "threat level id" "1", "publish timestamp" "1617875568", "sighting timestamp" "1617875568", "disable correlation" false, "extends uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "event creator email" "user\@example com" }, "object" { "id" "12345", "name" "ail leak", "meta category" "string", "description" "string", "template uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "template version" "1", "event id" "12345", "uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "timestamp" "1617875568", "distribution" "0", "sharing group id" "1", "comment" "string", "deleted" true, "first seen" "1581984000000000", "last seen" "1581984000000000", "attribute" \[ { "id" "12345", "event id" "12345", "object id" "12345", "object relation" "sensor", "category" "internal reference", "type" "md5", "value" "127 0 0 1", "to ids" true, "uuid" "c99506a6 1255 4b71 afa5 7b8ba48c3b1b", "timestamp" "1617875568", "distribution" "0", "sharing group id" "1", "comment" "logged source ip", "deleted" false, "disable correlation" false, "first seen" "1581984000000000", "last seen" "1581984000000000" } ] }, "tag" \[ { "id" "12345", "name" "tlp\ white", "colour" "#ffffff", "exportable" true, "org id" "12345", "user id" "12345", "hide tag" false, "numerical value" "12345", "is galaxy" true, "is custom galaxy" true, "inherited" 1 } ] } ] } } ] output parameters response (object) attribute (array) id (string) event id (string) object id (string) object relation (string) category (string) type (string) value (string) to ids (boolean) uuid (string) timestamp (string) distribution (string) sharing group id (string) comment (string) deleted (boolean) disable correlation (boolean) first seen (string) last seen (string) data (string) event uuid (string) decay score (array) score (number) base score (number) decayed (boolean) decayingmodel (object) id (string) name (string) event (object) id (string) org id (string) distribution (string) info (string) orgc id (string) uuid (string) date (string) published (boolean) analysis (string) attribute count (string) timestamp (string) sharing group id (string) proposal email lock (boolean) locked (boolean) threat level id (string) publish timestamp (string) sighting timestamp (string) disable correlation (boolean) extends uuid (string) event creator email (string) object (object) id (string) name (string) meta category (string) description (string) template uuid (string) template version (string) event id (string) uuid (string) timestamp (string) distribution (string) sharing group id (string) comment (string) deleted (boolean) first seen (string) last seen (string) attribute (array) id (string) event id (string) object id (string) object relation (string) category (string) type (string) value (string) to ids (boolean) uuid (string) timestamp (string) distribution (string) sharing group id (string) comment (string) deleted (boolean) disable correlation (boolean) first seen (string) last seen (string) tag (array) id (string) name (string) colour (string) exportable (boolean) org id (string) user id (string) hide tag (boolean) numerical value (string) is galaxy (boolean) is custom galaxy (boolean) inherited (number)