Misp

MISP is an open-source threat intelligence platform that facilitates the sharing of structured threat information among organizations.

MISP (Malware Information Sharing Platform & Threat Sharing) is an open-source threat intelligence platform designed to improve the sharing of structured threat information. The MISP Turbine Connector enables seamless integration with Swimlane Turbine, allowing users to automate the management of threat intelligence data. This integration enhances security operations by enabling automated actions such as adding, editing, and deleting threat attributes and events, enriching threat data, and executing custom scripts for advanced threat analysis.

Prerequisites

Before you can use the MISP connector for Swimlane, you'll need access to the MISP API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing the MISP API.

API Key: A unique key provided by MISP for authenticating API requests.

Capabilities

The Connector for MISP needs to support the following capabilities:

Add Attribute

Add Event

Add Event Tag

Add Tag to Attribute

Delete Attribute

Delete Event

Edit Attribute

Get a Filtered and Paginated List of Attributes

Get a Filtered and Paginated List of Objects

Get Attribute

Get Attribute by Id

Get Count of Attributes by Category

Get Event by Id

Get Events

Get List of Attribute Types ... and so on

Notes

https://www.misp-project.org/openapi/

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Authorization	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Attribute

Add a new attribute to an existing event in MISP using the provided event ID, path parameters, and headers.

Endpoint

URL: attributes/add/{{eventId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Add Attribute action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
event_id	string	Optional	Unique identifier
object_id	string	Optional	Unique identifier
object_relation	string	Optional	Parameter for Add Attribute
category	string	Optional	Parameter for Add Attribute
type	string	Optional	Type of the resource
value	string	Optional	Value for the parameter
to_ids	boolean	Optional	Unique identifier
uuid	string	Optional	Unique identifier
timestamp	string	Optional	Parameter for Add Attribute
distribution	string	Optional	Parameter for Add Attribute
sharing_group_id	string	Optional	Unique identifier
comment	string	Optional	Parameter for Add Attribute
deleted	boolean	Optional	Parameter for Add Attribute
disable_correlation	boolean	Optional	Parameter for Add Attribute
first_seen	string	Optional	Parameter for Add Attribute
last_seen	string	Optional	Parameter for Add Attribute

Input Example

{"json_body":{"event_id":"12345","object_id":"12345","object_relation":"sensor","category":"Internal reference","type":"md5","value":"127.0.0.1","to_ids":true,"uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","timestamp":"1617875568","distribution":"0","sharing_group_id":"1","comment":"logged source ip","deleted":false,"disable_correlation":false,"first_seen":"1581984000000000","last_seen":"1581984000000000"},"path_parameters":{"eventId":"string"}}

Output

Parameter	Type	Description
Attribute	object	Output field: Attribute
Attribute.id	string	Unique identifier
Attribute.event_id	string	Unique identifier
Attribute.object_id	string	Unique identifier
Attribute.object_relation	string	Output field: Attribute.object_relation
Attribute.category	string	Output field: Attribute.category
Attribute.type	string	Type of the resource
Attribute.value	string	Value for the parameter
Attribute.to_ids	boolean	Unique identifier
Attribute.uuid	string	Unique identifier
Attribute.timestamp	string	Output field: Attribute.timestamp
Attribute.distribution	string	Output field: Attribute.distribution
Attribute.sharing_group_id	string	Unique identifier
Attribute.comment	string	Output field: Attribute.comment
Attribute.deleted	boolean	Output field: Attribute.deleted
Attribute.disable_correlation	boolean	Output field: Attribute.disable_correlation
Attribute.first_seen	string	Output field: Attribute.first_seen
Attribute.last_seen	string	Output field: Attribute.last_seen

Output Example

{"Attribute":{"id":"12345","event_id":"12345","object_id":"12345","object_relation":"sensor","category":"Internal reference","type":"md5","value":"127.0.0.1","to_ids":true,"uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","timestamp":"1617875568","distribution":"0","sharing_group_id":"1","comment":"logged source ip","deleted":false,"disable_correlation":false}}

Add domain-ip object to event

Add a domain-IP object to a MISP event using event ID. Requires at least one of domain, hostname, or IPs. Supports single domain and arrays for IPs and ports, with per-attribute tags.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_id	string	Required	The MISP event ID (or UUID) to add the domain-ip object to
domain	string	Optional	Domain name (single value)
ips	array	Optional	List of IP addresses to add as ip attributes
ports	array	Optional	List of TCP ports to add as port attributes
hostname	string	Optional	Hostname related to the IP(s)
first_seen	string	Optional	First time the domain-ip tuple has been seen (datetime)
last_seen	string	Optional	Last time the domain-ip tuple has been seen (datetime)
registration_date	string	Optional	Registration date of the domain (datetime)
text	string	Optional	A description of the domain-ip tuple
attribute_tags	array	Optional	Optional. List of { "attribute": " ", "tag": " ", ... } to add a tag to domain-ip object attributes. "attribute" is the MISP attribute name (e.g. domain, hostname, ip, port, first-seen, last-seen, registration-date, text). "tag" is the tag name (e.g. tlp:white). For domain, ip, or port you can target a specific instance with "value" (e.g. "1.2.3.4") or "index" (0-based). Without value/index, the tag is applied to all attributes of that type.
attribute_tags.attribute	string	Optional	MISP attribute name (e.g. domain, hostname, ip, port, first-seen, last-seen, registration-date, text)
attribute_tags.tag	string	Optional	Tag name to add to this attribute
attribute_tags.value	string	Optional	For domain/ip/port; tag only the attribute with this value.
attribute_tags.index	integer	Optional	Tag only the attribute at this 0-based index among attributes of the same type.

Input Example

{"event_id":"string","domain":"string","ips":["string"],"ports":[],"hostname":"Example Name","first_seen":"string","last_seen":"string","registration_date":"string","text":"string","attribute_tags":[{"attribute":"string","tag":"string","value":"string","index":123}]}

Add Email Object to Event using EML file

Convert each EML attachment into a MISP email object and append it to the specified event using event ID and email EML.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_id	string	Required	The MISP event ID (or UUID) to add each email object to
email_eml	array	Required	The EML file(s) to convert to email object(s)
email_eml.file	string	Optional	Parameter for Add Email Object to Event using EML file
email_eml.file_name	string	Optional	Name of the resource
email_eml.description	string	Optional	Parameter for Add Email Object to Event using EML file

Input Example

{"event_id":"string","email_eml":[{"file":"string","file_name":"Example Name","description":"string"}]}

Add Event

Add a new event to the MISP platform using provided headers for authentication and configuration.

Endpoint

URL: /events/add

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
org_id	string	Optional	Organisation ID. Length of the string must be less than or equal to 10 characters and all the characters of the string must be numbers.
distribution	string	Optional	Distribution Level ID. Who will be able to see this event once it becomes published and eventually when it becomes pulled. 0 - Your organization only, 1 - This community only, 2 - Connected communities, 3 - All communities, 4 - Sharing group, 5 - Inherit Event.
info	string	Optional	Event Info. Length of the string must be less than or equal to 1065535 characters.
orgc_id	string	Optional	Organisation ID. Length of the string must be less than or equal to 10 characters and all the characters of the string must be numbers.
uuid	string	Optional	UUID. Length of the string must be less than or equal to 36 characters.
date	string	Optional	Date value
published	boolean	Optional	Published Flag.
analysis	string	Optional	Analysis Level ID. Represents the analysis maturity level. 0 - Initial, 1 - Ongoing, 2 - Complete.
attribute_count	string	Optional	Event Attribute Count. All the characters of the string must be numbers.
timestamp	string	Optional	Nullable Timestamp. All the characters of the string must be numbers or null value also.
sharing_group_id	string	Optional	Sharing Group ID. Length of the string must be less than or equal to 10 characters and all the characters of the string must be numbers or null value also.
proposal_email_lock	boolean	Optional	Event Proposal Email Lock.
locked	boolean	Optional	Is Locked.
threat_level_id	string	Optional	Threat Level ID. Represents the threat level. 1 - High, 2 - Medium, 3 - Low, 4 - Undefined.
publish_timestamp	string	Optional	Timestamp. All the characters of the string must be numbers.
sighting_timestamp	string	Optional	Timestamp. All the characters of the string must be numbers.
disable_correlation	boolean	Optional	Disable Correlation Flag.
extends_uuid	string	Optional	Extends UUID. Length of the string must be less than or equal to 36 characters or null value also.
event_creator_email	string	Optional	Email.

Input Example

{"headers":{"Accept":"application/json","Content-Type":"application/json"},"org_id":"string","distribution":"string","info":"string","orgc_id":"string","uuid":"12345678-1234-1234-1234-123456789abc","date":"2024-01-01T00:00:00Z","published":true,"analysis":"string","attribute_count":"string","timestamp":"2024-01-01T00:00:00Z","sharing_group_id":"string","proposal_email_lock":true,"locked":true,"threat_level_id":"string","publish_timestamp":"0","sighting_timestamp":"0","disable_correlation":true,"extends_uuid":"string","event_creator_email":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Event	object	Output field: Event
Event.id	string	Unique identifier
Event.org_id	string	Unique identifier
Event.distribution	string	Output field: Event.distribution
Event.info	string	Output field: Event.info
Event.orgc_id	string	Unique identifier
Event.uuid	string	Unique identifier
Event.date	string	Date value
Event.published	boolean	Output field: Event.published
Event.analysis	string	Output field: Event.analysis
Event.attribute_count	string	Count value
Event.timestamp	string	Output field: Event.timestamp
Event.sharing_group_id	string	Unique identifier
Event.proposal_email_lock	boolean	Output field: Event.proposal_email_lock
Event.locked	boolean	Output field: Event.locked
Event.threat_level_id	string	Unique identifier
Event.publish_timestamp	string	Output field: Event.publish_timestamp
Event.sighting_timestamp	string	Output field: Event.sighting_timestamp
Event.disable_correlation	boolean	Output field: Event.disable_correlation
Event.extends_uuid	string	Unique identifier
Event.event_creator_email	string	Output field: Event.event_creator_email
Event.Feed	object	Output field: Event.Feed
Event.Feed.id	string	Unique identifier

Output Example

{"Event":{"id":"12345678-1234-1234-1234-123456789abc","org_id":"string","distribution":"string","info":"string","orgc_id":"string","uuid":"12345678-1234-1234-1234-123456789abc","date":"2024-01-01T00:00:00Z","published":true,"analysis":"string","attribute_count":"string","timestamp":"2024-01-01T00:00:00Z","sharing_group_id":"string","proposal_email_lock":true,"locked":true,"threat_level_id":"string"}}

Add Event Tag

Associate a tag with an event in MISP using the event ID, tag ID, and locality parameter.

Endpoint

URL: events/addTag/{{eventId}}/{{tagId}}/local:{{local}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Add Event Tag action
path_parameters.tagId	string	Required	Parameters for the Add Event Tag action
path_parameters.local	number	Required	Parameters for the Add Event Tag action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"eventId":"string","tagId":"string","local":1}}

Output

Parameter	Type	Description
saved	boolean	Output field: saved
success	string	Whether the operation was successful
check_publish	boolean	Output field: check_publish
errors	string	Error message if any

Output Example

{"saved":true,"success":"Tag added.","check_publish":true,"errors":"Tag could not be added."}

Add File object to event

Add a MISP file object to an event using metadata like full path and hashes. No file attachment is required. Optionally add tags to specific object attributes.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_id	string	Required	The MISP event ID (or UUID) to add the file object to
full_path	string	Optional	Full path of the file (e.g. /path/to/file.exe)
filename	string	Optional	File name (e.g. file.exe). If omitted, can be derived from full path
path	string	Optional	Path of the file (complete or partial)
md5	string	Optional	MD5 hash of the file
sha1	string	Optional	SHA-1 hash of the file
sha256	string	Optional	SHA-256 hash of the file
attribute_tags	array	Optional	Optional. List of { "attribute": " ", "tag": " " } to add a tag to specific file object attributes. "attribute" is the MISP attribute name (e.g. md5, sha256, filename, fullpath). "tag" is the tag name (e.g. tlp:white).
attribute_tags.attribute	string	Optional	MISP attribute name (e.g. md5, sha256, filename)
attribute_tags.tag	string	Optional	Tag name to add to this attribute

Input Example

{"event_id":"string","full_path":"string","filename":"Example Name","path":"string","md5":"string","sha1":"string","sha256":"string","attribute_tags":[{"attribute":"string","tag":"string"}]}

Add process object to event

Add a MISP process object to an event using details like pid, name, image, command-line, and parent info. Requires the event_id.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_id	string	Required	The MISP event ID (or UUID) to add the process object to
name	string	Optional	Name of the process
pid	string	Optional	Process ID of the process
parent_pid	string	Optional	Process ID of the parent process
image	string	Optional	Path of process image
command_line	string	Optional	Command line of the process
parent_command_line	string	Optional	Command line of the parent process
parent_image	string	Optional	Path of parent process image
parent_process_name	string	Optional	Process name of the parent
parent_process_path	string	Optional	Parent process path
current_directory	string	Optional	Current working directory of the process
args	string	Optional	Arguments of the process
creation_time	string	Optional	Local date/time at which the process was created (e.g. ISO 8601)
start_time	string	Optional	Local date/time at which the process was started (e.g. ISO 8601)
child_pid	string	Optional	Process ID(s) of child process(es); comma-separated or array
guid	string	Optional	Globally unique identifier assigned by the vendor product
parent_guid	string	Optional	Globally unique identifier of the parent process
pgid	string	Optional	Identifier of the process group
port	string	Optional	Port(s) owned by the process; comma-separated or array
process_state	string	Optional	State of process (e.g. R=Running, S=Sleeping, D=Uninterruptible sleep)
user_process	string	Optional	User who is running the process at the time of analysis
user_creator	string	Optional	User who created the process
integrity_level	string	Optional	Integrity level (e.g. system, high, medium, low, untrusted)
environment_variables	string	Optional	Environment variables associated with the process
hidden	boolean	Optional	Whether the process is hidden (true/false or 1/0)

Input Example

{"event_id":"string","name":"Example Name","pid":"string","parent_pid":"string","image":"string","command_line":"string","parent_command_line":"string","parent_image":"string","parent_process_name":"Example Name","parent_process_path":"string","current_directory":"string","args":"string","creation_time":"string","start_time":"string","child_pid":"string","guid":"string","parent_guid":"string","pgid":"string","port":"string","process_state":"string","user_process":"string","user_creator":"string","integrity_level":"string","environment_variables":"string","hidden":true,"fake_process_name":true}

Add Tag to Attribute

Associate a specified tag with an attribute in MISP using the attribute's ID, tag's ID, and locality.

Endpoint

URL: attributes/addTag/{{attributeId}}/{{tagId}}/local:{{local}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.attributeId	string	Required	Parameters for the Add Tag to Attribute action
path_parameters.tagId	string	Required	Parameters for the Add Tag to Attribute action
path_parameters.local	number	Required	Parameters for the Add Tag to Attribute action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"attributeId":"string","tagId":"string","local":1}}

Output

Parameter	Type	Description
saved	boolean	Output field: saved
success	string	Whether the operation was successful
check_publish	boolean	Output field: check_publish
errors	string	Error message if any

Output Example

{"saved":true,"success":"Tag added.","check_publish":true,"errors":"Tag could not be added."}

Add URL object to event

Add a URL object to a MISP event using the event ID and URL value. Scheme, host, domain, port, path, query string, fragment, and related fields are derived from the URL.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_id	string	Required	The MISP event ID (or UUID) to add the URL object to
url_value	string	Required	The full URL (e.g. https://example.com/path?q=1#section). All URL object attributes are derived from it.
ip_addresses	array	Optional	List of IPs to add as ip attributes to the URL object.
attribute_tags	array	Optional	Optional. List of { "attribute": " ", "tag": " ", ... } to add a tag to URL object attributes. "attribute" is the MISP attribute name (e.g. url, host, domain, scheme, port, ip, resource_path). "tag" is the tag name (e.g. tlp:white). For ip attributes you can target a specific IP with "value" (e.g. "1.2.3.4") or "index" (0-based). Without value/index, the tag is applied to all attributes of that type.
attribute_tags.attribute	string	Optional	MISP attribute name (e.g. url, host, domain, scheme, ip)
attribute_tags.tag	string	Optional	Tag name to add to this attribute
attribute_tags.value	string	Optional	For ip; tag only the attribute with this value (e.g. "1.2.3.4").
attribute_tags.index	integer	Optional	Tag only the attribute at this 0-based index among attributes of the same type.

Input Example

{"event_id":"string","url_value":"string","ip_addresses":["string"],"attribute_tags":[{"attribute":"string","tag":"string","value":"string","index":123}]}

Delete Attribute

Remove a specified attribute from MISP using the provided attribute ID, requiring path parameters and headers.

Endpoint

URL: attributes/delete/{{attributeId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.attributeId	string	Required	Parameters for the Delete Attribute action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"attributeId":"string"}}

Output

Parameter	Type	Description
message	string	Response message

Output Example

{"message":"Attribute deleted."}

Delete Event

Remove a specified event from MISP using the provided event ID in path parameters, with necessary headers.

Endpoint

URL: events/delete/{{eventId}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Delete Event action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"eventId":"string"}}

Output

Parameter	Type	Description
saved	boolean	Output field: saved
success	boolean	Whether the operation was successful
name	string	Name of the resource
message	string	Response message
url	string	URL endpoint for the request
errors	string	Error message if any

Output Example

{"saved":true,"success":true,"name":"Event deleted.","message":"Could not delete Event","url":"/events/delete/1","errors":"Event was not deleted."}

Edit Attribute

Modify an existing attribute in MISP using the specified attribute ID and updated details provided in the request.

Endpoint

URL: attributes/edit/{{attributeId}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.attributeId	string	Required	Parameters for the Edit Attribute action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
id	string	Optional	Unique identifier
event_id	string	Optional	Unique identifier
object_id	string	Optional	Unique identifier
object_relation	string	Optional	Parameter for Edit Attribute
category	string	Optional	Parameter for Edit Attribute
type	string	Optional	Type of the resource
value	string	Optional	Value for the parameter
to_ids	boolean	Optional	Unique identifier
uuid	string	Optional	Unique identifier
timestamp	string	Optional	Parameter for Edit Attribute
distribution	string	Optional	Parameter for Edit Attribute
sharing_group_id	string	Optional	Unique identifier
comment	string	Optional	Parameter for Edit Attribute
deleted	boolean	Optional	Parameter for Edit Attribute
disable_correlation	boolean	Optional	Parameter for Edit Attribute
first_seen	string	Optional	Parameter for Edit Attribute
last_seen	string	Optional	Parameter for Edit Attribute

Input Example

{"json_body":{"id":"12345","event_id":"12345","object_id":"12345","object_relation":"sensor","category":"Internal reference","type":"md5","value":"127.0.0.1","to_ids":true,"uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","timestamp":"1617875568","distribution":"0","sharing_group_id":"1","comment":"logged source ip","deleted":false,"disable_correlation":false,"first_seen":"1581984000000000","last_seen":"1581984000000000"},"path_parameters":{"attributeId":"string"}}

Output

Parameter	Type	Description
Attribute	object	Output field: Attribute
Attribute.id	string	Unique identifier
Attribute.event_id	string	Unique identifier
Attribute.object_id	string	Unique identifier
Attribute.object_relation	string	Output field: Attribute.object_relation
Attribute.category	string	Output field: Attribute.category
Attribute.type	string	Type of the resource
Attribute.value	string	Value for the parameter
Attribute.to_ids	boolean	Unique identifier
Attribute.uuid	string	Unique identifier
Attribute.timestamp	string	Output field: Attribute.timestamp
Attribute.distribution	string	Output field: Attribute.distribution
Attribute.sharing_group_id	string	Unique identifier
Attribute.comment	string	Output field: Attribute.comment
Attribute.deleted	boolean	Output field: Attribute.deleted
Attribute.disable_correlation	boolean	Output field: Attribute.disable_correlation
Attribute.first_seen	string	Output field: Attribute.first_seen
Attribute.last_seen	string	Output field: Attribute.last_seen

Output Example

Execute script

Execute a Python script using pymisp and bundled dependencies in MISP.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
script	string	Required	Multi-line Python code to run. Use "action_inputs" for input data. Set "action_outputs" to return a value (e.g. action_outputs = {"attachment": ..., "name": ...}). Dict keys are also exposed at top level for mapping.
action_inputs	object	Optional	Optional. Free-form object passed into the script as "action_inputs". Use any keys you need; they are available inside the script.

Input Example

{"script":"string","action_inputs":{}}

Get a Filtered and Paginated List of Attributes

Retrieve a filtered and paginated list of attributes from MISP, including specified request headers.

Endpoint

URL: attributes/restSearch

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
page	number	Optional	Parameter for Get a Filtered and Paginated List of Attributes
limit	number	Optional	Parameter for Get a Filtered and Paginated List of Attributes
value	string	Optional	Value for the parameter
value1	string	Optional	Value for the parameter
value2	string	Optional	Value for the parameter
type	string	Optional	Type of the resource
category	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
org	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
tags	array	Optional	Parameter for Get a Filtered and Paginated List of Attributes
from	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
to	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
last	number	Optional	Parameter for Get a Filtered and Paginated List of Attributes
eventid	string	Optional	Unique identifier
withAttachments	boolean	Optional	Parameter for Get a Filtered and Paginated List of Attributes
uuid	string	Optional	Unique identifier
publish_timestamp	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
published	boolean	Optional	Parameter for Get a Filtered and Paginated List of Attributes
timestamp	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
attribute_timestamp	string	Optional	Parameter for Get a Filtered and Paginated List of Attributes
enforceWarninglist	boolean	Optional	Parameter for Get a Filtered and Paginated List of Attributes
to_ids	boolean	Optional	Unique identifier
deleted	boolean	Optional	Parameter for Get a Filtered and Paginated List of Attributes

Input Example

{"json_body":{"page":0,"limit":1,"value":"127.0.0.1","value1":"127.0.0.1","value2":"127.0.0.1","type":"md5","category":"Internal reference","org":"12345","tags":["tlp:amber"],"from":"string","to":"string","last":0,"eventid":"12345","withAttachments":false,"uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","publish_timestamp":"1617875568","published":false,"timestamp":"1617875568","attribute_timestamp":"1617875568","enforceWarninglist":true,"to_ids":true,"deleted":false,"event_timestamp":"1617875568","threat_level_id":"1","eventinfo":"string","sharinggroup":["1"],"decayingModel":"string","score":"string","first_seen":"string","last_seen":"string","includeEventUuid":false,"includeEventTags":false,"includeProposals":false,"requested_attributes":["id"],"includeContext":true,"headerless":true,"includeWarninglistHits":true,"attackGalaxy":"mitre-attack","object_relation":"filepath","includeSightings":true,"includeCorrelations":true,"modelOverrides":{"lifetime":3,"decay_speed":2.3,"threshold":30,"default_base_score":80,"base_score_config":{"estimative-language:confidence-in-analytic-judgment":0.25,"estimative-language:likelihood-probability":0.25,"phishing:psychological-acceptability":0.25,"phishing:state":0.2}},"includeDecayScore":false,"includeFullModel":false,"excludeDecayed":false,"returnFormat":"json"}}

Output

Parameter	Type	Description
response	object	Output field: response
response.Attribute	array	Output field: response.Attribute
response.Attribute.id	string	Unique identifier
response.Attribute.event_id	string	Unique identifier
response.Attribute.object_id	string	Unique identifier
response.Attribute.object_relation	string	Output field: response.Attribute.object_relation
response.Attribute.category	string	Output field: response.Attribute.category
response.Attribute.type	string	Type of the resource
response.Attribute.value	string	Value for the parameter
response.Attribute.to_ids	boolean	Unique identifier
response.Attribute.uuid	string	Unique identifier
response.Attribute.timestamp	string	Output field: response.Attribute.timestamp
response.Attribute.distribution	string	Output field: response.Attribute.distribution
response.Attribute.sharing_group_id	string	Unique identifier
response.Attribute.comment	string	Output field: response.Attribute.comment
response.Attribute.deleted	boolean	Output field: response.Attribute.deleted
response.Attribute.disable_correlation	boolean	Output field: response.Attribute.disable_correlation
response.Attribute.first_seen	string	Output field: response.Attribute.first_seen
response.Attribute.last_seen	string	Output field: response.Attribute.last_seen
response.Attribute.data	string	Response data
response.Attribute.event_uuid	string	Unique identifier
response.Attribute.decay_score	array	Score value
response.Attribute.decay_score.score	number	Score value
response.Attribute.decay_score.base_score	number	Score value
response.Attribute.decay_score.decayed	boolean	Output field: response.Attribute.decay_score.decayed

Output Example

{"response":{"Attribute":[{}]}}

Get a Filtered and Paginated List of Objects

Retrieve a filtered and paginated list of objects from MISP based on specified criteria in headers and JSON body.

Endpoint

URL: /objects/restsearch

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
page	number	Optional	Integer or null. (PageSearchFilter) >= 1.
limit	number	Optional	Integer or null. (LimitSearchFilter) >= 0.
quickFilter	string	Optional	Search events by matching any tag names, event descriptions, attribute values or attribute comments (SearchAllRestSearchFilter).
searchall	string	Optional	Search events by matching any tag names, event descriptions, attribute values or attribute comments (SearchAllRestSearchFilter).
timestamp	string	Optional	Timestamp format is in ^\d+$.
object_name	string	Optional	Object name to search for. Less than or equal to 131071 characters.
object_template_uuid	string	Optional	Object template UUID to search for.
object_template_version	string	Optional	Object template version to search for. Format is in ^\d+$.
eventid	string	Optional	Event ID to search for. Format is in ^\d+$. Less than or equal to 10 characters.
eventinfo	string	Optional	Less than or equal to 65535 characters.
ignore	boolean	Optional	Default is false. If true matches both true and false values for to_ids and published.
from	string	Optional	Value is string or null. (DateRestSearchFilter) You can use any of the valid time related filters (examples are 7d, timestamps, [14d, 7d] for ranges, etc.).
to	string	Optional	Value is string or null. (DateRestSearchFilter) You can use any of the valid time related filters (examples are 7d, timestamps, [14d, 7d] for ranges, etc.).
date	string	Optional	Value is string or null. (DateRestSearchFilter) You can use any of the valid time related filters (examples are 7d, timestamps, [14d, 7d] for ranges, etc.).
tags	array	Optional	Array of strings (TagRestSearchFilter).
last	number	Optional	Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp (LastRestSearchFilter).
event_timestamp	string	Optional	Event timestamp format is in ^\d+$. Default is '0'.
publish_timestamp	string	Optional	Event timestamp format is in ^\d+$. Default is '0'.
org	string	Optional	Either Organisation ID or Organisation Name. If Organisation ID is used, Less than or equal to 10 characters. If Organisation Name is used, Less than or equal to 255 characters.
uuid	string	Optional	UUID to search for.
value	string	Optional	Value to search for. Less than or equal to 131071 characters (AttributeValue).
type	string	Optional	Type to search for. Less than or equal to 100 characters (AttributeType).

Input Example

{"headers":{"Accept":"application/json","Content-Type":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response	array	Output field: response
response.Object	object	Output field: response.Object
response.Object.id	string	Unique identifier
response.Object.name	string	Name of the resource
response.Object.meta-category	string	Output field: response.Object.meta-category
response.Object.description	string	Output field: response.Object.description
response.Object.template_uuid	string	Unique identifier
response.Object.template_version	string	Output field: response.Object.template_version
response.Object.event_id	string	Unique identifier
response.Object.uuid	string	Unique identifier
response.Object.timestamp	string	Output field: response.Object.timestamp
response.Object.distribution	string	Output field: response.Object.distribution
response.Object.sharing_group_id	string	Unique identifier
response.Object.comment	string	Output field: response.Object.comment
response.Object.deleted	boolean	Output field: response.Object.deleted
response.Object.first_seen	string	Output field: response.Object.first_seen
response.Object.last_seen	string	Output field: response.Object.last_seen
response.Object.Attribute	array	Output field: response.Object.Attribute
response.Object.Attribute.id	string	Unique identifier
response.Object.Attribute.event_id	string	Unique identifier
response.Object.Attribute.object_id	string	Unique identifier
response.Object.Attribute.object_relation	string	Output field: response.Object.Attribute.object_relation
response.Object.Attribute.category	string	Output field: response.Object.Attribute.category

Output Example

{"response":[{"Object":{}}]}

Get Attribute

Fetch a specific attribute from MISP for threat analysis and intelligence using provided headers.

Endpoint

URL: attributes

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json","Content-Type":"application/json"}}

Output Example

{"id":"12345","event_id":"12345","object_id":"12345","object_relation":"sensor","category":"Internal reference","type":"md5","value":"127.0.0.1","to_ids":true,"uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","timestamp":"1617875568","distribution":"0","sharing_group_id":"1","comment":"logged source ip","deleted":false,"disable_correlation":false}

Get Attribute by Id

Retrieve details for a specific attribute in MISP by providing the unique attribute ID. Requires headers and path parameters.

Endpoint

URL: attributes/view/{{attributeId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.attributeId	string	Required	Parameters for the Get Attribute by Id action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"attributeId":"string"}}

Output

Parameter	Type	Description
Attribute	object	Output field: Attribute
Attribute.id	string	Unique identifier
Attribute.event_id	string	Unique identifier
Attribute.object_id	string	Unique identifier
Attribute.object_relation	string	Output field: Attribute.object_relation
Attribute.category	string	Output field: Attribute.category
Attribute.type	string	Type of the resource
Attribute.value	string	Value for the parameter
Attribute.to_ids	boolean	Unique identifier
Attribute.uuid	string	Unique identifier
Attribute.timestamp	string	Output field: Attribute.timestamp
Attribute.distribution	string	Output field: Attribute.distribution
Attribute.sharing_group_id	string	Unique identifier
Attribute.comment	string	Output field: Attribute.comment
Attribute.deleted	boolean	Output field: Attribute.deleted
Attribute.disable_correlation	boolean	Output field: Attribute.disable_correlation
Attribute.first_seen	string	Output field: Attribute.first_seen
Attribute.last_seen	string	Output field: Attribute.last_seen

Output Example

Get Count of Attributes by Category

Retrieve the count of MISP attributes by category using context and percentage as path parameters.

Endpoint

URL: attributes/attributeStatistics/{{context}}/{{percentage}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.context	string	Required	Parameters for the Get Count of Attributes by Category action
path_parameters.percentage	number	Required	Parameters for the Get Count of Attributes by Category action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"context":"type","percentage":1}}

Output Example

{"Antivirus detection":"10"}

Get Event by Id

Retrieve detailed information for a specific event in MISP by providing the unique event ID as a path parameter and necessary headers.

Endpoint

URL: events/view/{{eventId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Get Event by Id action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"eventId":"string"}}

Output

Parameter	Type	Description
Event	object	Output field: Event
Event.id	string	Unique identifier
Event.org_id	string	Unique identifier
Event.distribution	string	Output field: Event.distribution
Event.info	string	Output field: Event.info
Event.orgc_id	string	Unique identifier
Event.uuid	string	Unique identifier
Event.date	string	Date value
Event.published	boolean	Output field: Event.published
Event.analysis	string	Output field: Event.analysis
Event.attribute_count	string	Count value
Event.timestamp	string	Output field: Event.timestamp
Event.sharing_group_id	string	Unique identifier
Event.proposal_email_lock	boolean	Output field: Event.proposal_email_lock
Event.locked	boolean	Output field: Event.locked
Event.threat_level_id	string	Unique identifier
Event.publish_timestamp	string	Output field: Event.publish_timestamp
Event.sighting_timestamp	string	Output field: Event.sighting_timestamp
Event.disable_correlation	boolean	Output field: Event.disable_correlation
Event.extends_uuid	string	Unique identifier
Event.event_creator_email	string	Output field: Event.event_creator_email
Event.Feed	object	Output field: Event.Feed
Event.Feed.id	string	Unique identifier
Event.Feed.name	string	Name of the resource
Event.Feed.provider	string	Unique identifier

Output Example

{"Event":{"id":"12345","org_id":"12345","distribution":"0","info":"logged source ip","orgc_id":"12345","uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","date":"1991-01-15","published":false,"analysis":"0","attribute_count":"321","timestamp":"1617875568","sharing_group_id":"1","proposal_email_lock":true,"locked":true,"threat_level_id":"1"}}

Get Events

Retrieves a list of threat intelligence events from MISP using specified headers for an informed security overview.

Endpoint

URL: events

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json","Content-Type":"application/json"}}

Output Example

{"id":"12345","org_id":"12345","distribution":"0","info":"logged source ip","orgc_id":"12345","uuid":"c99506a6-1255-4b71-afa5-7b8ba48c3b1b","date":"1991-01-15","published":false,"analysis":"0","attribute_count":"321","timestamp":"1617875568","sharing_group_id":"1","proposal_email_lock":true,"locked":true,"threat_level_id":"1"}

Get List of Attribute Types

Retrieve a list of available attribute types from MISP. Authentication headers are required.

Endpoint

URL: attributes/describeTypes

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json","Content-Type":"application/json"}}

Output

Parameter	Type	Description
sane_defaults	object	Output field: sane_defaults
sane_defaults.md5	object	Output field: sane_defaults.md5
sane_defaults.md5.default_category	string	Output field: sane_defaults.md5.default_category
sane_defaults.md5.to_ids	number	Unique identifier
sane_defaults.pdb	object	Output field: sane_defaults.pdb
sane_defaults.pdb.default_category	string	Output field: sane_defaults.pdb.default_category
sane_defaults.pdb.to_ids	number	Unique identifier
types	array	Type of the resource
categories	array	Output field: categories
category_type_mappings	object	Type of the resource
category_type_mappings.Internal reference	array	Type of the resource
category_type_mappings.Antivirus detection	array	Type of the resource

Output Example

{"sane_defaults":{"md5":{"default_category":"Payload delivery","to_ids":1},"pdb":{"default_category":"Artifacts dropped","to_ids":0}},"types":["md5"],"categories":["Internal reference"],"category_type_mappings":{"Internal reference":["text","link","comment"],"Antivirus detection":["link","comment","text"]}}

Publish Event

Publish a specified event in MISP using the provided eventId, requiring headers and path parameters.

Endpoint

URL: events/publish/{{eventId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Publish Event action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"eventId":"string"}}

Output

Parameter	Type	Description
name	string	Name of the resource
message	string	Response message
url	string	URL endpoint for the request
id	string	Unique identifier

Output Example

{"name":"Publish","message":"Job queued","url":"https://misp.local/events/alert/1","id":"string"}

Remove Event Tag

Remove a specified tag from an event in MISP using the provided event and tag IDs. Requires headers and path parameters.

Endpoint

URL: events/removeTag/{{eventId}}/{{tagId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.eventId	string	Required	Parameters for the Remove Event Tag action
path_parameters.tagId	string	Required	Parameters for the Remove Event Tag action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"eventId":"string","tagId":"string"}}

Output

Parameter	Type	Description
saved	boolean	Output field: saved
success	string	Whether the operation was successful
check_publish	boolean	Output field: check_publish
errors	string	Error message if any

Output Example

{"saved":true,"success":"Tag removed.","check_publish":true,"errors":"Tag could not be added."}

Remove Tag from Attribute

Remove a specified tag from an attribute in MISP using the provided attributeId and tagId.

Endpoint

URL: attributes/removeTag/{{attributeId}}/{{tagId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.attributeId	string	Required	Parameters for the Remove Tag from Attribute action
path_parameters.tagId	string	Required	Parameters for the Remove Tag from Attribute action
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"attributeId":"string","tagId":"string"}}

Output

Parameter	Type	Description
saved	boolean	Output field: saved
success	string	Whether the operation was successful
check_publish	boolean	Output field: check_publish
errors	string	Error message if any

Output Example

{"saved":true,"success":"Tag removed.","check_publish":true,"errors":"Tag could not be added."}

Search Events

Perform a search for events in MISP using specified headers to quickly locate relevant event data.

Endpoint

URL: events/index

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept	string	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request
page	number	Optional	Parameter for Search Events
limit	number	Optional	Parameter for Search Events
sort	string	Optional	Parameter for Search Events
direction	string	Optional	Parameter for Search Events
minimal	boolean	Optional	Parameter for Search Events
attribute	string	Optional	Parameter for Search Events
eventid	string	Optional	Unique identifier
datefrom	string	Optional	Parameter for Search Events
dateuntil	string	Optional	Parameter for Search Events
org	string	Optional	Parameter for Search Events
eventinfo	string	Optional	Parameter for Search Events
tag	string	Optional	Parameter for Search Events
tags	array	Optional	Parameter for Search Events
distribution	string	Optional	Parameter for Search Events
sharinggroup	string	Optional	Parameter for Search Events
analysis	string	Optional	Parameter for Search Events
threatlevel	string	Optional	Parameter for Search Events
email	string	Optional	Parameter for Search Events
hasproposal	string	Optional	Parameter for Search Events
timestamp	string	Optional	Parameter for Search Events
publish_timestamp	string	Optional	Parameter for Search Events
searchDatefrom	string	Optional	Parameter for Search Events

Input Example

{"json_body":{"page":0,"limit":1,"sort":"timestamp","direction":"asc","minimal":false,"attribute":"covert channel","eventid":"12345","datefrom":"2021-03-05","dateuntil":"2021-03-05","org":"CIRCL","eventinfo":"Phishing campaing","tag":"tlp:white","tags":["tlp:amber","cycat:scope=\"exploit\""],"distribution":"0","sharinggroup":"1","analysis":"0","threatlevel":"1","email":"[email protected]","hasproposal":"1","timestamp":"1","publish_timestamp":"1","searchDatefrom":"2020-01-20","searchDateuntil":"2020-01-20"}}

Output Example

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT