MISP V3

Malware information sharing platform and threat sharing.

Data Enrichment & Threat Intelligence · MISP

Configuration parameters

  • url — MISP server URL (e.g., https://192.168.0.1) (required)
  • credentials —
  • certificate — Client Certificate
  • check_to_ids — Use IDS flag
  • allowed_orgs — ORG names to use for reputation checks
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • malicious_tag_ids — Malicious tag IDs
  • suspicious_tag_ids — Suspicious tag IDs
  • benign_tag_ids — Benign tag IDs
  • search_warninglists — Should the warninglists be considered when searching for an attribute
  • integrationReliability — Source Reliability (required)
  • attributes_limit — Maximum attributes to be returned

Commands (34)

  • domain

    Checks the reputation of the given domain.

  • email

    Checks the reputation of the given email address.

  • file

    Checks the file reputation of the given hash.

  • ip

    Checks the reputation of an IP address.

  • misp-add-attribute

    Adds an attribute to an existing MISP event.

  • misp-add-custom-object

    Adds custom objects to MISP.

  • misp-add-domain-object

    Adds a domain object to MISP.

  • misp-add-email-object

    Adds an email object to the specified event ID.

  • misp-add-events-from-feed

    Adds an OSINT feed. Only feeds in the misp format are allowed. For example have manifest.json.

  • misp-add-file-object

    Adds a file object to the specified event ID.

  • misp-add-ip-object

    Adds an IP object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".

  • misp-add-object

    Adds any other object to MISP.

  • misp-add-sighting

    Add sighting to an attribute.

  • misp-add-tag-to-attribute

    Adds a tag to the given UUID attribute.

  • misp-add-tag-to-event

    Adds a tag to the given UUID event .

  • misp-add-url-object

    Adds a URL object to an MISP event.

  • misp-add-user

    Add a new user to MISP.

  • misp-change-warninglist

    Changes a warninglist in MISP.

  • misp-check-warninglist

    Check a list of indicator values against the MISP warninglist.

  • misp-create-event

    Creates a new MISP event.

  • misp-delete-attribute

    Delete an attribute according to the given attribute ID.

  • misp-delete-event

    Deletes an event according to the given event ID.

  • misp-get-organization-info

    Display the organization IDs and names.

  • misp-get-role-info

    Display role names and role IDs.

  • misp-get-warninglist

    Get a specific warninglist by its ID.

  • misp-get-warninglists

    Gets all warninglists from MISP

  • misp-publish-event

    Publish an event.

  • misp-remove-tag-from-attribute

    Removes a tag from the given UUID attribute.

  • misp-remove-tag-from-event

    Removes a tag from the given UUID event .

  • misp-search-attributes

    Search for attributes in MISP.

  • misp-search-events

    Search for events in MISP. This search command will return only information about the matched events. To get information about attributes, use the misp-search-attributes command.

  • misp-set-event-attributes

    Set event attributes according to the given attributes data.

  • misp-update-attribute

    Update an attribute of an existing MISP event.

  • url

    Checks the reputation of the given URL.