category: Data Enrichment & Threat Intelligence provider: Open Source commonfields: id: MISP V3 version: -1 sectionorder: - Connect - Collect configuration: - display: MISP server URL (e.g., https://192.168.0.1) name: url required: true type: 0 section: Connect - displaypassword: API Key name: credentials type: 9 hiddenusername: true display: "" required: false section: Connect - display: Client Certificate displaypassword: Private Key name: certificate type: 9 required: false section: Connect - display: Use IDS flag name: check_to_ids defaultvalue: "true" type: 8 required: false additionalinfo: This is to enable checking the boolean flag to_ids. The flag allows you to indicate if an attribute should be actionable or not. section: Collect - display: ORG names to use for reputation checks name: allowed_orgs type: 12 required: false additionalinfo: Comma-separated list of allowed TI providers (orgc in MISP events). When pulling data from MISP you may have data coming from a reliable source. However, some of the orgs are including things like 8.8.8.8 in their feeds. This parameter is used to filter such orgs out by specifying the exact list of orgs to trust. section: Collect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - additionalinfo: Comma-separated list of event's or attribute's malicious tag IDs. Malicious tags are stronger than suspicious tags. display: Malicious tag IDs name: malicious_tag_ids type: 12 required: false section: Collect - additionalinfo: Comma-separated list of event's or attribute's suspicious tag IDs. Malicious tags are stronger than suspicious tags. display: Suspicious tag IDs name: suspicious_tag_ids type: 12 required: false section: Collect - additionalinfo: Comma-separated list of event's or attribute's benign tag IDs. Malicious and suspicious tags are stronger than benign tags. display: Benign tag IDs name: benign_tag_ids type: 12 required: false section: Collect - display: Should the warninglists be considered when searching for an attribute name: search_warninglists defaultvalue: "false" type: 8 required: false section: Collect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - additionalinfo: This field limits the number of attributes that will be written to the context for every reputation command. Raising the number of attributes may result in high memory and disk usage. defaultvalue: '20' display: Maximum attributes to be returned name: attributes_limit type: 0 required: false section: Collect description: Malware information sharing platform and threat sharing. display: MISP v3 name: MISP V3 script: commands: - arguments: - description: 'Search for events that include the specified attribute type. Use any valid MISP attribute type. For example: "md5", "sha1", "email", "url".' name: type - description: 'Search for events that include the specified attribute value. For example: "1.2.3.4" (and other IP addresses), "google.com" (and other domains), "www.example.com" (and other URLs).' name: value - description: 'Search for events that include the specified attribute category. Use any valid MISP attribute category. For example: "Other", "Person", "Attribution", "Payload type".' name: category - description: Search by creator organization by supplying the organization ID. name: org - description: 'A comma-separated list of tags to include in the results. To exclude a tag, prefix the tag name with "!". Can be: "AND", "OR", and "NOT" followed by ":". To chain logical operators use ";". For example, "AND:tag1,tag2;OR:tag3".' name: tags - description: Event search start date in the format yyyy-mm-dd. For example, 2015-02-15. This date refers to the event creation date. name: from - description: Event search end date in the format yyyy-mm-dd. For example, 2015-02-15. This date refers to the event creation date. name: to - description: Events published within the last "x" amount of time. Valid time values are days, hours, and minutes. For example, "5d", "12h", "30m". This filter uses the published timestamp of the event. name: last - description: A comma-separated list of event IDs to be returned by the search. isArray: true name: event_id - description: The event UUID to be returned by the search. For example, 59523300-4be8-4fa6-8867-0037ac110002. name: uuid - description: If a limit is set, sets the page to be returned. For example, page 3, limit 100 will return records 201->300. defaultValue: '1' name: page - description: Limit the number of events returned. name: limit defaultValue: '50' - auto: PREDEFINED description: Whether to return the event related feeds. Possible values are "true" and "false". Note, Only if this argument set to "true" the response will include attributes' feed hits values. name: include_feed_correlations predefined: - 'true' - 'false' - description: 'Search for events that include match the searchstring in the events info field.' name: eventinfo description: Search for events in MISP. This search command will return only information about the matched events. To get information about attributes, use the misp-search-attributes command. name: misp-search-events outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: string - contextPath: MISP.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Info description: Event name. type: string - contextPath: MISP.Event.AttributeCount description: Number of attributes of the event. type: string - contextPath: MISP.Event.OrganizationID description: Event organization ID. type: string - contextPath: MISP.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.Organization.ID description: Organization ID. type: number - contextPath: MISP.Event.Organization.Name description: Organization name. type: string - contextPath: MISP.Event.Organization.UUID description: Organization UUID. type: string - contextPath: MISP.Event.Organization.local description: Is the organization local. type: boolean - contextPath: MISP.Event.OwnerOrganization.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.OwnerOrganization.local description: Is the owner organization local. type: boolean - contextPath: MISP.Event.ProposalEmailLock description: Is email lock proposed. type: boolean - contextPath: MISP.Event.LastChanged description: Last change event timestamp. type: date - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: string - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Event.Tag.is_galaxy description: Is the tag galaxy. type: boolean - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Feed.ID description: Feed id. type: String - contextPath: MISP.Event.Feed.Name description: Feed name. type: String - contextPath: MISP.Event.Feed.Provider description: Feed provider. type: String - contextPath: MISP.Event.Feed.SourceFormat description: Feed source format (MISP for example). type: String - contextPath: MISP.Event.Feed.URL description: Feed url. type: String - contextPath: MISP.Event.Feed.EventUUIDS description: List of event uuids include the feed. type: Unknown - contextPath: MISP.Event.Attribute.Feed.ID description: Attribute feed id. type: String - contextPath: MISP.Event.Attribute.Feed.Name description: Attribute feed name. type: String - contextPath: MISP.Event.Attribute.Feed.Provider description: Attribute feed provider. type: String - contextPath: MISP.Event.Attribute.Feed.SourceFormat description: Attribute feed source format (MISP for example). type: String - contextPath: MISP.Event.Attribute.Feed.URL description: Attribute feed url. type: String - contextPath: MISP.Event.Attribute.Feed.EventUUIDS description: List of event uuids include the attribute feed. type: Unknown - contextPath: MISP.Event.Attribute.ID description: MISP attribute ID. type: String - contextPath: MISP.Event.Attribute.Value description: MISP attribute value. type: String - arguments: - default: true description: Domain to search. isArray: true name: domain required: true description: Checks the reputation of the given domain. name: domain outputs: - contextPath: Domain.Name description: The domain of the indicator. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.LastChanged description: Last change event timestamp. type: string - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Owner organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.local description: Is owner organization local. type: boolean - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Attribute.Event.Tag.Name description: Event tag name. type: string - contextPath: MISP.Attribute.Event.Tag.ID description: Event tag ID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.ID description: Attribute tag ID. type: string - contextPath: MISP.Attribute.Sighting.Type description: Attribute's sighting type. type: string - arguments: - default: true description: Email address to search. isArray: true name: email required: true description: Checks the reputation of the given email address. name: email outputs: - contextPath: Email.Address description: The email address of the indicator. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.LastChanged description: Last change event timestamp. type: string - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Owner organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.local description: Is owner organization local. type: boolean - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Attribute.Event.Tag.Name description: Event tag name. type: string - contextPath: MISP.Attribute.Event.Tag.ID description: Event tag ID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.ID description: Attribute tag ID. type: string - contextPath: MISP.Attribute.Sighting.Type description: Attribute's sighting type. type: string - arguments: - default: true description: Hash of the file to query. Supports MD5, SHA-1, and SHA-256. isArray: true name: file required: true description: Checks the file reputation of the given hash. name: file outputs: - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.LastChanged description: Last change event timestamp. type: string - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Owner organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.local description: Is owner organization local. type: boolean - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Attribute.Event.Tag.Name description: Event tag name. type: string - contextPath: MISP.Attribute.Event.Tag.ID description: Event tag ID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.ID description: Attribute tag ID. type: string - contextPath: MISP.Attribute.Sighting.Type description: Attribute's sighting type. type: string - arguments: - default: true description: URL to check. isArray: true name: url required: true description: Checks the reputation of the given URL. name: url outputs: - contextPath: URL.Data description: The URL of the indicator. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.LastChanged description: Last change event timestamp. type: string - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Owner organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.local description: Is owner organization local. type: boolean - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Attribute.Event.Tag.Name description: Event tag name. type: string - contextPath: MISP.Attribute.Event.Tag.ID description: Event tag ID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.ID description: Attribute tag ID. type: string - contextPath: MISP.Attribute.Sighting.Type description: Attribute's sighting type. type: string - arguments: - default: true description: IP address to check. isArray: true name: ip required: true description: Checks the reputation of an IP address. name: ip outputs: - contextPath: IP.Address description: The IP address. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.LastChanged description: Last change event timestamp. type: string - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Owner organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.local description: Is owner organization local. type: boolean - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Attribute.Event.Tag.Name description: Event tag name. type: string - contextPath: MISP.Attribute.Event.Tag.ID description: Event tag ID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.ID description: Attribute tag ID. type: string - contextPath: MISP.Attribute.Sighting.Type description: Attribute's sighting type. type: string - arguments: - defaultValue: other description: 'Attribute type to be created as part of the new event. For example: "md5", "sha1", "email", "url".' name: type - defaultValue: External analysis description: 'Attribute category to be created as part of the new event. For example: "Other", "Person", "Attribution", "Payload type".' name: category - auto: PREDEFINED defaultValue: 'true' description: 'Whether to create the event''s attribute with the Intrusion Detection System flag. Possible values are: true, false.' name: to_ids predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: Your_organization_only description: 'Where to distribute the event. Possible values: "Your_organization_only", "This_community_only", "Connected_communities", "All_communities", "Sharing_group" and "Inherit_event".' name: distribution predefined: - Your_organization_only - This_community_only - Connected_communities - All_communities - Sharing_group - Inherit_event - description: Attribute comment to be created as part of the new event. name: comment - description: 'Attribute value to be created as part of the new event. For example: "1.2.3.4" (and other IP addresses), "google.com" (and other domains), "www.example.com" (and other URLs).' name: value required: true - default: true description: Event name. name: info required: true - auto: PREDEFINED defaultValue: 'false' description: 'Whether to publish the event. Possible values: "false" and "true".' name: published predefined: - 'false' - 'true' - auto: PREDEFINED defaultValue: High description: 'MISP Threat level ID. Possible values: "High", "Medium", "Low", and "Unknown".' name: threat_level_id predefined: - High - Medium - Low - Unknown - auto: PREDEFINED defaultValue: initial description: 'The analysis event level. Possible values: "initial", "ongoing", and "completed".' name: analysis predefined: - initial - ongoing - completed - description: Sharing group ID. Mandatory when Sharing_group distribution is set. name: sharing_group_id - description: Set the creation date for the event in the format YYYY-MM-DD. name: creation_date description: Creates a new MISP event. name: misp-create-event outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: string - contextPath: MISP.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Info description: Event name. type: string - contextPath: MISP.Event.AttributeCount description: Number of attributes of the event. type: string - contextPath: MISP.Event.OrganizationID description: Event organization ID. type: string - contextPath: MISP.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.Organization.ID description: Organization ID. type: number - contextPath: MISP.Event.Organization.Name description: Organization name. type: string - contextPath: MISP.Event.Organization.UUID description: Organization UUID. type: string - contextPath: MISP.Event.Organization.local description: Is the organization local. type: boolean - contextPath: MISP.Event.OwnerOrganization.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.OwnerOrganization.local description: Is the owner organization local. type: boolean - contextPath: MISP.Event.ProposalEmailLock description: If email lock is proposed. type: boolean - contextPath: MISP.Event.LastChanged description: Last change event timestamp. type: date - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: string - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Event.Tag.is_galaxy description: Is the tag galaxy. type: boolean - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - arguments: - description: MISP event ID. name: event_id required: true - defaultValue: other description: 'Attribute type. For example: "md5", "sha1", "email", "url".' name: type - defaultValue: External analysis description: 'Attribute category. For example: "Other", "Person", "Attribution", "Payload type".' name: category - auto: PREDEFINED defaultValue: 'true' description: 'Whether to create the attribute with the Intrusion Detection System flag. Possible values are: true, false.' name: to_ids predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: Inherit_event description: 'Where to distribute the event. Possible values: "Your_organization_only", "This_community_only", "Connected_communities", "Sharing_group", "All_communities", and "Inherit_event".' name: distribution predefined: - Your_organization_only - This_community_only - Connected_communities - All_communities - Sharing_group - Inherit_event - description: Comment for the attribute. name: comment - description: 'A comma-separated list of attribute values. For example: "1.2.3.4,1.1.1.1" (and other IP addresses), "google.com" (and other domains), "www.example.com" (and other URLs).' isArray: true name: value required: true - description: Sharing group ID. Mandatory when Sharing_group distribution is set. name: sharing_group_id description: Adds an attribute to an existing MISP event. name: misp-add-attribute outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Event owner organization ID. type: string - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - arguments: - description: Event ID to delete. name: event_id required: true description: Deletes an event according to the given event ID. name: misp-delete-event - arguments: - description: UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. name: uuid required: true - description: Tag to remove from the event. name: tag required: true description: Removes a tag from the given UUID event . name: misp-remove-tag-from-event outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: string - contextPath: MISP.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Info description: Event name. type: string - contextPath: MISP.Event.AttributeCount description: Number of attributes of the event. type: string - contextPath: MISP.Event.OrganizationID description: Event organization ID. type: string - contextPath: MISP.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.Organization.ID description: Organization ID. type: number - contextPath: MISP.Event.Organization.Name description: Organization name. type: string - contextPath: MISP.Event.Organization.UUID description: Organization UUID. type: string - contextPath: MISP.Event.Organization.local description: Is the organization local. type: boolean - contextPath: MISP.Event.OwnerOrganization.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.OwnerOrganization.local description: Is the owner organization local. type: boolean - contextPath: MISP.Event.ProposalEmailLock description: If email lock proposed. type: boolean - contextPath: MISP.Event.LastChanged description: Last change event timestamp. type: date - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: string - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Event.Tag.is_galaxy description: Is the tag galaxy. type: boolean - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - arguments: - description: UUID of the event. For example, 59575300-4be8-4ff6-8767-0037ac110032. name: uuid required: true - description: Tag to add to the event. name: tag required: true - auto: PREDEFINED description: Whether to add the tag as a local tag. name: is_local predefined: - 'true' - 'false' description: Adds a tag to the given UUID event . name: misp-add-tag-to-event outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: string - contextPath: MISP.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: string - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Info description: Event name. type: string - contextPath: MISP.Event.AttributeCount description: Number of attributes of the event. type: string - contextPath: MISP.Event.OrganizationID description: Event organization ID. type: string - contextPath: MISP.Event.CreationDate description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.Organization.ID description: Organization ID. type: number - contextPath: MISP.Event.Organization.Name description: Organization name. type: string - contextPath: MISP.Event.Organization.UUID description: Organization UUID. type: string - contextPath: MISP.Event.Organization.local description: Is the organization local. type: boolean - contextPath: MISP.Event.OwnerOrganization.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganization.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganization.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.OwnerOrganization.local description: Is the owner organization local. type: boolean - contextPath: MISP.Event.ProposalEmailLock description: If email lock proposed. type: boolean - contextPath: MISP.Event.LastChanged description: Last change event timestamp. type: date - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: string - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: string - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: string - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Event.Tag.is_galaxy description: Is the tag galaxy. type: boolean - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - arguments: - description: UUID of the attribute. For example, 59575300-4be8-4ff6-8767-0037ac110032. name: uuid required: true - description: Tag to add to the attribute. name: tag required: true - auto: PREDEFINED description: Whether to add the tag as a local tag. name: is_local predefined: - 'true' - 'false' - name: disable_output description: If true, the attribute information will not be displayed in the response, reducing the runtime. defaultValue: "false" predefined: - "false" - "true" auto: PREDEFINED description: Adds a tag to the given UUID attribute. name: misp-add-tag-to-attribute outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Event owner organization ID. type: string - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.is_galaxy description: Is the tag galaxy. type: string - arguments: - description: UUID of the attribute. For example, 59575300-4be8-4ff6-8767-0037ac110032. name: uuid required: true - description: Tag to remove from the attribute. name: tag required: true description: Removes a tag from the given UUID attribute. name: misp-remove-tag-from-attribute outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.ObjectID description: Attribute object ID. type: string - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: Event owner organization ID. type: string - contextPath: MISP.Attribute.Event.UUID description: MISP event UUID. type: string - contextPath: MISP.Attribute.Tag.Name description: Attribute tag name. type: string - contextPath: MISP.Attribute.Tag.is_galaxy description: Is the tag galaxy. type: string - arguments: - auto: PREDEFINED description: 'Type of sighting to add. Possible values: "sighting", "false_positive", and "expiration".' name: type predefined: - sighting - false_positive - expiration required: true - description: ID of attribute to add sighting to (Must be filled if UUID or value is empty). Can be retrieved from the misp-search commands. name: id - description: UUID of the attribute to add sighting to (Must be filled if ID or value is empty). Can be retrieved from the misp-search commands. name: uuid - description: Value of the attribute to add sighting to. (Must be filled if ID or UUID is empty). Adds sighting to all attributes with this value. Takes precedence over (UU)ID. Can be retrieved from the misp-search commands. name: value - description: Sighting source. name: source description: Add sighting to an attribute. name: misp-add-sighting - arguments: - auto: PREDEFINED description: 'URL of the feed to add. Possible values: CIRCL and "Botvrij.eu".' name: feed predefined: - CIRCL - Botvrij.eu required: true - default: true defaultValue: '2' description: Maximum number of files to add. name: limit description: Adds an OSINT feed. Only feeds in the misp format are allowed. For example have manifest.json. name: misp-add-events-from-feed outputs: - contextPath: MISP.Event.ID description: IDs of the newly created events. type: string - arguments: - description: Entry ID of the file. name: entry_id required: true - description: Event ID to which to add the object to. name: event_id required: true description: Adds a file object to the specified event ID. name: misp-add-file-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: Entry ID of the email (only supports .eml files). name: entry_id required: true - description: ID of the event to which to add object to. name: event_id required: true description: Adds an email object to the specified event ID. name: misp-add-email-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of an MISP event. name: event_id required: true - description: The domain name. For example, "google.com". name: name required: true - description: A comma-separated list of IP addresses resolved by DNS. isArray: true name: ip required: true - description: A description of the domain. name: text description: Adds a domain object to MISP. name: misp-add-domain-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: Full URL to add to the event. name: url required: true - description: Date that this URL was first seen. For example, `2019-02-03`. name: first_seen - description: Description of the URL. name: text - description: Date that this URL was last seen. For example, `2019-02-03`. name: last_seen - description: ID of a MISP event. name: event_id required: true description: Adds a URL object to an MISP event. name: misp-add-url-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of the event to add the object to. name: event_id required: true - description: Template name. (Can be found at https://www.misp-project.org/objects.html). For example, 'vehicle'. name: template required: true - description: 'Attributes. For example, {"description": "Manager Ferrari", "make": "Ferrari", "model": "308 GTS"}.' name: attributes required: true description: Adds any other object to MISP. name: misp-add-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted?. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of the event to add the object to. name: event_id required: true - description: Custom Template name. name: template required: true - description: 'Attributes. For example, {"description": "Manager Ferrari", "make": "Ferrari", "model": "308 GTS"}.' name: attributes required: true description: Adds custom objects to MISP. name: misp-add-custom-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted?. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of a MISP event. name: event_id required: true - description: A comma-separated list of IP addresses. isArray: true name: ip - description: Destination port number. name: dst_port - description: Source port number. name: src_port - description: Domain name. name: domain - description: Hostname. For example, 'mail123.example.com'. name: hostname - description: IP source address. name: ip_src - description: IP destination address. name: ip_dst - description: Date when the IP address was first seen. For example, `2019-02-03`. name: first_seen - description: Date when the IP address was last seen. For example, `2019-02-03`. name: last_seen - description: Description of the object to be set as a text attribute. name: comment description: 'Adds an IP object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".' name: misp-add-ip-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.LastChanged description: Timestamp when the object was last changed. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.LastChanged description: Attribute last changed timestamp. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: 'The attribute type. Use any valid MISP attribute type. For example: "md5", "sha1", "email", "url".' name: type - description: 'Search for the specified value in the attribute''s value field. For example: "1.2.3.4" (and other IP addresses), "google.com" (and other domains), "www.example.com" (and other URLs).' name: value - description: 'The attribute category. Use any valid MISP attribute category. For example: "Other", "Person", "Attribution", "Payload type".' name: category - description: Return attributes with the given UUID. Alternatively, return all the attributes that are part of the given UUID's event. For example, 59523300-4be8-4fa6-8867-0037ac110002. name: uuid - auto: PREDEFINED description: 'Whether to return only the attributes set with the "to_ids" flag. The default is to return all attributes without with and with out to_ids flag. Possible values are: true, false.' name: to_ids predefined: - 'true' - 'false' - description: Search attributes of events published within the last "x" amount of time. Valid time values are days, hours, and minutes. For example, "5d", "12h", "30m". This filter uses the published timestamp of the event. name: last - auto: PREDEFINED description: 'Whether to return the decay score at the attribute level. Possible values are: true, false.' name: include_decay_score predefined: - 'true' - 'false' - description: Search by the creator organization by supplying the organization identifier. name: org - description: 'A comma-separated list of tags to include in the results. To exclude a tag, prefix the tag name with "!". Can be: "AND", "OR", and "NOT" followed by ":". To chain logical operators use ";". For example, "AND:tag1,tag2;OR:tag3".' isArray: true name: tags - description: Events with the date set to a date after the one specified. This filter will use the date of the event. name: from - description: Events with the date set to a date before the one specified. This filter will use the date of the event. name: to - description: A comma-separated list of event IDs. Returns the attributes that are part of the given event IDs. isArray: true name: event_id - auto: PREDEFINED description: 'Whether to include the the sightings of the matching attributes. Default is false. Possible values are: true, false.' name: include_sightings predefined: - 'true' - 'false' - auto: PREDEFINED description: 'Whether to include the full correlations of the matching attributes. Possible values are: true, false. Default is false.' name: include_correlations predefined: - 'true' - 'false' - auto: PREDEFINED description: 'Whether to include the file data of the matching attributes. Possible values are: true, false. Default is false.' name: with_attachments predefined: - 'true' - 'false' - description: If a limit is set, sets the page to be returned. For example, page 3, limit 100 will return records 201->300. Default is 1. defaultValue: '1' name: page - description: Limit the number of attributes returned. Default is 50. name: limit defaultValue: '50' - auto: PREDEFINED description: 'Whether to return only the values that are not on the warninglists. Possible values are: true, false.' name: enforceWarninglist predefined: - 'true' - 'false' - auto: PREDEFINED description: 'Whether to return only the attribute''s values that match the search query. In case you want to get the full attributes data, set this argument to false. Possible values are: true, false.' defaultValue: 'false' name: compact predefined: - 'true' - 'false' description: Search for attributes in MISP. name: misp-search-attributes outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ObjectID description: Attribute's object ID. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ObjectRelation description: Attribute's object relation. type: string - contextPath: MISP.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: string - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: string - contextPath: MISP.Attribute.Event.Info description: MISP event name. type: string - contextPath: MISP.Attribute.Event.OrganizationID description: MISP event organization ID. type: string - contextPath: MISP.Attribute.Event.OwnerOrganization.ID description: MISP event owner organization ID. type: string - contextPath: MISP.Attribute.Event.UUID description: Event UUID. type: string - contextPath: MISP.Attribute.Object.Distribution description: Distribution of object. type: Number - contextPath: MISP.Attribute.Object.ID description: ID of the object. type: Number - contextPath: MISP.Attribute.Object.SharingGroupID description: Object sharing group ID. type: String - contextPath: MISP.Attribute.Tag.Name description: All tag names in the attribute. type: string - contextPath: MISP.Attribute.Tag.is_galaxy description: Is the tag is a galaxy. type: Boolean - contextPath: MISP.Attribute.Sighting.Type description: Sighting type. type: String - arguments: - description: UUID of the attribute to be updated. name: attribute_uuid required: true - description: 'Attribute type. For example: "md5", "sha1", "email", "url".' name: type - description: 'Attribute category. For example: "Other", "Person", "Attribution", "Payload type".' name: category - auto: PREDEFINED description: 'Where to distribute the event. Possible values: "Your_organization_only", "This_community_only", "Connected_communities", "All_communities", and "Inherit_event".' name: distribution predefined: - Your_organization_only - This_community_only - Connected_communities - All_communities - Inherit_event - description: Comment for the attribute. name: comment - description: 'Attribute value. For example: "1.2.3.4" (and other IP addresses), "google.com" (and other domains), "www.example.com" (and other URLs).' name: value - description: Updated date when the attribute was first seen. For example, `2019-02-03`. name: first_seen - description: Updated date when the attribute was last seen. For example, `2019-02-03`. name: last_seen description: Update an attribute of an existing MISP event. name: misp-update-attribute outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: string - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: string - contextPath: MISP.Attribute.last_seen description: Attribute last_seen timestamp. type: string - contextPath: MISP.Attribute.first_seen description: Attribute first_seen timestamp. type: string - contextPath: MISP.Attribute.LastChanged description: Attribute last changed timestamp. type: date - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: string - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: string - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - arguments: - description: Attribute ID to delete. name: attribute_id required: true description: Delete an attribute according to the given attribute ID. name: misp-delete-attribute - arguments: - description: Event ID to be published. name: event_id required: true - auto: PREDEFINED description: Whether to send an email. The default is to not send a mail. name: alert predefined: - 'true' - 'false' description: Publish an event. name: misp-publish-event - arguments: - description: Event ID to set attributes for. name: event_id required: true - description: 'Adjust current attributes of an event to match the given attribute data. Has to be json formated list with attributes that should be part of the event. E.g.: [{"type":"domain","value":"target.domain"},{"type":"ip-dst","value":"1.2.3.4"}].' name: attribute_data required: true description: Set event attributes according to the given attributes data. name: misp-set-event-attributes - arguments: - description: Indicator values to check against the MISP warninglist. name: value required: true description: Check a list of indicator values against the MISP warninglist. name: misp-check-warninglist outputs: - contextPath: MISP.Warninglist.Count description: Count on how many warninglists the value was found. type: number - contextPath: MISP.Warninglist.Value description: Value checked. type: string - contextPath: MISP.Warninglist.Lists description: Name of warninglists where the value was found. type: string - arguments: - description: The email address of the new user to be added. name: email required: true type: textArea - description: ID number indicating which organization the new user will be added to. In order to get the org_id, use the command misp-get-organization-info. name: org_id required: true type: textArea - description: Role of the new user to be added. In order to get the role_id, use the command misp-get-role-info. name: role_id required: true type: textArea - description: A password for the new user. Ensure that the password is at least 12 characters long, contains at least one upper-case, includes a digit or a special character, and at least one lower-case character. name: password required: true description: Add a new user to MISP. name: misp-add-user outputs: - contextPath: MISP.User.id description: MISP user ID. type: string - contextPath: MISP.User.password description: MISP user password. type: string - contextPath: MISP.User.org_id description: MISP user organisation ID. type: string - contextPath: MISP.User.server_id description: MISP user server ID. type: string - contextPath: MISP.User.email description: MISP user email. type: string - contextPath: MISP.User.autoalert description: MISP user auto alert. type: boolean - contextPath: MISP.User.authkey description: MISP User auth key. type: string - contextPath: MISP.User.invited_by description: MISP user invited by. type: string - contextPath: MISP.User.gpgkey description: MISP user GPG key. type: string - contextPath: MISP.User.certif_public description: MISP User public certificate. type: string - contextPath: MISP.User.nids_sid description: MISP user Network Intrusion Detection System (NIDS) Signature ID (SID). type: string - contextPath: MISP.User.termsaccepted description: Whether MISP user terms were accepted. type: boolean - contextPath: MISP.User.newsread description: MISP user news read. type: string - contextPath: MISP.User.role_id description: MISP user role ID. type: string - contextPath: MISP.User.change_pw description: Whether the MISP user password was changed. type: boolean - contextPath: MISP.User.contactalert description: MISP user contact alert. type: boolean - contextPath: MISP.User.disabled description: Whether the MISP user was disabled. type: boolean - contextPath: MISP.User.expiration description: MISP user expiration. type: string - contextPath: MISP.User.current_login description: MISP user current login. type: string - contextPath: MISP.User.last_login description: MISP user last login. type: string - contextPath: MISP.User.force_logout description: MISP user force logout. type: boolean - contextPath: MISP.User.date_created description: MISP user created date. type: string - contextPath: MISP.User.date_modified description: MISP user modified date. type: string - arguments: [] description: Display the organization IDs and names. name: misp-get-organization-info outputs: - contextPath: MISP.Organization.org_id description: MISP organization ID. type: string - contextPath: MISP.Organization.org_name description: MISP organization name. type: string - arguments: [] description: Display role names and role IDs. name: misp-get-role-info outputs: - contextPath: MISP.Role.role_id description: MISP role ID. type: string - contextPath: MISP.Role.role_name description: MISP role name. type: string - arguments: - description: ID of the warninglist. name: id required: true description: Get a specific warninglist by its ID. name: misp-get-warninglist outputs: - contextPath: MISP.Warninglist.ID description: The ID of the warninglist. type: number - contextPath: MISP.Warninglist.Name description: The warninglist's name. type: string - contextPath: MISP.Warninglist.Type description: MISP warninglist type. type: string - contextPath: MISP.Warninglist.Description description: Description of the warninglist. type: string - contextPath: MISP.Warninglist.Version description: The warninglist version number. type: number - contextPath: MISP.Warninglist.Enabled description: Whether the warninglist is enabled. type: boolean - contextPath: MISP.Warninglist.Default description: Whether the warninglist is set as default. type: boolean - contextPath: MISP.Warninglist.Category description: The category of the MISP warninglist. type: string - contextPath: MISP.Warninglist.Entries description: The warninglist entries. type: dict - contextPath: MISP.Warninglist.Attributes description: The attribute types for this warninglist. type: dict - arguments: [] description: Gets all warninglists from MISP name: misp-get-warninglists outputs: - contextPath: MISP.Warninglist.ID description: The ID of the warninglist. type: number - contextPath: MISP.Warninglist.Name description: The warninglist's name. type: string - contextPath: MISP.Warninglist.Type description: MISP warninglist type. type: string - contextPath: MISP.Warninglist.Description description: Description of the warninglist. type: string - contextPath: MISP.Warninglist.Version description: The warninglist version number. type: number - contextPath: MISP.Warninglist.Enabled description: Whether the warninglist is enabled. type: boolean - contextPath: MISP.Warninglist.Default description: Whether the warninglist is set as default. type: boolean - contextPath: MISP.Warninglist.Entries description: The warninglist entries. type: dict - contextPath: MISP.Warninglist.Attributes description: The attribute types for this warninglist. type: dict - arguments: - name: id description: ID of the warninglist to update. required: true type: number - name: name description: Updated name of the warninglist. - name: type description: Updated type of the warninglist. - name: description description: Updated description of the warninglist. - name: enabled description: Whether the warninglist is enabled. type: boolean - name: version description: Updated version number of the warninglist. - name: default description: Whether the warninglist is set as default. type: boolean - name: values description: Updated values of the warninglist. - name: types description: Updated valid attribute types for the warninglist. description: Changes a warninglist in MISP. name: misp-change-warninglist outputs: - contextPath: MISP.Warninglist.ID description: The ID of the warninglist to be changed. type: number - contextPath: MISP.Warninglist.Name description: The updated warninglist name. type: string - contextPath: MISP.Warninglist.Type description: The updated warninglist type. type: string - contextPath: MISP.Warninglist.Description description: The updated description of the warninglist. type: string - contextPath: MISP.Warninglist.Version description: The updated warninglist version number. type: number - contextPath: MISP.Warninglist.Enabled description: Whether the warninglist is enabled. type: boolean - contextPath: MISP.Warninglist.Default description: Whether the warninglist is set as default. type: boolean - contextPath: MISP.Warninglist.Category description: The updated category of the warninglist. type: string - contextPath: MISP.Warninglist.Entries description: The warninglist entries. type: dict - contextPath: MISP.Warninglist.Attributes description: The attribute types for this warninglist. type: string dockerimage: demisto/pymisp2:2.5.34.1.10133006 runonce: false script: '' subtype: python3 type: python tests: - MISP V3 Test fromversion: 5.5.0