category: Data Enrichment & Threat Intelligence provider: Open Source deprecated: true commonfields: id: MISP V2 version: -1 configuration: - display: MISP server URL (e.g., https://192.168.0.1) name: url required: true type: 0 - display: API Key name: api_key required: true type: 4 - display: Use system proxy settings name: proxy type: 8 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Select which attribute data fields of the event to save to context. Leave empty to save all attributes. name: context_select options: - Category - Comment - Deleted - DisableCorrelation - Distribution - EventID - Galaxy - Tag - ID - ObjectID - ObjectRelation - ShadowAttribute - SharingGroupID - Timestamp - ToIDs - Type - UUID - Value type: 16 required: false - additionalinfo: This field limits the number of attributes for every event that will be written to the context. Raising the number of attributes above 1000 may result in high memory and disk usage. Contact Cortex XSOAR support before attempting to raise this field above 1000. defaultvalue: '1000' display: Maximum attributes in the event name: attributes_limit type: 0 required: false description: Deprecated. Use the MISP v3 integration instead. display: MISP v2 (Deprecated) name: MISP V2 script: commands: - arguments: - description: The attribute type. Use any valid MISP attribute. name: type - description: Search for the specified value in the attributes' value field. name: value - description: The attribute category. Use any valid MISP attribute category. name: category - description: Search by creator organization by supplying the organization ID. name: org - description: 'A comma-separated list of tags to include in the results. To exclude a tag, prefix the tag name with "!". Can be: "AND", "OR", and "NOT" followed by ":". To chain logical operators use ";". for example, "AND:tag1,tag2;OR:tag3".' name: tags - description: Event search start date (2015-02-15). name: from - description: Event search end date (2015-02-15). name: to - description: Events published within the last "x" amount of time. Valid time values are days, hours, and minutes (for example "5d", "12h", "30m"). This filter uses the published timestamp of the event. name: last - description: The events to include or exclude from the search. isArray: true name: eventid - description: Return events that include an attribute with the given UUID. Alternatively the event's UUID must match the value(s) passed, e.g., 59523300-4be8-4fa6-8867-0037ac110002. name: uuid - auto: PREDEFINED defaultValue: 'false' description: Whether to return only the attributes set with the "to_ids" flag. name: to_ids predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether to return only the values that are not on the warninglists. name: enforceWarninglist predefined: - 'true' - 'false' description: Search for events in MISP. name: misp-search outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Date description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Event.ProposalEmailLock description: If email lock proposed. type: boolean - contextPath: MISP.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Event.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Event.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Event.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Event.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Event.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Event.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Event.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Event.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Event.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Event.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Event.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Event.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Event.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Event.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Event.Object.MetaCategory description: Object Meta Category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event which the object first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp of the object creation. type: String - contextPath: MISP.Event.Object.Deleted description: Is the object deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp of the object creation. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Is the object deleted? type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: If the correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Type of object type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Is the to_ids flag on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - default: true description: Hash of the file to query. Supports MD5, SHA-1, and SHA-256. You can pass CSV values to retrieve multiple responses. isArray: true name: file description: Checks the file reputation of the given hash. name: file outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - default: true description: URL to check isArray: true name: url description: Checks if the URL is in MISP events. name: url outputs: - contextPath: URL.Data description: The URL. type: String - contextPath: URL.Malicious.Vendor description: The vendor reporting the URL as malicious. type: String - contextPath: URL.Malicious.Description description: A description of the malicious URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: String - arguments: - default: true description: IP address to check. isArray: true name: ip description: Checks the reputation of an IP address. name: ip outputs: - contextPath: IP.Address description: IP address. type: String - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP address as malicious. type: String - contextPath: IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - description: Event type of the new event. name: type - defaultValue: External analysis description: Category of the new event. name: category - auto: PREDEFINED defaultValue: 'false' description: Whether to create an event with the Intrusion Detection System flag. name: to_ids predefined: - 'true' - 'false' - defaultValue: '0' description: Where to distribute the event. name: distribution - description: Comment for the event. name: comment - description: Value to add to the event. name: value required: true - default: true description: Event name. name: info required: true - auto: PREDEFINED defaultValue: 'false' description: Whether to publish the event. name: published predefined: - 'false' - 'true' - defaultValue: '1' description: MISP threat level ID. Default is 1. name: threat_level_id deprecated: true description: Create a new MISP event. name: internal-misp-create-event outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Event.PublishTimestamp description: If published, timestamp of the publish time. type: number - contextPath: MISP.Event.EventCreatorEmail description: Email addrss of the event creator. type: string - contextPath: MISP.Event.Date description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Whether the event is locked. type: boolean - contextPath: MISP.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Event.ProposalEmailLock description: Is email lock proposed. type: boolean - contextPath: MISP.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Event.Galaxy.Description description: Event galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Event.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Event.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Event.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Event.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Event.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Event.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Event.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Event.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Event.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Event.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Event.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Event.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Event.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Event.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - arguments: - defaultValue: other description: Event type of the new event. name: type - defaultValue: External analysis description: Category of the new event. name: category - auto: PREDEFINED defaultValue: 'false' description: Whether to create the event with the Intrusion Detection System flag. name: to_ids predefined: - 'true' - 'false' - defaultValue: '0' description: Where to distribute the event. name: distribution - description: Comment for the event. name: comment - description: Value to add to the event. name: value required: true - default: true description: Event name. name: info required: true - auto: PREDEFINED defaultValue: 'false' description: Whether to publish the event. name: published predefined: - 'false' - 'true' - auto: PREDEFINED defaultValue: high description: MISP Threat level ID. Default is "high". name: threat_level_id predefined: - high - medium - low - undefined - auto: PREDEFINED defaultValue: initial description: The analysis level. Default is "initial". name: analysis predefined: - initial - ongoing - completed description: Creates a new MISP event. name: misp-create-event outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Date description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Event.ProposalEmailLock description: Is email lock proposed. type: boolean - contextPath: MISP.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Event.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Event.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Event.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Event.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Event.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Event.Attribute.DisableCorrelation description: Is attribute correlation disabled? type: boolean - contextPath: MISP.Event.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Event.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Event.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Event.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Event.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Event.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Event.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Event.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - arguments: - description: MISP event ID. name: id required: true - description: Attribute type, e.g., "other" or "url". name: type required: true - description: Attribute category. name: category required: true - auto: PREDEFINED defaultValue: 'true' description: Whether to set Intrusion Detection System on. name: to_ids predefined: - 'true' - 'false' - description: Where to distribute the attribute. name: distribution - description: Attribute name. name: comment required: true - description: Attribute value. name: value required: true deprecated: true description: Adds an attribute to an existing MISP event. name: internal-misp-add-attribute - arguments: - description: 'A hash in MD5 format. If the "allSamples" argument is supplied, this can be any one of the following: md5, sha1, and sha256.' name: hash required: true - description: If set, will only fetch data from the given event ID. name: eventID - auto: PREDEFINED description: If set, will return all samples from events that match the hash supplied in the "hash" argument. name: allSamples predefined: - 'true' - 'false' - auto: PREDEFINED default: true defaultValue: 'false' description: True to return all files unzipped. False to return one zipped file. Default is "false". name: unzip predefined: - 'true' - 'false' description: Downloads a file sample from MISP. execution: true name: misp-download-sample - arguments: - description: MISP event ID. name: id required: true - description: Attribute type. name: type required: true - description: Attribute category. name: category required: true - auto: PREDEFINED defaultValue: 'true' description: Return only events set with the "to_ids" flag. Default is "true". name: to_ids predefined: - 'true' - 'false' - description: Where to distribute the attribute. name: distribution - description: Comment for the attribute. name: comment required: true - description: Attribute value. name: value required: true description: Adds an attribute to an existing MISP event. name: misp-add-attribute outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Date description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Event.ProposalEmailLock description: Is email lock proposed. type: boolean - contextPath: MISP.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Event.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Event.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Event.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Event.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Event.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Event.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Event.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Event.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Event.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Event.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Event.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Event.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Event.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Event.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - arguments: - description: Entry ID of the file to upload. name: fileEntryID required: true - description: The event ID of the event to add the uploaded file to. name: event_id - auto: PREDEFINED description: The distribution setting used for the attributes and for the newly created event, if relevant (0-3). name: distribution predefined: - '0' - '1' - '2' - '3' - auto: PREDEFINED description: Flags all attributes created during the transaction to be marked as "to_ids" or not. name: to_ids predefined: - '0' - '1' - description: The category that will be assigned to the uploaded samples, (Payload delivery, Artifacts dropped, Payload Installation, External Analysis). name: category - description: Used to populate the event info field if no event ID is supplied. Alternatively, if not supplied, MISP will generate a message showing that it is a malware sample collection generated on the given day. name: info - auto: PREDEFINED defaultValue: initial description: The analysis level. Default is "initial". name: analysis predefined: - initial - ongoing - completed - auto: PREDEFINED defaultValue: high description: The threat level ID of the newly created event. Default is "high". name: threat_level_id predefined: - high - medium - low - undefined - description: This will populate the comment field of any attribute created using this API. name: comment description: Uploads a file sample to MISP. execution: true name: misp-upload-sample outputs: - contextPath: MISP.UploadedSample description: 'Object containing {filename: event id} of the uploaded file.' type: Unknown - arguments: - description: Event ID to delete. name: event_id required: true description: Deletes an event according to event ID. name: misp-delete-event - arguments: - description: UUID of the attribute/event, e.g., 59575300-4be8-4ff6-8767-0037ac110032. name: uuid required: true - description: Tag to add to the attribute or event. name: tag required: true description: Adds a tag to the given UUID event or attribute. name: misp-add-tag outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Event.Date description: Event creation date. type: date - contextPath: MISP.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Event.ProposalEmailLock description: Is email lock proposed. type: boolean - contextPath: MISP.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Event.UUID description: Event UUID. type: string - contextPath: MISP.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Event.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Event.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Event.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Event.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Event.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Event.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Event.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Event.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Event.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Event.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Event.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Event.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Event.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Event.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Event.Tag.Name description: All tag names in the event. type: string - arguments: - auto: PREDEFINED description: Type of sighting to add. name: type predefined: - sighting - false_positive - expiration required: true - description: ID of attribute to add sighting to (Must be filled if UUID is empty). Can be retrieved from misp-search. name: id - description: UUID of attribute to add sighting to (Must be filled if ID is empty). Can be retrieved from misp-search. name: uuid description: Add sighting to an attribute. name: misp-add-sighting - arguments: - auto: PREDEFINED description: URL of the feed to add. name: feed predefined: - CIRCL - Botvrij.eu - default: true defaultValue: '0' description: Maximum number of files to add. name: limit description: Adds an OSINT feed. name: misp-add-events-from-feed outputs: - contextPath: MISP.Event.ID description: IDs of newly created events. type: number - arguments: - description: Entry ID of the email. name: entry_id required: true - description: ID of the event to which to add object to. name: event_id required: true description: Adds an email object to the specified event ID. name: misp-add-email-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp when the object was created. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp when the object was created. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of a MISP event. name: event_id required: true - description: 'The domain name, for example: "google.com". ' name: name required: true - description: A list (array) or IP addresses resolved by DNS. isArray: true name: dns required: true - description: Date that the domain was created. name: creation_date - description: 'Datetime that the domain was last seen, for example: `2019-02-03`.' name: last_seen - description: 'Datetime that the domain was first seen, for example: `2019-02-03`.' name: first_seen - description: A description of the domain. name: text description: Adds a domain object. name: misp-add-domain-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp when the object was created. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp of object creation type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: Full URL to add to the event. name: url required: true - description: 'Date that this URL was first seen, for example: `2019-02-03`.' name: first_seen - description: Description of the URL. name: text - description: 'Date that this URL was last seen, for example: `2019-02-03`.' name: last_seen - description: ID of the event. name: event_id required: true description: Adds a URL object to a MISP event. name: misp-add-url-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp when the object was created. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp when the object was created. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of the event to add the object to. name: event_id required: true - description: Template name (can be found at https://www.misp-project.org/objects.html). name: template required: true - description: Attributes. name: attributes required: true description: Adds any other object to MISP. name: misp-add-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp when the object was created. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp when the object was created. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted? type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: ID of an event. name: event_id required: true - description: IP address (require one of). name: ip - description: Destination port number. name: dst_port - description: Source port number. name: src_port - description: Domain. name: domain - description: Hostname. name: hostname - description: IP source. name: ip_src - description: IP destination. name: ip_dst - description: Date when the tuple was first seen. name: first_seen - description: Date when the tuple was last seen. name: last_seen - description: A description of the object. name: comment description: 'Adds an IP object to the MISP event. The following arguments are optional, but at least one must be supplied for the command to run successfully: "ip", "dst_port", "src_port", "domain", "hostname", "ip_src", and "ip_dst".' name: misp-add-ip-object outputs: - contextPath: MISP.Event.ID description: MISP event ID. type: number - contextPath: MISP.Event.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Event.Object.Distribution description: Distribution of the object. type: Number - contextPath: MISP.Event.Object.Name description: Name of the object. type: String - contextPath: MISP.Event.Object.TemplateVersion description: Template version of the object. type: Number - contextPath: MISP.Event.Object.EventID description: ID of the event in which the object was first created. type: Number - contextPath: MISP.Event.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Event.Object.Timestamp description: Timestamp when the object was created. type: String - contextPath: MISP.Event.Object.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.ID description: ID of the object. type: Number - contextPath: MISP.Event.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Event.Object.Attribute.Value description: Value of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.EventID description: ID of the first event from which the object originated. type: Number - contextPath: MISP.Event.Object.Attribute.Timestamp description: Timestamp when the object was created. type: Date - contextPath: MISP.Event.Object.Attribute.Deleted description: Whether the object was deleted. type: Boolean - contextPath: MISP.Event.Object.Attribute.ObjectID description: ID of the object. type: Number - contextPath: MISP.Event.Object.Attribute.DisableCorrelation description: Whether correlation is disabled. type: Boolean - contextPath: MISP.Event.Object.Attribute.ID description: ID of the attribute. type: Unknown - contextPath: MISP.Event.Object.Attribute.ObjectRelation description: Relation of the object. type: String - contextPath: MISP.Event.Object.Attribute.Type description: Object type. type: String - contextPath: MISP.Event.Object.Attribute.UUID description: UUID of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.ToIDs description: Whether the to_ids flag is on. type: Boolean - contextPath: MISP.Event.Object.Attribute.Category description: Category of the attribute. type: String - contextPath: MISP.Event.Object.Attribute.SharingGroupID description: ID of the sharing group. type: Number - contextPath: MISP.Event.Object.Attribute.Comment description: Comment of the attribute. type: String - contextPath: MISP.Event.Object.Description description: Description of the object. type: String - arguments: - description: The attribute type. Use any valid MISP attribute. name: type - description: Search for the specified value in the attributes' value field. name: value - description: The attribute category. Use any valid MISP attribute category. name: category - description: Return events that include an attribute with the given UUID. Alternatively the event's UUID must match the value(s) passed, e.g., 59523300-4be8-4fa6-8867-0037ac110002 name: uuid - auto: PREDEFINED defaultValue: 'false' description: Whether to return only the attributes set with the "to_ids" flag. name: to_ids predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether to return only the attributes that are not on the warninglists. name: enforceWarninglist predefined: - 'true' - 'false' - description: Search attributes of events published within the last "x" amount of time. Valid time values are days, hours, and minutes (for example "5d", "12h", "30m"). This filter uses the published timestamp of the event. name: last - auto: PREDEFINED description: Whether to include the decay score at the attribute level. name: include_decay_score predefined: - 'true' - 'false' description: Search for attributes in MISP. name: misp-search-attributes outputs: - contextPath: MISP.Attribute.Distribution description: Attribute distribution. type: number - contextPath: MISP.Attribute.Value description: Attribute value. type: string - contextPath: MISP.Attribute.EventID description: Attribute event ID. type: number - contextPath: MISP.Attribute.Timestamp description: Attribute timestamp. type: number - contextPath: MISP.Attribute.Deleted description: Is the attribute deleted. type: boolean - contextPath: MISP.Attribute.DisableCorrelation description: Is attribute correlation disabled. type: boolean - contextPath: MISP.Attribute.Type description: Attribute type. type: string - contextPath: MISP.Attribute.ID description: Attribute ID. type: number - contextPath: MISP.Attribute.UUID description: Attribute UUID. type: string - contextPath: MISP.Attribute.ShadowAttribute description: Attribute shadow attribute. type: Unknown - contextPath: MISP.Attribute.ToIDs description: Is the Intrusion Detection System flag set. type: boolean - contextPath: MISP.Attribute.Category description: Attribute category. type: string - contextPath: MISP.Attribute.SharingGroupID description: Attribute sharing group ID. type: number - contextPath: MISP.Attribute.Comment description: Attribute comment. type: string - contextPath: MISP.Attribute.Event.ID description: MISP event ID. type: number - contextPath: MISP.Attribute.Event.Distribution description: MISP event distribution. type: number - contextPath: MISP.Attribute.Event.ThreatLevelID description: Threat level of the MISP event (1 High, 2 Medium, 3 Low, 4 Undefined). type: number - contextPath: MISP.Attribute.Event.PublishTimestamp description: Timestamp of the publish time (if published). type: number - contextPath: MISP.Attribute.Event.EventCreatorEmail description: Email address of the event creator. type: string - contextPath: MISP.Attribute.Event.Date description: Event creation date. type: date - contextPath: MISP.Attribute.Event.Locked description: Is the event locked. type: boolean - contextPath: MISP.Attribute.Event.OwnerOrganisation.ID description: Owner organization ID. type: number - contextPath: MISP.Attribute.Event.OwnerOrganisation.Name description: Owner organization name. type: string - contextPath: MISP.Attribute.Event.OwnerOrganisation.UUID description: Owner organization UUID. type: string - contextPath: MISP.Attribute.Event.RelatedEvent.ID description: Event IDs of related events (can be a list). type: number - contextPath: MISP.Attribute.Event.ProposalEmailLock description: If email lock proposed. type: boolean - contextPath: MISP.Attribute.Event.Timestamp description: Timestamp of the event. type: number - contextPath: MISP.Attribute.Event.Galaxy.Description description: Event's galaxy description. type: string - contextPath: MISP.Attribute.Event.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Attribute.Event.Galaxy.Type description: Galaxy type. type: number - contextPath: MISP.Attribute.Event.Published description: Is the event published. type: boolean - contextPath: MISP.Attribute.Event.DisableCorrelation description: Is correlation disabled. type: boolean - contextPath: MISP.Attribute.Event.UUID description: Event UUID. type: string - contextPath: MISP.Attribute.Event.ShadowAttribute description: Event shadow attributes. type: Unknown - contextPath: MISP.Attribute.Event.Analysis description: Event analysis (0 Initial, 1 Ongoing, 2 Completed). type: number - contextPath: MISP.Attribute.Event.SharingGroupID description: Event sharing group ID. type: number - contextPath: MISP.Attribute.Event.Tag.Name description: All tag names in the event. type: string - contextPath: MISP.Attribute.Object.MetaCategory description: Object meta category. type: String - contextPath: MISP.Attribute.Object.Distribution description: Distribution of object. type: Number - contextPath: MISP.Attribute.Object.Name description: Name of the object. type: String - contextPath: MISP.Attribute.Object.TemplateVersion description: Template version of object. type: Number - contextPath: MISP.Attribute.Object.EventID description: ID of the event which the object first created. type: Number - contextPath: MISP.Attribute.Object.TemplateUUID description: UUID of the template. type: String - contextPath: MISP.Attribute.Object.Timestamp description: Timestamp of object creation. type: String - contextPath: MISP.Attribute.Object.Deleted description: Is the object deleted. type: Boolean - contextPath: MISP.Attribute.Object.ID description: ID of the object. type: Number - contextPath: MISP.Attribute.Object.UUID description: UUID of the object. type: String - contextPath: MISP.Attribute.Object.Description description: Description of the object. type: String - contextPath: MISP.Attribute.Tag.Name description: All tag names in the attribute. type: string - contextPath: MISP.Attribute.Galaxy.Description description: Galaxy description. type: string - contextPath: MISP.Attribute.Galaxy.Name description: Galaxy name. type: string - contextPath: MISP.Attribute.Galaxy.Type description: Galaxy type. type: number dockerimage: demisto/pymisp:1.0.0.19190 runonce: false script: '-' subtype: python3 type: python tests: - No tests fromversion: 5.0.0