Skip to main content

​
Get attribute

Action ID: tools.misp.get_attribute Retrieve a specific MISP indicator by its numeric attribute ID. Reference: https://www.misp-project.org/openapi/#tag/Attributes/operation/getAttributeById

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the attribute to retrieve.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get event

Action ID: tools.misp.get_event Retrieve a complete MISP event by ID, including its attributes, objects, tags, and metadata. Reference: https://www.misp-project.org/openapi/#tag/Events/operation/getEventById

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the event to retrieve.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Include correlation data when supported by the MISP instance.Default: false.
​
boolean
Include sighting data when supported by the MISP instance.Default: false.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get galaxy

Action ID: tools.misp.get_galaxy Retrieve a MISP galaxy and optionally include all of its clusters. Reference: https://www.misp-project.org/openapi/#tag/Galaxies/operation/getGalaxyById

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the galaxy to retrieve.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.
​
boolean
Include clusters associated with the galaxy.Default: true.

​
Get object

Action ID: tools.misp.get_object Retrieve a specific MISP object and all of its grouped attributes. Reference: https://www.misp-project.org/openapi/#tag/Objects/operation/getObjectById

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the object to retrieve.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get taxonomy

Action ID: tools.misp.get_taxonomy Retrieve a MISP taxonomy with its predicates and values. Reference: https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomyById

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the taxonomy to retrieve.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List taxonomies

Action ID: tools.misp.list_taxonomies List MISP taxonomy vocabularies used to classify threat intelligence. Reference: https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomies

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search attributes

Action ID: tools.misp.search_attributes Search individual MISP indicators across events for threat enrichment. Reference: https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
MISP attribute category.Default: null.
​
string | null
Earliest event date in YYYY-MM-DD format.Default: null.
​
string | null
Latest event date in YYYY-MM-DD format.Default: null.
​
boolean | null
Exclude attributes matching enabled warning lists.Default: null.
​
integer | array[integer] | null
Parent event ID or list of event IDs.Default: null.
​
boolean
Include correlation data.Default: false.
​
boolean
Include indicator decay scores.Default: false.
​
boolean
Include parent event tags.Default: false.
​
boolean
Include the parent event UUID.Default: true.
​
boolean
Include sighting data.Default: false.
​
integer
Maximum number of attributes to return.Default: 50.
​
string | null
Creator organisation name or ID.Default: null.
​
integer
Result page number.Default: 1.
​
boolean | null
Filter by parent event publication state.Default: null.
​
array[string] | null
Attribute tags to include or exclude.Default: null.
​
boolean | null
Filter attributes by their IDS flag.Default: null.
​
string | null
MISP attribute type such as ip-src, domain, url, md5, or sha256.Default: null.
​
string | null
Indicator value such as an IP address, domain, URL, or hash.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search event index

Action ID: tools.misp.search_event_index Browse and filter lightweight MISP event metadata without loading full attributes or objects. Reference: https://www.misp-project.org/openapi/#tag/Events/operation/searchEvents

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer | null
Analysis level where 0 is initial, 1 ongoing, and 2 complete.Default: null.
​
string | null
Match events containing this attribute value.Default: null.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
Earliest event date in YYYY-MM-DD format.Default: null.
​
string | null
Latest event date in YYYY-MM-DD format.Default: null.
​
boolean | null
Sort descending when true or ascending when false.Default: null.
​
string | null
Event ID filter.Default: null.
​
string | null
Text to match in the event information field.Default: null.
​
integer
Maximum number of events to return.Default: 25.
​
boolean
Return the minimal event metadata shape.Default: false.
​
string | null
Creator organisation name or ID.Default: null.
​
integer
Result page number.Default: 1.
​
string | null
Filter by publication timestamp or relative time.Default: null.
​
boolean | null
Filter by event publication state.Default: null.
​
string | null
Sort field such as id, date, or attribute_count.Default: null.
​
array[string] | null
Event tags to include or exclude.Default: null.
​
integer | null
Threat level where 1 is high, 2 medium, 3 low, and 4 undefined.Default: null.
​
string | null
Filter by last-modified timestamp or relative time.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search events

Action ID: tools.misp.search_events Search MISP events by indicators, tags, dates, organisation, and publication state. Reference: https://www.misp-project.org/openapi/#tag/Events/operation/restSearchEvents

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
MISP attribute category.Default: null.
​
string | null
Earliest event date in YYYY-MM-DD format.Default: null.
​
string | null
Latest event date in YYYY-MM-DD format.Default: null.
​
boolean | null
Exclude attributes matching enabled warning lists.Default: null.
​
array[string] | null
Event-level tags to include or exclude.Default: null.
​
integer | array[integer] | null
Event ID or list of event IDs.Default: null.
​
string | null
Text to match in the event information field.Default: null.
​
boolean
Include correlation data.Default: false.
​
boolean
Include sighting data.Default: false.
​
integer
Maximum number of events to return.Default: 25.
​
boolean
Return event metadata without attributes or objects.Default: false.
​
string | null
Creator organisation name or ID.Default: null.
​
integer
Result page number.Default: 1.
​
boolean | null
Filter by event publication state.Default: null.
​
string | null
Quick text search across event and attribute fields.Default: null.
​
array[string] | null
Attribute tags to include or exclude.Default: null.
​
boolean | null
Filter attributes by their IDS flag.Default: null.
​
string | null
MISP attribute type such as ip-src, domain, url, md5, or sha256.Default: null.
​
string | null
Indicator value such as an IP address, domain, URL, or hash.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search feeds

Action ID: tools.misp.search_feeds List configured MISP feeds or search their cached threat intelligence for an indicator. Reference: https://www.misp-project.org/openapi/#tag/Feeds

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
Indicator to search in cached feeds. Omit to list configured feeds.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search galaxies

Action ID: tools.misp.search_galaxies Search MISP galaxies for threat actors, malware, tools, and ATT&CK knowledge bases. Reference: https://www.misp-project.org/openapi/#tag/Galaxies/operation/searchGalaxies

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string
required
Text to match in galaxy names and descriptions.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.
​
boolean
Request cluster data with matching galaxies when supported.Default: false.

​
Search galaxy clusters

Action ID: tools.misp.search_galaxy_clusters Search threat actors, malware families, techniques, and other clusters within a MISP galaxy. Reference: https://www.misp-project.org/openapi/#tag/Galaxy-Clusters/operation/searchGalaxyClusters

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
integer
required
Numeric ID of the galaxy to search.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
Optional MISP galaxy cluster context filter.Default: null.
​
string | null
Text to match in cluster names, descriptions, and synonyms.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search objects

Action ID: tools.misp.search_objects Search MISP objects that group related indicators such as files, network connections, and emails. Reference: https://www.misp-project.org/openapi/#tag/Objects/operation/restSearchObjects

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
string | null
MISP attribute category.Default: null.
​
string | null
Earliest event date in YYYY-MM-DD format.Default: null.
​
string | null
Latest event date in YYYY-MM-DD format.Default: null.
​
integer | array[integer] | null
Parent event ID or list of event IDs.Default: null.
​
integer
Maximum number of objects to return.Default: 25.
​
string | null
Object template name such as file, ip-port, domain-ip, or email.Default: null.
​
string | null
Creator organisation name or ID.Default: null.
​
integer
Result page number.Default: 1.
​
array[string] | null
Tags to include or exclude.Default: null.
​
string | null
Type of an attribute contained in an object.Default: null.
​
string | null
Value of an attribute contained in an object.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search tags

Action ID: tools.misp.search_tags Search MISP tags by exact or partial tag name. Reference: https://www.misp-project.org/openapi/#tag/Tags/operation/searchTag

​
Secrets

Required secrets:
  • misp: required values MISP_API_KEY.

​
Input fields

​
string
required
Exact or partial tag name, such as tlp:amber or a galaxy tag.
​
string | null
MISP base URL. Falls back to VARS.misp.base_url.Default: null.
​
boolean
Match the tag name exactly instead of matching synonyms and galaxy values.Default: false.
​
boolean
Whether to verify SSL certificates.Default: true.