> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # MISP > Reference for the Tracecat MISP integration: registered actions, required secrets, expected inputs, and example workflow usage. ## Get attribute Action ID: `tools.misp.get_attribute` Retrieve a specific MISP indicator by its numeric attribute ID. Reference: [https://www.misp-project.org/openapi/#tag/Attributes/operation/getAttributeById](https://www.misp-project.org/openapi/#tag/Attributes/operation/getAttributeById) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the attribute to retrieve. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Get event Action ID: `tools.misp.get_event` Retrieve a complete MISP event by ID, including its attributes, objects, tags, and metadata. Reference: [https://www.misp-project.org/openapi/#tag/Events/operation/getEventById](https://www.misp-project.org/openapi/#tag/Events/operation/getEventById) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the event to retrieve. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Include correlation data when supported by the MISP instance. Default: `false`. Include sighting data when supported by the MISP instance. Default: `false`. Whether to verify SSL certificates. Default: `true`. ## Get galaxy Action ID: `tools.misp.get_galaxy` Retrieve a MISP galaxy and optionally include all of its clusters. Reference: [https://www.misp-project.org/openapi/#tag/Galaxies/operation/getGalaxyById](https://www.misp-project.org/openapi/#tag/Galaxies/operation/getGalaxyById) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the galaxy to retrieve. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. Include clusters associated with the galaxy. Default: `true`. ## Get object Action ID: `tools.misp.get_object` Retrieve a specific MISP object and all of its grouped attributes. Reference: [https://www.misp-project.org/openapi/#tag/Objects/operation/getObjectById](https://www.misp-project.org/openapi/#tag/Objects/operation/getObjectById) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the object to retrieve. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Get taxonomy Action ID: `tools.misp.get_taxonomy` Retrieve a MISP taxonomy with its predicates and values. Reference: [https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomyById](https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomyById) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the taxonomy to retrieve. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## List taxonomies Action ID: `tools.misp.list_taxonomies` List MISP taxonomy vocabularies used to classify threat intelligence. Reference: [https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomies](https://www.misp-project.org/openapi/#tag/Taxonomies/operation/getTaxonomies) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search attributes Action ID: `tools.misp.search_attributes` Search individual MISP indicators across events for threat enrichment. Reference: [https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes](https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. MISP attribute category. Default: `null`. Earliest event date in YYYY-MM-DD format. Default: `null`. Latest event date in YYYY-MM-DD format. Default: `null`. Exclude attributes matching enabled warning lists. Default: `null`. Parent event ID or list of event IDs. Default: `null`. Include correlation data. Default: `false`. Include indicator decay scores. Default: `false`. Include parent event tags. Default: `false`. Include the parent event UUID. Default: `true`. Include sighting data. Default: `false`. Maximum number of attributes to return. Default: `50`. Creator organisation name or ID. Default: `null`. Result page number. Default: `1`. Filter by parent event publication state. Default: `null`. Attribute tags to include or exclude. Default: `null`. Filter attributes by their IDS flag. Default: `null`. MISP attribute type such as ip-src, domain, url, md5, or sha256. Default: `null`. Indicator value such as an IP address, domain, URL, or hash. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search event index Action ID: `tools.misp.search_event_index` Browse and filter lightweight MISP event metadata without loading full attributes or objects. Reference: [https://www.misp-project.org/openapi/#tag/Events/operation/searchEvents](https://www.misp-project.org/openapi/#tag/Events/operation/searchEvents) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Analysis level where 0 is initial, 1 ongoing, and 2 complete. Default: `null`. Match events containing this attribute value. Default: `null`. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Earliest event date in YYYY-MM-DD format. Default: `null`. Latest event date in YYYY-MM-DD format. Default: `null`. Sort descending when true or ascending when false. Default: `null`. Event ID filter. Default: `null`. Text to match in the event information field. Default: `null`. Maximum number of events to return. Default: `25`. Return the minimal event metadata shape. Default: `false`. Creator organisation name or ID. Default: `null`. Result page number. Default: `1`. Filter by publication timestamp or relative time. Default: `null`. Filter by event publication state. Default: `null`. Sort field such as id, date, or attribute\_count. Default: `null`. Event tags to include or exclude. Default: `null`. Threat level where 1 is high, 2 medium, 3 low, and 4 undefined. Default: `null`. Filter by last-modified timestamp or relative time. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search events Action ID: `tools.misp.search_events` Search MISP events by indicators, tags, dates, organisation, and publication state. Reference: [https://www.misp-project.org/openapi/#tag/Events/operation/restSearchEvents](https://www.misp-project.org/openapi/#tag/Events/operation/restSearchEvents) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. MISP attribute category. Default: `null`. Earliest event date in YYYY-MM-DD format. Default: `null`. Latest event date in YYYY-MM-DD format. Default: `null`. Exclude attributes matching enabled warning lists. Default: `null`. Event-level tags to include or exclude. Default: `null`. Event ID or list of event IDs. Default: `null`. Text to match in the event information field. Default: `null`. Include correlation data. Default: `false`. Include sighting data. Default: `false`. Maximum number of events to return. Default: `25`. Return event metadata without attributes or objects. Default: `false`. Creator organisation name or ID. Default: `null`. Result page number. Default: `1`. Filter by event publication state. Default: `null`. Quick text search across event and attribute fields. Default: `null`. Attribute tags to include or exclude. Default: `null`. Filter attributes by their IDS flag. Default: `null`. MISP attribute type such as ip-src, domain, url, md5, or sha256. Default: `null`. Indicator value such as an IP address, domain, URL, or hash. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search feeds Action ID: `tools.misp.search_feeds` List configured MISP feeds or search their cached threat intelligence for an indicator. Reference: [https://www.misp-project.org/openapi/#tag/Feeds](https://www.misp-project.org/openapi/#tag/Feeds) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Indicator to search in cached feeds. Omit to list configured feeds. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search galaxies Action ID: `tools.misp.search_galaxies` Search MISP galaxies for threat actors, malware, tools, and ATT\&CK knowledge bases. Reference: [https://www.misp-project.org/openapi/#tag/Galaxies/operation/searchGalaxies](https://www.misp-project.org/openapi/#tag/Galaxies/operation/searchGalaxies) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Text to match in galaxy names and descriptions. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Whether to verify SSL certificates. Default: `true`. Request cluster data with matching galaxies when supported. Default: `false`. ## Search galaxy clusters Action ID: `tools.misp.search_galaxy_clusters` Search threat actors, malware families, techniques, and other clusters within a MISP galaxy. Reference: [https://www.misp-project.org/openapi/#tag/Galaxy-Clusters/operation/searchGalaxyClusters](https://www.misp-project.org/openapi/#tag/Galaxy-Clusters/operation/searchGalaxyClusters) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Numeric ID of the galaxy to search. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Optional MISP galaxy cluster context filter. Default: `null`. Text to match in cluster names, descriptions, and synonyms. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search objects Action ID: `tools.misp.search_objects` Search MISP objects that group related indicators such as files, network connections, and emails. Reference: [https://www.misp-project.org/openapi/#tag/Objects/operation/restSearchObjects](https://www.misp-project.org/openapi/#tag/Objects/operation/restSearchObjects) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. MISP attribute category. Default: `null`. Earliest event date in YYYY-MM-DD format. Default: `null`. Latest event date in YYYY-MM-DD format. Default: `null`. Parent event ID or list of event IDs. Default: `null`. Maximum number of objects to return. Default: `25`. Object template name such as file, ip-port, domain-ip, or email. Default: `null`. Creator organisation name or ID. Default: `null`. Result page number. Default: `1`. Tags to include or exclude. Default: `null`. Type of an attribute contained in an object. Default: `null`. Value of an attribute contained in an object. Default: `null`. Whether to verify SSL certificates. Default: `true`. ## Search tags Action ID: `tools.misp.search_tags` Search MISP tags by exact or partial tag name. Reference: [https://www.misp-project.org/openapi/#tag/Tags/operation/searchTag](https://www.misp-project.org/openapi/#tag/Tags/operation/searchTag) ### Secrets Required secrets: * `misp`: required values `MISP_API_KEY`. ### Input fields Exact or partial tag name, such as tlp:amber or a galaxy tag. MISP base URL. Falls back to VARS.misp.base\_url. Default: `null`. Match the tag name exactly instead of matching synonyms and galaxy values. Default: `false`. Whether to verify SSL certificates. Default: `true`.