misp_add_attribute
Add indicators of compromise (IOCs) like IP addresses, domains, or hashes to MISP threat intelligence events for sharing and analysis.
Instructions
Add an IOC/attribute to a MISP event
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| eventId | Yes | Event ID to add the attribute to | |
| type | Yes | Attribute type (ip-src, ip-dst, domain, md5, sha256, sha1, url, email-src, hostname, filename, etc.) | |
| value | Yes | The IOC value | |
| category | No | Category (auto-determined from type if omitted) | |
| toIds | No | Flag for IDS export (default true for applicable types) | |
| comment | No | Context/notes about this IOC | |
| distribution | No | Distribution level (0-4) | |
| tags | No | Tags to apply to the attribute |