misp_search_attributes
Search MISP threat intelligence events for specific indicators of compromise (IOCs) like IP addresses, domains, hashes, and URLs to investigate security threats.
Instructions
Search for specific attributes (IOCs) across all MISP events
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| value | No | IOC value to search | |
| type | No | Attribute type (ip-src, ip-dst, domain, md5, sha256, url, email-src, hostname, etc.) | |
| category | No | Category filter | |
| tags | No | Tag filters | |
| toIds | No | Only IDS-flagged attributes | |
| includeCorrelations | No | Include correlation data | |
| last | No | Relative time filter (e.g., 1d, 7d, 30d) | |
| limit | No | Max results (default 50) |