misp_search_events
Search MISP threat intelligence events using IOC values, types, tags, date ranges, or organizations to identify security incidents and correlations.
Instructions
Search MISP events by IOC value, type, tags, date range, or organization
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| value | No | IOC value to search across all attributes | |
| type | No | Attribute type filter (ip-src, ip-dst, domain, md5, sha256, url, email-src, etc.) | |
| category | No | Category filter (Network activity, Payload delivery, External analysis, etc.) | |
| tags | No | Tag filters (e.g., tlp:white, misp-galaxy:mitre-attack-pattern) | |
| eventId | No | Specific event ID | |
| org | No | Organization filter | |
| dateFrom | No | Start date (YYYY-MM-DD) | |
| dateTo | No | End date (YYYY-MM-DD) | |
| last | No | Relative time (e.g., 1d, 7d, 30d, 6m) | |
| published | No | Only published events | |
| limit | No | Max results (default 50) | |
| page | No | Page number for pagination |