Search MISP for an IOC and return normalized attribute matches.

Investigate an IOC using MISP matches, related events, tags, and warninglists.

Summarize a MISP event without returning full raw event JSON.

Check an IOC against MISP warninglists when available.

Generate a deterministic analyst report for an IOC.

Pivot from an IOC to related events and indicators useful for hunting.

Return a focused, ranked list of IOCs related to the given IOC.

Extract supported IOC types from a MISP event, grouped and deduplicated.

Explain what a MISP event represents in deterministic, analyst-friendly language.

Find MISP events associated with a tag.

Generate a deterministic, structured analyst report for a MISP event.

Generate a Markdown-formatted IOC report suitable for SOC documentation.

Generate a Markdown-formatted MISP event report suitable for SOC escalation.

Return bounded sighting summaries for an IOC.

Discover MISP events by bounded date, publication state, and org filters.

Return MISP version and warninglist read capability status.

List configured MISP feeds in a bounded, redacted response.

Return redacted status and health metadata for one configured MISP feed.

Summarize configured feed health grouped by health label.

Build a MISP event creation proposal. Never writes to MISP.

Build an attribute creation proposal for an existing event. Never writes to MISP.

Submit an IOC (attribute) to MISP only when write is enabled, role permits write, and approval (when required) has been explicitly given. Otherwise returns a blocked/proposal result.

Add a sighting to MISP only when policy and approval allow. Otherwise returns a blocked/proposal result.

Tag a MISP event only when policy and approval allow. Otherwise returns a blocked/proposal result.

Publish a MISP event only when policy and approval allow. Requires curator/ admin-like permission and is always high-risk and approval-gated. Otherwise returns a blocked/proposal result.