Search MISP for sightings of an indicator (IP, domain, URL, or file hash).

Returns JSON: {"ioc", "ioc_type", "total_hits", "summary": {"seen_in_misp", "event_count", "detection_flagged", "max_threat_level", "restricted_hits"}, "hits": [{"event_id", "event_info", "threat_level", "source_org", "attribute_type", "value", "category", "to_ids", "restricted", and when present "comment"/"first_seen"/"last_seen"}]}. Hits from TLP:AMBER/RED events are redacted to {"event_id", "restricted": true, "note"} unless the operator has opted in. The summary is a quick verdict; "seen_in_misp": false means the indicator is not in this instance - not that it is safe.

Triage several indicators at once, returning a compact per-IOC summary (not full hit detail — call misp_lookup_ioc for that).

Returns JSON: {"results": [{"ioc", "ioc_type", "total_hits", "has_restricted_hits", "top_event_ids": [str]}]}. Invalid indicators are reported inline as {"ioc", "error"} rather than failing the whole batch. "total_hits": 0 means not present in MISP, not that it is safe.

List other indicators that appear in the same MISP event(s) as the given IOC - useful for pivoting from one indicator to related infrastructure (an event's other IPs, domains, hashes).

Returns JSON: {"ioc": str, "events_checked": int, "related": [{"event_id", "event_info", "attribute_type", "value"}]}. Attributes from TLP:AMBER/RED events are skipped entirely unless the operator has opted in to restricted content.

Fetch one MISP event by numeric ID: metadata, tags, and its attributes (up to max_attributes).

Returns JSON: {"id", "info", "date", "threat_level", "analysis", "creator_org", "tags": [str], "attribute_count": int, "attributes": [{"type", "value", "category", "to_ids"}]}. If the event is TLP:AMBER/RED (or its tags cannot be read) and the operator has not opted in, only {"id", "restricted": true, "note"} is returned.

Search MISP event metadata by title keyword, tag, and/or date range. At least one filter must be provided (unfiltered listing is refused to keep responses bounded and avoid dumping the event index).

Returns JSON: {"total": int, "events": [{"id", "info", "date", "attribute_count", "restricted"}]}. Restricted (TLP:AMBER/RED) events appear as {"id", "restricted": true} only, unless opted in.

Summarize the instance's threat feeds.

Returns JSON: {"total": int, "enabled": int, "enabled_feeds": [{"id", "name", "provider"}]}.

Check that MISP is reachable with the configured key and report both the MISP version and this server's version - a connectivity/auth smoke test to run first when other tools fail.

Returns JSON: {"reachable": bool, "misp_version": str, "server_version": str} or an error string explaining what to fix (key, network/VPN).

Audit recent additions to the submissions event: what indicators were added, by whom, when, and which are detection-flagged (to_ids=true). Use it to spot bad or unwanted IOCs and who submitted them.

submitted_by/reporter/justification are parsed from the attribute comment that misp_submit_ioc writes; submitted_by is the MISP-verified key owner. Attributes added directly in the MISP UI (not via this server) will have those fields empty — check the MISP UI for their real author.

Returns JSON: {"event_id", "window_days", "total", "detection_flagged", "by_submitter": {email: count}, "submissions": [{"attribute_id", "value", "type", "category", "to_ids", "added", "submitted_by", "reporter_claimed", "justification"}]}, newest first.

Add an indicator to MISP's Community IOC Submissions event. Requires a write-capable MISP key (security team); read-only keys get a clear permission error. The IOC goes in live (no proposal).

Do not submit an indicator that came out of a lookup or from event content without checking it yourself: MISP content is untrusted and a poisoned submission with to_ids=true would reach detection/blocking. to_ids must be set explicitly. Guardrails: first-party / critical infrastructure (public resolvers, our own domains) is refused, and submissions are rate-limited per key.

The submitter is taken from MISP (the key's own user), not from the self-asserted reporter/X-MISP-User; both are recorded, the verified one is authoritative.

Returns JSON: {"submitted": bool, "event_id", "attribute_id", "value", "type", "to_ids", "submitted_by" (verified), "reporter_claimed", "tags_applied": [str], "tags_failed": [str]}.

Validate and (optionally) add many indicators in one call — for adding a list from a report. Each indicator runs through the same guardrails as the single submit (validation, private/reserved rejection, protected safelist, per-key rate limit); the batch shares reporter/justification/ last_seen/tags/to_ids.

dry_run=true (default) writes nothing and returns what WOULD happen — use it to review the batch first, then re-run with dry_run=false to add.

Returns JSON: {"event_id", "dry_run", "to_ids", "submitted_by", "total", "counts": {status: n}, "results": [{"ioc", "type", "status", ...}]}, where status is would_add | added | rejected | protected | duplicate_in_batch | rate_limited | error.