Search MISP events by IOC value, type, tags, date range, or organization

Get full details of a specific MISP event including all attributes, objects, tags, and related events

Create a new MISP event for documenting incidents or threat intelligence. Does not publish - use misp_publish_event separately.

Update an existing MISP event's metadata (info, threat level, analysis status). Publishing is separate - use misp_publish_event.

Publish a MISP event, triggering alerts and notifications to sharing partners. State-changing: requires confirm:true (or MISP_ALLOW_DESTRUCTIVE=true).

Add or remove a tag from a MISP event (TLP, MITRE ATT&CK, custom tags). Removing a tag is destructive and requires confirm:true (or MISP_ALLOW_DESTRUCTIVE=true).

Search for specific attributes (IOCs) across all MISP events

Add an IOC/attribute to a MISP event

Add multiple attributes (IOCs) to a MISP event at once

Delete (soft or hard) an attribute from MISP. Destructive: requires confirm:true (or MISP_ALLOW_DESTRUCTIVE=true); hard delete also requires confirmHard:true.

Find correlations for a specific observable value across all MISP events

Get events related to a specific event through shared attributes and correlations

Get all available MISP attribute types and categories with their mappings

List available MISP tags with usage statistics

Search MISP events or attributes by tag (MITRE ATT&CK, TLP, custom tags)

Export IOCs from MISP in various formats (CSV, STIX, Suricata, Snort, text, RPZ)

Export file hashes from MISP for HIDS integration

Report a sighting of an IOC (confirms it was observed in the wild, marks as false positive, or sets expiration)

Check if an observable value appears on any MISP warninglists (known benign/false positive lists)

List available MISP object templates (file, domain-ip, email, network-connection, etc.)

Get details of a specific MISP object template including required and optional attributes

Add a MISP object (structured group of attributes) to an event

Delete a MISP object from an event. Destructive: requires confirm:true (or MISP_ALLOW_DESTRUCTIVE=true); hard delete also requires confirmHard:true.

List available MISP galaxies (MITRE ATT&CK, threat actors, malware families, tools, etc.)

Get a specific galaxy with its clusters (e.g., MITRE ATT&CK techniques, threat actor profiles)

Search galaxy clusters by keyword (find specific MITRE ATT&CK techniques, threat actors, malware, etc.)

Attach a galaxy cluster (MITRE ATT&CK technique, threat actor, etc.) to an event or attribute

List configured MISP feeds (threat intel sources, IOC feeds, etc.)

Enable or disable a MISP feed

Trigger a fetch/pull of data from a specific MISP feed

Cache feed data locally for correlation without creating events

List MISP organisations (local and remote sharing partners)

Get details of a specific MISP organisation

Get MISP server version, status, and diagnostic information

List MISP sharing groups for controlled event distribution

Delete a MISP event (requires appropriate permissions). Destructive: requires confirm:true (or MISP_ALLOW_DESTRUCTIVE=true).