misp_add_attribute
Add an IOC or attribute to a MISP event by specifying the type, value, and event ID. Optionally attach tags, comments, or set distribution and IDS flag.
Instructions
Add an IOC/attribute to a MISP event
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags to apply to the attribute | |
| type | Yes | Attribute type (ip-src, ip-dst, domain, md5, sha256, sha1, url, email-src, hostname, filename, etc.) | |
| toIds | No | Flag for IDS export (default true for applicable types) | |
| value | Yes | The IOC value | |
| comment | No | Context/notes about this IOC | |
| eventId | Yes | Event ID to add the attribute to | |
| category | No | Category (auto-determined from type if omitted) | |
| distribution | No | Distribution level (0-4) |