Health check — return the MISP server version and capability flags. Use this to verify connectivity before issuing other queries.

List MISP events (most recent first). Returns event headers (id, info, date, threat level, tags). For detailed attributes, call misp_get_event with an id. Default page size is 20; max 100.

Fetch a single MISP event by id, including its attributes (IOCs). The response is scanned for prompt-injection payloads before being returned.

Search MISP events by tag, type, value, category, or date range. Useful for threat hunting (e.g. all events tagged with a CVE, or matching an IOC value).

Search MISP attributes (IOCs) directly. Faster than searching events when you have a specific IOC type/value pair to look up.

List all tags configured on the MISP instance. Useful for discovering taxonomy values (TLP levels, malware families, campaign names) before running a tag-scoped search.

List configured MISP threat-intel feeds (enabled and disabled). Use this to understand which external sources are feeding the instance.

List MISP galaxies (threat actor profiles, campaign clusters, technique catalogs). Galaxies are MISP's structured representation of MITRE ATT&CK, threat actors, etc.