<!-- BusyBot node reference — https://busybot.net/tools/misp/ -->

> Node: MISP (`misp`) · Action · v1
> Category: Development · Credentials: MISP API (`mispApi`)
> Updated: 2026-08-16

# MISP

> Manage MISP threat intelligence events, attributes, tags, feeds, and more.

## Overview

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or even counter-terrorism information. This tool provides CRUD operations on MISP resources including events, attributes, organisations, feeds, galaxies, noticelists, objects, tags, users, and warninglists.

**Category:** Development  
**Tool Name:** `misp`  
**Version:** 1

**Appearance:** Icon: `lucide-Shield` | Color: `#003366`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **MISP API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/misp-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Attribute | `attribute` |
| Event | `event` |
| Event Tag | `eventTag` |
| Feed | `feed` |
| Galaxy | `galaxy` |
| Noticelist | `noticelist` |
| Object | `object` |
| Organisation | `organisation` |
| Tag | `tag` |
| User | `user` |
| Warninglist | `warninglist` |

### Operations

Each resource has its own Operation list, and most resources reuse the same operation values (`create`, `delete`, `get`, `getAll`, `update`). Pick the resource first, then the operation.

| Resource | Operation | Value |
|----------|-----------|-------|
| Attribute | Create | `create` |
| Attribute | Delete | `delete` |
| Attribute | Get | `get` |
| Attribute | Get Many | `getAll` |
| Attribute | Search | `search` |
| Attribute | Update | `update` |
| Event | Create | `create` |
| Event | Delete | `delete` |
| Event | Get | `get` |
| Event | Get Many | `getAll` |
| Event | Publish | `publish` |
| Event | Search | `search` |
| Event | Unpublish | `unpublish` |
| Event | Update | `update` |
| Event Tag | Add | `add` |
| Event Tag | Remove | `remove` |
| Feed | Create | `create` |
| Feed | Disable | `disable` |
| Feed | Enable | `enable` |
| Feed | Get | `get` |
| Feed | Get Many | `getAll` |
| Feed | Update | `update` |
| Galaxy | Delete | `delete` |
| Galaxy | Get | `get` |
| Galaxy | Get Many | `getAll` |
| Noticelist | Get | `get` |
| Noticelist | Get Many | `getAll` |
| Object | Search | `search` |
| Organisation | Create | `create` |
| Organisation | Delete | `delete` |
| Organisation | Get | `get` |
| Organisation | Get Many | `getAll` |
| Organisation | Update | `update` |
| Tag | Create | `create` |
| Tag | Delete | `delete` |
| Tag | Get Many | `getAll` |
| Tag | Update | `update` |
| User | Create | `create` |
| User | Delete | `delete` |
| User | Get | `get` |
| User | Get Many | `getAll` |
| User | Update | `update` |
| Warninglist | Get | `get` |
| Warninglist | Get Many | `getAll` |

### Parameters

Parameter values are sent to MISP exactly as you type them — this node does not evaluate `{{ … }}` expressions in its fields, so enter literal values. To drive a MISP call from upstream data, build the value in an Edit Fields or Code node first and read it back into a fixed field.

Distribution levels are numeric and mean the same thing everywhere they appear. Choosing `4` (Sharing Group) also requires a Sharing Group ID; leaving it blank fails the item with a clear message. Update operations reject an empty Update Fields collection rather than sending a no-op request.

#### Attribute: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event UUID (`eventId`) | `string` | Yes | — | UUID of the event to attach the attribute to. |
| Type | `options` | Yes | `text` | The attribute type. |
| | | | | Options: `text`, `url`, `comment` |
| Value | `string` | Yes | — | The attribute value — the indicator itself. |
| Additional Fields | `collection` | No | `{}` | Optional attribute properties. |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Sharing Group ID | `string` | No | — | Required when Distribution is set to Sharing Group. The numeric ID of the sharing group. |

#### Attribute: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Attribute ID | `string` | Yes | — | UUID or numeric ID of the attribute. |

#### Attribute: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Attribute: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Use JSON to Specify Fields | `boolean` | No | `false` | Whether to use JSON to specify the fields for the search request. |
| JSON (`jsonOutput`) | `json` | No | `{ "value": "search value", "type": "text" }` | JSON body for the restSearch endpoint. See MISP API docs for available fields. _(shown when Use JSON to Specify Fields is `true`)_ |
| Value | `string` | Yes | — | The value to search for, e.g. an IP address or hash. _(shown when Use JSON to Specify Fields is `false`)_ |
| Additional Fields | `collection` | No | `{}` | Extra search criteria. _(shown when Use JSON to Specify Fields is `false`)_ |
| — Category | `string` | No | — | Restrict the search to one MISP category, e.g. Internal reference. |
| — Deleted | `boolean` | No | `false` | Whether to include deleted attributes. |
| — Tags | `string` | No | — | Comma-separated list of tags. |
| — Type | `string` | No | — | Restrict the search to one attribute type, e.g. text. |
| — Published | `boolean` | No | `false` | Whether to restrict the search to published data. |

#### Attribute: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Attribute ID | `string` | Yes | — | ID of the attribute to update. |
| Update Fields | `collection` | No | `{}` | Attribute properties to change. Only the fields you add are sent, and at least one is required. |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Sharing Group ID | `string` | No | — | Required when Distribution is set to Sharing Group. |

#### Attribute: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Attribute ID | `string` | Yes | — | UUID or numeric ID of the attribute. |

#### Event: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Organization ID (`org_id`) | `string` | Yes | — | The numeric ID of the organization. Find IDs in the MISP dashboard under /organisations. |
| Information | `string` | Yes | — | Information on the event - max 65535 characters. |
| Additional Fields | `collection` | No | `{}` | Optional event properties. |
| — Analysis | `options` | No | `0` | Analysis maturity level of the event. |
| | | | | Options: `0` (initial), `1` (ongoing), `2` (complete) |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Sharing Group ID | `string` | No | — | Required when Distribution is set to Sharing Group. |
| — Threat Level ID | `options` | No | `1` | The threat level assigned to the event. |
| | | | | Options: `1` (high), `2` (medium), `3` (low), `4` (undefined) |

#### Event: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |

#### Event: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Event: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Use JSON to Specify Fields | `boolean` | No | `false` | Whether to use JSON to specify the fields for the search request. |
| JSON (`jsonOutput`) | `json` | No | `{ "value": "search value", "type": "text" }` | JSON body for the restSearch endpoint. See MISP API docs for available fields. _(shown when Use JSON to Specify Fields is `true`)_ |
| Value | `string` | Yes | — | The value to search for, e.g. an IP address or hash. _(shown when Use JSON to Specify Fields is `false`)_ |
| Additional Fields | `collection` | No | `{}` | Extra search criteria. _(shown when Use JSON to Specify Fields is `false`)_ |
| — Category | `string` | No | — | Restrict the search to one MISP category, e.g. Internal reference. |
| — Deleted | `boolean` | No | `false` | Whether to include deleted data. |
| — Search All | `string` | No | — | Search by matching any tag names, event descriptions, attribute values or attribute comments. |
| — Tags | `string` | No | — | Comma-separated list of tags. |
| — Type | `string` | No | — | Restrict the search to one attribute type, e.g. text. |
| — Published | `boolean` | No | `false` | Whether to restrict the search to published data. |

#### Event: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |
| Update Fields | `collection` | No | `{}` | Event properties to change. Only the fields you add are sent, and at least one is required. |
| — Analysis | `options` | No | `0` | Analysis maturity level of the event. |
| | | | | Options: `0` (initial), `1` (ongoing), `2` (complete) |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Information | `string` | No | — | Information on the event - max 65535 characters. |
| — Sharing Group ID | `string` | No | — | Required when Distribution is set to Sharing Group. |
| — Threat Level ID | `options` | No | `1` | The threat level assigned to the event. |
| | | | | Options: `1` (high), `2` (medium), `3` (low), `4` (undefined) |

#### Event: Publish

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |

#### Event: Unpublish

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |

#### Event: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |

#### Event Tag: Add

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |
| Tag ID | `string` | Yes | — | Numeric ID of the tag. Find IDs via Tag > Get Many. |

#### Event Tag: Remove

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Event ID | `string` | Yes | — | UUID or numeric ID of the event. |
| Tag ID | `string` | Yes | — | Numeric ID of the tag. Find IDs via Tag > Get Many. |

#### Feed: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Name | `string` | Yes | — | A name for the feed. |
| Provider | `string` | Yes | — | The organisation or source providing the feed. |
| URL | `string` | Yes | — | The URL the feed is fetched from. |
| Additional Fields | `collection` | No | `{}` | Optional feed properties. |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Rules (`json`) | `string` | No | — | Filter rules for the feed. |

#### Feed: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Feed ID | `string` | Yes | — | UUID or numeric ID of the feed. |

#### Feed: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Feed: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Feed ID | `string` | Yes | — | ID of the feed to update. |
| Update Fields | `collection` | No | `{}` | Feed properties to change. Only the fields you add are sent, and at least one is required. |
| — Distribution | `options` | No | `0` | Who will be able to see this event once published. |
| | | | | Options: `0` (your organization only), `1` (this community only), `2` (connected communities), `3` (all communities), `4` (sharing group), `5` (inherit event) |
| — Name | `string` | No | — | A new name for the feed. |
| — Provider | `string` | No | — | A new provider for the feed. |
| — Rules (`rules`) | `json` | No | — | Filter rules for the feed. |
| — URL | `string` | No | — | A new URL for the feed. |

#### Feed: Enable

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Feed ID | `string` | Yes | — | UUID or numeric ID of the feed. |

#### Feed: Disable

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Feed ID | `string` | Yes | — | UUID or numeric ID of the feed. |

#### Galaxy: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Galaxy ID | `string` | Yes | — | UUID or numeric ID of the galaxy. |

#### Galaxy: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Galaxy: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Galaxy ID | `string` | Yes | — | UUID or numeric ID of the galaxy. |

#### Noticelist: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Noticelist ID | `string` | Yes | — | Numeric ID of the noticelist. |

#### Noticelist: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Object: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Use JSON to Specify Fields | `boolean` | No | `false` | Whether to use JSON to specify the fields for the search request. |
| JSON (`jsonOutput`) | `json` | No | `{ "value": "search value", "type": "text" }` | JSON body for the restSearch endpoint. See MISP API docs for available fields. _(shown when Use JSON to Specify Fields is `true`)_ |
| Value | `string` | Yes | — | The value to search for, e.g. an IP address or hash. _(shown when Use JSON to Specify Fields is `false`)_ |
| Additional Fields | `collection` | No | `{}` | Extra search criteria. _(shown when Use JSON to Specify Fields is `false`)_ |
| — Category | `string` | No | — | Restrict the search to one MISP category, e.g. Internal reference. |
| — Deleted | `boolean` | No | `false` | Whether to include deleted data. |
| — Search All | `string` | No | — | Search by matching any tag names, event descriptions, attribute values or attribute comments. |
| — Tags | `string` | No | — | Comma-separated list of tags. |
| — Type | `string` | No | — | Restrict the search to one attribute type, e.g. text. |
| — Published | `boolean` | No | `false` | Whether to restrict the search to published data. |

#### Organisation: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Name | `string` | Yes | — | The organisation's name. |
| Additional Fields | `collection` | No | `{}` | Optional organisation properties. |
| — Created by Email | `string` | No | — | The email address recorded as the creator. |
| — Description | `string` | No | — | A description of the organisation. |
| — Nationality | `string` | No | — | The organisation's nationality. |
| — Sector | `string` | No | — | The organisation's sector. |
| — Type | `string` | No | — | The organisation's type. |
| — User Count | `number` | No | `0` | The number of users in the organisation. |

#### Organisation: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Organisation ID | `string` | Yes | — | UUID or numeric ID of the organisation. |

#### Organisation: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Organisation: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Organisation ID | `string` | Yes | — | ID of the organisation to update. |
| Update Fields | `collection` | No | `{}` | Organisation properties to change. Only the fields you add are sent, and at least one is required. |
| — Description | `string` | No | — | A description of the organisation. |
| — Name | `string` | No | — | A new name for the organisation. |
| — Nationality | `string` | No | — | The organisation's nationality. |
| — Sector | `string` | No | — | The organisation's sector. |
| — Type | `string` | No | — | The organisation's type. |

#### Organisation: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Organisation ID | `string` | Yes | — | UUID or numeric ID of the organisation. |

#### Tag: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Name | `string` | Yes | — | The tag name. |
| Additional Fields | `collection` | No | `{}` | Optional tag properties. |
| — Color (`colour`) | `string` | No | — | Hex color code for the tag (e.g. #ff0000). |

#### Tag: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Tag: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Tag ID | `string` | Yes | — | ID of the tag to update. |
| Update Fields | `collection` | No | `{}` | Tag properties to change. Only the fields you add are sent, and at least one is required. |
| — Color (`colour`) | `string` | No | — | Hex color code for the tag (e.g. #ff0000). |
| — Name | `string` | No | — | A new name for the tag. |

#### Tag: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Tag ID | `string` | Yes | — | Numeric ID of the tag. |

#### User: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Email | `string` | Yes | — | The new user's email address. |
| Role ID | `string` | Yes | — | Role IDs are available in the MISP dashboard at /roles/index. |
| Additional Fields | `collection` | No | `{}` | Optional user properties. |
| — GPG Key | `string` | No | — | The user's public GPG key. |
| — Inviter Email or ID (`invited_by`) | `string` | No | — | User ID of the inviter. Find IDs via User > Get Many. |
| — Organization ID (`org_id`) | `string` | No | — | Numeric ID of the organization. Find IDs via Organisation > Get Many. |

#### User: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | Numeric ID of the user. |

#### User: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### User: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | ID of the user to update. |
| Update Fields | `collection` | No | `{}` | User properties to change. Only the fields you add are sent, and at least one is required. |
| — Email | `string` | No | — | A new email address for the user. |
| — GPG Key | `string` | No | — | The user's public GPG key. |
| — Inviter ID (`invited_by`) | `string` | No | — | User ID of the inviter. Find IDs via User > Get Many. |
| — Organization ID (`org_id`) | `string` | No | — | Numeric ID of the organization. Find IDs via Organisation > Get Many. |

#### User: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | Numeric ID of the user. |

#### Warninglist: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Warninglist ID | `string` | Yes | — | Numeric ID of the warninglist. |

#### Warninglist: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

The MISP response is **merged onto the input item's JSON** at the top level — the returned fields sit alongside the fields the item already carried, so downstream nodes address them directly (`{{ $json.uuid }}`). A response field with the same name as an existing item field overwrites it. Binary data on the input item is forwarded.

| Operations | Output |
|------------|--------|
| Every Get Many, and Attribute / Event / Object Search | **One output item per record** — a page of 50 events becomes 50 output items from a single input item. A response with no records produces no output items for that input. |
| Create, Get and Update on attributes, events, feeds, organisations, tags and users | One output item carrying the record, already unwrapped from its MISP envelope so its fields sit at the top level rather than under `Attribute` or `Event`. |
| Delete, Publish, Unpublish, Feed Enable and Disable, Event Tag Add and Remove | One output item carrying MISP's confirmation message for the call. |

An attribute arrives like this:

```json
{
  "id": "12345",
  "event_id": "678",
  "object_id": "0",
  "category": "Other",
  "type": "text",
  "value": "203.0.113.10",
  "to_ids": false,
  "uuid": "5f8a7c1e-1234-4c5d-8e9f-0a1b2c3d4e5f",
  "timestamp": "1768478400",
  "distribution": "0",
  "sharing_group_id": "0",
  "comment": "",
  "deleted": false
}
```

**Event: Get and Event: Update return the event without its attribute list.** The `Attribute` array is removed so a single busy event cannot flood the workflow with a multi-megabyte item. To work with an event's indicators, follow up with **Attribute: Get Many** or **Attribute: Search**.

Search results come back already unwrapped: an attribute search yields the attributes themselves, and event and object searches yield the events and objects. Turning Return All off trims the result list to the Limit.

## Usage Examples

- Get all events from MISP
- Create a new attribute on a MISP event
- Search MISP attributes by IOC value
- Publish a MISP event
- Add a tag to a MISP event

## Example Configuration

Create an event for a new incident:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "create",
    "org_id": "1",
    "information": "Phishing campaign targeting finance team",
    "additionalFields": {
      "analysis": 1,
      "distribution": 1,
      "threat_level_id": 2
    }
  }
}
```

Attach an indicator to that event:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "create",
    "eventId": "5f8a7c1e-1234-4c5d-8e9f-0a1b2c3d4e5f",
    "type": "url",
    "value": "http://malicious.example.com/login",
    "additionalFields": {
      "distribution": 5
    }
  }
}
```

Search attributes for a specific IOC:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "search",
    "useJson": false,
    "value": "203.0.113.10",
    "additionalFields": {
      "type": "text",
      "tags": "tlp:amber,malware",
      "published": true
    }
  }
}
```

Run the same search with a raw restSearch body when you need fields the form does not expose:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "search",
    "useJson": true,
    "jsonOutput": "{\"value\":\"203.0.113.10\",\"type\":\"ip-dst\",\"last\":\"7d\"}"
  }
}
```

List the most recent events:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50
  }
}
```

Publish an event so partner communities can see it:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "publish",
    "eventId": "678"
  }
}
```

Tag an event:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "eventTag",
    "operation": "add",
    "eventId": "678",
    "tagId": "42"
  }
}
```

Create a tag with a colour:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "tag",
    "operation": "create",
    "name": "campaign:finance-phish",
    "additionalFields": {
      "colour": "#ff0000"
    }
  }
}
```

Register a threat feed:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "feed",
    "operation": "create",
    "name": "OSINT URL feed",
    "provider": "Example CERT",
    "url": "https://feeds.example.org/urls.json",
    "additionalFields": {
      "distribution": 3
    }
  }
}
```

Turn a feed on:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "feed",
    "operation": "enable",
    "feedId": "7"
  }
}
```

Add an analyst account:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "email": "analyst@example.org",
    "role_id": "3",
    "additionalFields": {
      "org_id": "1"
    }
  }
}
```

Create a partner organisation:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "organisation",
    "operation": "create",
    "name": "Example CERT",
    "additionalFields": {
      "description": "National CERT partner",
      "nationality": "BE",
      "sector": "Government",
      "type": "CERT"
    }
  }
}
```

Raise an event's threat level:

```json
{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "update",
    "eventId": "678",
    "updateFields": {
      "threat_level_id": 1,
      "analysis": 2,
      "information": "Phishing campaign — confirmed compromise"
    }
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

MISP threat intelligence platform tool for managing events, attributes, tags, feeds, organisations, users, galaxies, noticelists, objects, and warninglists.