MISP

Operations 39

• Tag Attribute
  Attach a tag to an attribute by tag id or tag name.
  misp.add_attribute_tag
• Tag Event
  Attach a tag to an event by tag id or tag name.
  misp.add_event_tag
• Attach Tag by UUID
  Tag an event or an attribute addressed by its UUID rather than its id.
  misp.attach_tag
• Cache Feeds
  Queue a rebuild of the feed caches that power feed correlation.
  misp.cache_feeds
• Check Values Against Warninglists
  Test indicators against the enabled warninglists before acting on them.
  misp.check_warninglist_values
• Create Attribute
  Add an indicator to an event as a new attribute.
  misp.create_attribute
• Create Event
  Create an event; MISP fills in the org, date and UUID you omit.
  misp.create_event
• Create Feed
  Register a new feed so MISP can pull intelligence from it.
  misp.create_feed
• Create Tag
  Define a tag on the instance; this attaches it to nothing.
  misp.create_tag
• Delete Attribute
  Soft-delete an attribute; misp.restore_attribute undoes it.
  misp.delete_attribute
• Delete Event
  Soft-delete an event; MISP keeps it retrievable as deleted.
  misp.delete_event
• Delete Tag
  Remove a tag definition from the instance.
  misp.delete_tag
• Detach Tag by UUID
  Untag an event or an attribute addressed by its UUID rather than its id.
  misp.detach_tag
• Disable Feed
  Switch a feed off without deleting its configuration.
  misp.disable_feed
• Disable Warninglists
  Switch off one or more warninglists, named by id or by name.
  misp.disable_warninglists
• Enable Feed
  Switch a feed on so MISP includes it in the next pull.
  misp.enable_feed
• Enable Warninglists
  Switch on one or more warninglists, named by id or by name.
  misp.enable_warninglists
• Fetch Feed
  Ask MISP to pull one feed now; the pull runs in the background.
  misp.fetch_feed
• Get Attribute
  Fetch one attribute by its numeric id or UUID.
  misp.get_attribute
• Get Event
  Fetch one event in full, with its attributes, objects and tags.
  misp.get_event
• Get Feed
  Fetch one feed's configuration by numeric id or UUID.
  misp.get_feed
• Get Tag
  Fetch one tag definition by its numeric id.
  misp.get_tag
• Get Warninglist
  Fetch one warninglist by numeric id, including its entries.
  misp.get_warninglist
• List Events
  List the event index — event metadata only, without attributes.
  misp.list_events
• List Feeds
  List every configured feed, enabled or not.
  misp.list_feeds
• List Tags
  List every tag defined on the instance.
  misp.list_tags
• List Warninglists
  List every warninglist and whether it is currently enabled.
  misp.list_warninglists
• Publish Event
  Publish an event, which MISP usually runs as a background job.
  misp.publish_event
• Untag Attribute
  Remove a tag from an attribute by tag id or tag name.
  misp.remove_attribute_tag
• Untag Event
  Remove a tag from an event by tag id or tag name.
  misp.remove_event_tag
• Restore Attribute
  Undo a soft delete and bring an attribute back into its event.
  misp.restore_attribute
• Search Attributes
  Search attributes through restSearch — the indicator lookup.
  misp.search_attributes
• Search Events
  Search events through restSearch, the endpoint MISP recommends.
  misp.search_events
• Search Tags
  Search tags by name, with their taxonomy and galaxy context.
  misp.search_tags
• Unpublish Event
  Take a published event back off the wire.
  misp.unpublish_event
• Update Attribute
  Merge a set of fields into an existing attribute.
  misp.update_attribute
• Update Event
  Merge a set of fields into an existing event.
  misp.update_event
• Update Feed
  Merge a set of fields into an existing feed configuration.
  misp.update_feed
• Update Tag
  Merge a set of fields into an existing tag definition.
  misp.update_tag