MISP
Business appsAPI keyConnection test available
Threat intelligence: events, attributes, tags, feeds and warninglists.
OCNORA ships 39 typed MISP operations. Each node has a schema-driven form, input and output tables beside its settings, and is pre-flighted by Workflow Health before your first real run.
Before you connect MISP
- Authentication
- API key
- Credential
- the MISP automation key, or {"api_key": "…"}
- Connection test
- Available: the stored credential can be checked against the provider when you add it. This is not a record that a test was run or passed.
What you can do with MISP
Operations, grouped by what they do to your data.
Create and send 5
Read and search 14
Update 9
Delete and cancel 5
A sample MISP workflow
- 1A core triggerStart the run from a chat, form, manual, schedule, webhook, workflow trigger — no MISP trigger is needed.
- 2Check Values Against Warninglistsmisp.check_warninglist_valuesTest indicators against the enabled warninglists before acting on them.
- 3Tag Attributemisp.add_attribute_tagAttach a tag to an attribute by tag id or tag name.
An outline built from this provider’s node contracts, not a recorded run. Each step’s output fields are available to the next in the field picker.
Every node below has a reference page: what it does, the connection it needs, its config fields with types, constraints and examples, and the shapes it emits.
Operations 39
- Tag AttributeAttach a tag to an attribute by tag id or tag name.misp.add_attribute_tag
- Tag EventAttach a tag to an event by tag id or tag name.misp.add_event_tag
- Attach Tag by UUIDTag an event or an attribute addressed by its UUID rather than its id.misp.attach_tag
- Cache FeedsQueue a rebuild of the feed caches that power feed correlation.misp.cache_feeds
- Check Values Against WarninglistsTest indicators against the enabled warninglists before acting on them.misp.check_warninglist_values
- Create AttributeAdd an indicator to an event as a new attribute.misp.create_attribute
- Create EventCreate an event; MISP fills in the org, date and UUID you omit.misp.create_event
- Create FeedRegister a new feed so MISP can pull intelligence from it.misp.create_feed
- Create TagDefine a tag on the instance; this attaches it to nothing.misp.create_tag
- Delete AttributeSoft-delete an attribute; misp.restore_attribute undoes it.misp.delete_attribute
- Delete EventSoft-delete an event; MISP keeps it retrievable as deleted.misp.delete_event
- Delete TagRemove a tag definition from the instance.misp.delete_tag
- Detach Tag by UUIDUntag an event or an attribute addressed by its UUID rather than its id.misp.detach_tag
- Disable FeedSwitch a feed off without deleting its configuration.misp.disable_feed
- Disable WarninglistsSwitch off one or more warninglists, named by id or by name.misp.disable_warninglists
- Enable FeedSwitch a feed on so MISP includes it in the next pull.misp.enable_feed
- Enable WarninglistsSwitch on one or more warninglists, named by id or by name.misp.enable_warninglists
- Fetch FeedAsk MISP to pull one feed now; the pull runs in the background.misp.fetch_feed
- Get AttributeFetch one attribute by its numeric id or UUID.misp.get_attribute
- Get EventFetch one event in full, with its attributes, objects and tags.misp.get_event
- Get FeedFetch one feed's configuration by numeric id or UUID.misp.get_feed
- Get TagFetch one tag definition by its numeric id.misp.get_tag
- Get WarninglistFetch one warninglist by numeric id, including its entries.misp.get_warninglist
- List EventsList the event index — event metadata only, without attributes.misp.list_events
- List FeedsList every configured feed, enabled or not.misp.list_feeds
- List TagsList every tag defined on the instance.misp.list_tags
- List WarninglistsList every warninglist and whether it is currently enabled.misp.list_warninglists
- Publish EventPublish an event, which MISP usually runs as a background job.misp.publish_event
- Untag AttributeRemove a tag from an attribute by tag id or tag name.misp.remove_attribute_tag
- Untag EventRemove a tag from an event by tag id or tag name.misp.remove_event_tag
- Restore AttributeUndo a soft delete and bring an attribute back into its event.misp.restore_attribute
- Search AttributesSearch attributes through restSearch — the indicator lookup.misp.search_attributes
- Search EventsSearch events through restSearch, the endpoint MISP recommends.misp.search_events
- Search TagsSearch tags by name, with their taxonomy and galaxy context.misp.search_tags
- Unpublish EventTake a published event back off the wire.misp.unpublish_event
- Update AttributeMerge a set of fields into an existing attribute.misp.update_attribute
- Update EventMerge a set of fields into an existing event.misp.update_event
- Update FeedMerge a set of fields into an existing feed configuration.misp.update_feed
- Update TagMerge a set of fields into an existing tag definition.misp.update_tag
MISP questions
- How does OCNORA authenticate with MISP?
- With a stored API key credential, shaped the MISP automation key, or {"api_key": "…"}. A connection test can check it when you add it.
- What can I automate with MISP?
- 39 typed operations, each with a reference page listing its config fields and the shapes it emits.
- What if the MISP operation I need is not listed?
- Where MISP has an HTTP API, call it from the HTTP node with the same credential, or describe the step to the AI builder, which asks our team for a typed node when one is missing.
- Are there templates that use MISP?
- Not yet. Start from a blank workflow, or describe the workflow to Build with AI.
- How are MISP calls controlled?
- Every call and every run step is audited, runs count against the execution budget, and Workflow Health pre-flights the workflow when you save it.
More in Business apps
See your first MISP workflow run.
Book a technical demo. We add the connection, pick a template or describe the workflow to Build with AI, and Workflow Health checks it before it runs.