MISP: Advanced Features

Event Reports let you write a Markdown report directly inside an event. The report can reference the event’s attributes and objects, keeping analysis and data in one place. MISP can also automatically extract entities (IPs, domains, hashes) from pasted report text and turn them into attributes.

An object groups several related attributes according to a template (file, domain-ip, email, url, person…). A “file” object, for example, holds the name, size and hashes of the same sample. Relationships between objects (“communicates-with”, “drops”, “resolves-to”) describe how the pieces connect and power the graph view.

Galaxies link an event to shared knowledge: MITRE ATT&CK techniques, threat actors, malware families, tools. Taxonomies (TLP, PAP, admiralty-scale, kill-chain…) normalize tags. Warninglists flag values with a high false-positive risk: very popular domains, private IP ranges, well-known cloud services.

A sighting records that an indicator was observed (or that it is a false positive, or has expired). Sent automatically from your SIEM or EDR, sightings show which IOCs are actually active in your environment and feed the decaying model.

Indicators lose value over time: a malicious IP is often reassigned within weeks. The decaying model computes a score that drops with the indicator’s age, tags and sightings. You can then exclude “decayed” indicators from the exports that feed your blocking tools.

{
  "returnFormat": "json",
  "type": ["ip-dst", "domain"],
  "includeDecayScore": true,
  "excludeDecayed": true
}

Workflows trigger automatic actions on internal MISP events: an event being published, an attribute being saved, a user being created… Each workflow chains modules (conditions, filters, actions such as adding a tag or calling a webhook) in a visual editor, with no code required.

Every event has a distribution level: your organization, this community, connected communities, all communities, or a specific sharing group. Synchronization between instances honors these levels. External feeds (MISP format, CSV, free text) can be cached so you can correlate against them without importing them.

The restSearch API is the entry point for getting data out of MISP: filter by type, tag, date or IDS flag, and export in many formats (JSON, STIX 2, CSV, Suricata or Snort rules…). PyMISP, the official Python library, covers the same API to script event creation, sightings and searches.

curl -s -X POST https://misp.example.org/attributes/restSearch \
  -H "Authorization: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "returnFormat": "suricata",
    "tags": ["tlp:green"],
    "to_ids": true,
    "last": "7d"
  }'

from pymisp import PyMISP

misp = PyMISP("https://misp.example.org", "YOUR_API_KEY", ssl=True)

# Record that the SOC saw this indicator today
misp.add_sighting({"value": "185.220.101.4", "source": "SOC-EU"})

# Pull every attribute tagged APT28 from the last 30 days
attributes = misp.search(
    controller="attributes",
    tags=["misp-galaxy:threat-actor=\"APT28\""],
    last="30d",
    pythonify=True,
)
for attribute in attributes:
    print(attribute.type, attribute.value)