Misp Project MISP Automation API
Agent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey165 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Query, enrich, and publish threat intelligence on a MISP instance - events, attributes, indicators, sightings, and warninglists - through a single automation API.
Use for: Search MISP for every IP attribute tagged 'tlp:white' in the last 24 hours, Add a new IP indicator to event 12345, Record a sighting of file hash abc on the production sensor, List the current warninglists configured on the instance
Not supported: Does not handle endpoint detection, network packet capture, or vulnerability scanning - use for threat intelligence storage, sharing, and querying only.
Jentic publishes the only available OpenAPI specification for MISP Automation API, keeping it validated and agent-ready. MISP (Malware Information Sharing Platform) is the open-source threat intelligence platform used to share indicators of compromise across CERTs, ISACs, and security teams. The automation API exposes 165 endpoints covering events, attributes, objects, analyst data, sharing groups, taxonomies, galaxies, warninglists, sightings, feeds, and the full restSearch query language. Each MISP deployment runs at its own URL.
Install Jentic One Beta
Connect the MISP Automation API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the MISP Automation API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmisp-project.org%2Fmisp" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmisp-project.org%2Fmisp" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with MISP Automation API.
Run filtered intel queries with POST /attributes/restSearch and POST /events/restSearch returning paginated indicators
Add, edit, and delete attributes on existing events through /attributes/add/{eventId}, /attributes/edit/{attributeId}, and /attributes/delete/{attributeId}
Manage analyst notes, opinions, and relationships via the /analystData endpoints across notes, opinions, and analyst objects
Record sightings of an indicator to track which observers have seen it where
Read and apply taxonomies, galaxies, and warninglists to classify and validate indicators
Share events across MISP communities through sharing group endpoints
Pull and refresh threat feeds configured on the MISP instance
Use Cases
Patterns agents use MISP Automation API for, with concrete tasks.
★ Indicator Enrichment Pipeline
Pull indicators from MISP into a SOC pipeline using POST /attributes/restSearch with structured filters such as type, tag, or to_ids flag. The agent can paginate through results, transform them for the SIEM or EDR, and push them as detection rules. Reduces the time between intel publication and detection coverage.
POST /attributes/restSearch with type=ip-dst and tag=tlp:white, paginate results, and write each value to the SIEM watchlist
Sighting and False Positive Tracking
When a sensor matches an indicator, record the observation back into MISP as a sighting and, if the match turns out to be benign, delete the attribute via /attributes/delete/{attributeId}. The two-way flow keeps the shared intelligence accurate for the wider community.
POST a sighting for the matched attribute, then if confirmed benign POST /attributes/delete/{attributeId} with a note in the analystData
Event-Driven Incident Response
Triage an incoming alert by creating a MISP event, adding the observed indicators with /attributes/add/{eventId}, and attaching analyst notes via the /analystData/add endpoints. Automation can package an alert into a MISP event in seconds rather than the analyst manually keying values into the UI.
Create the MISP event, POST /attributes/add/{eventId} for each observable, and POST /analystData/add/Note/{eventUUID}/Event with the analyst summary
Threat Intel Feed Maintenance
Schedule periodic feed refreshes and validate incoming indicators against warninglists to prevent benign infrastructure (CDNs, DNS roots, RFC1918) from polluting detections. The agent runs the refresh, then queries warninglists to filter the new attributes.
Refresh feeds, then POST /attributes/restSearch and cross-check each value against /warninglists/checkValue to filter known-good infrastructure
Agent-Driven Threat Hunting
An AI agent uses Jentic to drive MISP operations during hunts: pull recent events, score relevance for the environment, and post sightings for matches. Jentic isolates the MISP API key for the per-tenant base URL so the agent never holds it directly.
Search Jentic for 'search MISP attributes', load the restSearch schema, and pull every IP attribute added in the last hour
Key Endpoints
165 endpoints — jentic publishes the only available openapi specification for misp automation api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/attributes/restSearch
Search attributes with rich filters
POST
/events/restSearch
Search events with rich filters
POST
/attributes/add/{eventId}
Add an attribute to an event
PUT
/attributes/edit/{attributeId}
Edit an attribute
DELETE
/attributes/delete/{attributeId}
Delete an attribute
POST
/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}
Add analyst note, opinion, or relationship
GET
/analystData/index/{analystType}
List analyst data by type
POST
/attributes/restSearch
Search attributes with rich filters
POST
/events/restSearch
Search events with rich filters
POST
/attributes/add/{eventId}
Add an attribute to an event
PUT
/attributes/edit/{attributeId}
Edit an attribute
DELETE
/attributes/delete/{attributeId}
Delete an attribute
POST
/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}
Add analyst note, opinion, or relationship
GET
/analystData/index/{analystType}
List analyst data by type
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring MISP by hand means handling its API key in the Authorization header, pointing at your own deployment URL, and coding the attribute, event, and analyst-data calls across a large endpoint surface yourself. Through Jentic you install once, import MISP from the API Directory, store the key once, and your agent calls it.
Permission scoping
MISP puts the event id and attribute id in the URL path (/attributes/add/{eventId}, /attributes/edit/{attributeId}), so a rule can pin your agent to one event's attributes. You choose the operations it may call, so a destructive one like deleting an attribute is not included unless you add it.
Credential isolation
Your MISP API key is stored once, encrypted, by your own Jentic One instance per deployment URL and injected at execution time. It never enters the agent's prompt, logs, or context, even when the deployment is on a private network address.
Intent-based discovery
Agents search Jentic by intent such as 'search MISP attributes' or 'add an attribute to an event', and Jentic returns the matching MISP operation with its input schema so the agent calls the right endpoint without navigating the full endpoint surface.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using MISP Automation API through Jentic.
Why is there no official OpenAPI spec for MISP Automation API?
The MISP project does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MISP Automation API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the MISP Automation API use?
MISP uses an API key in the `Authorization` request header (apiKey scheme). Each user on the MISP instance can mint a personal automation key via the UI. Through Jentic the key is stored in the vault per deployment URL.
Can I search MISP attributes by tag with this API?
Yes. POST /attributes/restSearch accepts a JSON body with filters including type, tag, value, to_ids, and date ranges, returning paginated matching attributes. It is the primary discovery endpoint for downstream automation.
How do I record a sighting through Jentic?
Run `pip install jentic`, search Jentic for 'record a sighting in MISP', and Jentic returns the matching MISP sighting endpoint. Provide the attribute id and the source identifier; the sighting is recorded against the attribute.
How does the API handle the per-deployment base URL?
Each MISP instance runs at its own URL (often inside a private network - the spec uses `https://misp.local` as a placeholder). Set the base URL on the client to point at your deployment, and Jentic stores it alongside the API key for that instance.
Can I add analyst notes to events?
Yes. POST /analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType} attaches a note, opinion, or relationship to an existing event or attribute. Use GET /analystData/index/{analystType} to list existing analyst data by type.
Can I limit what my agent is allowed to do with the MISP Automation API?
Yes. Because you run Jentic One yourself, your own rules decide which MISP operations and credentials the agent may use, so you can grant read-only calls like POST /attributes/restSearch and POST /events/restSearch while leaving out a destructive one such as DELETE /attributes/delete/{attributeId} unless you explicitly add it. Since MISP puts the event id and attribute id in the URL path, for example /attributes/add/{eventId} and /attributes/edit/{attributeId}, you can pin the agent to a single event's attributes. The API key is injected only at execution time and never enters the agent's prompt or context.
GET STARTED