Misp Project MISP Automation API

Name: MISP Automation API
Brand: MISP Automation API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey165 EndpointsREST

For Agents

Query, enrich, and publish threat intelligence on a MISP instance — events, attributes, indicators, sightings, and warninglists — through a single automation API.

Install Jentic One Beta

Connect the MISP Automation API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the MISP Automation API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with MISP Automation API.

Run filtered intel queries with POST /attributes/restSearch and POST /events/restSearch returning paginated indicators

Add, edit, and delete attributes on existing events through /attributes/add/{eventId}, /attributes/edit/{attributeId}, and /attributes/delete/{attributeId}

Manage analyst notes, opinions, and relationships via the /analystData endpoints across notes, opinions, and analyst objects

GET STARTED

Start building with MISP Automation API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use MISP Automation API for, with concrete tasks.

★ Indicator Enrichment Pipeline

Pull indicators from MISP into a SOC pipeline using POST /attributes/restSearch with structured filters such as type, tag, or to_ids flag. The agent can paginate through results, transform them for the SIEM or EDR, and push them as detection rules. Reduces the time between intel publication and detection coverage.

POST /attributes/restSearch with type=ip-dst and tag=tlp:white, paginate results, and write each value to the SIEM watchlist

Sighting and False Positive Tracking

When a sensor matches an indicator, record the observation back into MISP as a sighting and, if the match turns out to be benign, delete the attribute via /attributes/delete/{attributeId}. The two-way flow keeps the shared intelligence accurate for the wider community.

POST a sighting for the matched attribute, then if confirmed benign POST /attributes/delete/{attributeId} with a note in the analystData

Event-Driven Incident Response

Triage an incoming alert by creating a MISP event, adding the observed indicators with /attributes/add/{eventId}, and attaching analyst notes via the /analystData/add endpoints. Automation can package an alert into a MISP event in seconds rather than the analyst manually keying values into the UI.

Create the MISP event, POST /attributes/add/{eventId} for each observable, and POST /analystData/add/Note/{eventUUID}/Event with the analyst summary

Threat Intel Feed Maintenance

Schedule periodic feed refreshes and validate incoming indicators against warninglists to prevent benign infrastructure (CDNs, DNS roots, RFC1918) from polluting detections. The agent runs the refresh, then queries warninglists to filter the new attributes.

Refresh feeds, then POST /attributes/restSearch and cross-check each value against /warninglists/checkValue to filter known-good infrastructure

Agent-Driven Threat Hunting

An AI agent uses Jentic to drive MISP operations during hunts: pull recent events, score relevance for the environment, and post sightings for matches. Jentic isolates the MISP API key for the per-tenant base URL so the agent never holds it directly.

Search Jentic for 'search MISP attributes', load the restSearch schema, and pull every IP attribute added in the last hour

Key Endpoints

165 endpoints — jentic publishes the only available openapi specification for misp automation api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/attributes/restSearch

Search attributes with rich filters

POST

/events/restSearch

Search events with rich filters

POST

/attributes/add/{eventId}

Add an attribute to an event

PUT

/attributes/edit/{attributeId}

Edit an attribute

DELETE

/attributes/delete/{attributeId}

Delete an attribute

POST

/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}

Add analyst note, opinion, or relationship

GET

/analystData/index/{analystType}

List analyst data by type

POST

/attributes/restSearch

Search attributes with rich filters

POST

/events/restSearch

Search events with rich filters

POST

/attributes/add/{eventId}

Add an attribute to an event

PUT

/attributes/edit/{attributeId}

Edit an attribute

DELETE

/attributes/delete/{attributeId}

Delete an attribute

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The MISP API key is stored encrypted in the Jentic vault per deployment URL. Agents call MISP through scoped execution requests, so the key never enters agent context even when the deployment is on a private network address.

Intent-based discovery

Agents search Jentic for intents like 'search MISP attributes' or 'record a sighting' and Jentic returns the matching MISP operation with its input schema, hiding the size of the 165-endpoint surface.

Time to first call

Direct MISP integration: several days to learn restSearch, sharing groups, and analystData. Through Jentic: under an hour for the first useful flow.

FAQs

Specific to using MISP Automation API through Jentic.

Why is there no official OpenAPI spec for MISP Automation API?

The MISP project does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MISP Automation API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the MISP Automation API use?

MISP uses an API key in the `Authorization` request header (apiKey scheme). Each user on the MISP instance can mint a personal automation key via the UI. Through Jentic the key is stored in the vault per deployment URL.

Can I search MISP attributes by tag with this API?

Yes. POST /attributes/restSearch accepts a JSON body with filters including type, tag, value, to_ids, and date ranges, returning paginated matching attributes. It is the primary discovery endpoint for downstream automation.

How do I record a sighting through Jentic?

Run `pip install jentic`, search Jentic for 'record a sighting in MISP', and Jentic returns the matching MISP sighting endpoint. Provide the attribute id and the source identifier; the sighting is recorded against the attribute.

How does the API handle the per-deployment base URL?

Each MISP instance runs at its own URL (often inside a private network — the spec uses `https://misp.local` as a placeholder). Set the base URL on the client to point at your deployment, and Jentic stores it alongside the API key for that instance.

Can I add analyst notes to events?

Yes. POST /analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType} attaches a note, opinion, or relationship to an existing event or attribute. Use GET /analystData/index/{analystType} to list existing analyst data by type.

Misp Project MISP Automation API

Connect the MISP Automation API to your agent

Capabilities

Start building with MISP Automation API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs