canonical: https://jentic.com/apis/misp-project.org/misp

# Misp Project MISP Automation API

Jentic publishes the only available OpenAPI specification for MISP Automation API, keeping it validated and agent-ready. MISP (Malware Information Sharing Platform) is the open-source threat intelligence platform used to share indicators of compromise across CERTs, ISACs, and security teams. The automation API exposes 165 endpoints covering events, attributes, objects, analyst data, sharing groups, taxonomies, galaxies, warninglists, sightings, feeds, and the full restSearch query language. Each MISP deployment runs at its own URL.

## For AI agents

Query, enrich, and publish threat intelligence on a MISP instance - events, attributes, indicators, sightings, and warninglists - through a single automation API.

## Scope

Does not handle endpoint detection, network packet capture, or vulnerability scanning - use for threat intelligence storage, sharing, and querying only.

## Capabilities

- Run filtered intel queries with POST `/attributes/restSearch` and POST `/events/restSearch` returning paginated indicators
- Add, edit, and delete attributes on existing events through `/attributes/add/{eventId}`, `/attributes/edit/{attributeId}`, and `/attributes/delete/{attributeId}`
- Manage analyst notes, opinions, and relationships via the /analystData endpoints across notes, opinions, and analyst objects
- Record sightings of an indicator to track which observers have seen it where
- Read and apply taxonomies, galaxies, and warninglists to classify and validate indicators
- Share events across MISP communities through sharing group endpoints
- Pull and refresh threat feeds configured on the MISP instance

## Use cases

### Indicator Enrichment Pipeline

Pull indicators from MISP into a SOC pipeline using POST `/attributes/restSearch` with structured filters such as type, tag, or to_ids flag. The agent can paginate through results, transform them for the SIEM or EDR, and push them as detection rules. Reduces the time between intel publication and detection coverage.

Example prompt: POST `/attributes/restSearch` with type=ip-dst and tag=tlp:white, paginate results, and write each value to the SIEM watchlist

### Sighting and False Positive Tracking

When a sensor matches an indicator, record the observation back into MISP as a sighting and, if the match turns out to be benign, delete the attribute via `/attributes/delete/{attributeId}.` The two-way flow keeps the shared intelligence accurate for the wider community.

Example prompt: POST a sighting for the matched attribute, then if confirmed benign POST `/attributes/delete/{attributeId}` with a note in the analystData

### Event-Driven Incident Response

Triage an incoming alert by creating a MISP event, adding the observed indicators with `/attributes/add/{eventId}`, and attaching analyst notes via the `/analystData/add` endpoints. Automation can package an alert into a MISP event in seconds rather than the analyst manually keying values into the UI.

Example prompt: Create the MISP event, POST `/attributes/add/{eventId}` for each observable, and POST `/analystData/add/Note/{eventUUID}/Event` with the analyst summary

### Threat Intel Feed Maintenance

Schedule periodic feed refreshes and validate incoming indicators against warninglists to prevent benign infrastructure (CDNs, DNS roots, RFC1918) from polluting detections. The agent runs the refresh, then queries warninglists to filter the new attributes.

Example prompt: Refresh feeds, then POST `/attributes/restSearch` and cross-check each value against `/warninglists/checkValue` to filter known-good infrastructure

### Agent-Driven Threat Hunting

An AI agent uses Jentic to drive MISP operations during hunts: pull recent events, score relevance for the environment, and post sightings for matches. Jentic isolates the MISP API key for the per-tenant base URL so the agent never holds it directly.

Example prompt: Search Jentic for 'search MISP attributes', load the restSearch schema, and pull every IP attribute added in the last hour

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/attributes/restSearch` | Search attributes with rich filters |
| POST | `/events/restSearch` | Search events with rich filters |
| POST | `/attributes/add/{eventId}` | Add an attribute to an event |
| PUT | `/attributes/edit/{attributeId}` | Edit an attribute |
| DELETE | `/attributes/delete/{attributeId}` | Delete an attribute |
| POST | `/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}` | Add analyst note, opinion, or relationship |
| GET | `/analystData/index/{analystType}` | List analyst data by type |

## Key resources

- **Events** — Container objects holding attributes, objects, and analyst data for an incident or campaign
- **Attributes** — Individual indicators of compromise - IPs, hashes, URLs, file names - attached to events
- **Analyst Data** — Notes, opinions, and relationships between events and attributes
- **Sightings** — Records of where and when indicators were observed
- **Warninglists** — Lists of known-good values used to filter false positives
- **Feeds** — External sources of indicators imported into the MISP instance

## Why Jentic

- **Setup:** Wiring MISP by hand means handling its API key in the Authorization header, pointing at your own deployment URL, and coding the attribute, event, and analyst-data calls across a large endpoint surface yourself. Through Jentic you install once, import MISP from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** MISP puts the event id and attribute id in the URL path (`/attributes/add/{eventId}`, `/attributes/edit/{attributeId}`), so a rule can pin your agent to one event's attributes. You choose the operations it may call, so a destructive one like deleting an attribute is not included unless you add it.
- **Credential handling:** Your MISP API key is stored once, encrypted, by your own Jentic One instance per deployment URL and injected at execution time. It never enters the agent's prompt, logs, or context, even when the deployment is on a private network address.
- **Discovery method:** Agents search Jentic by intent such as 'search MISP attributes' or 'add an attribute to an event', and Jentic returns the matching MISP operation with its input schema so the agent calls the right endpoint without navigating the full endpoint surface.

## Related APIs

- **Shodan** — Shodan provides internet-scan data that enriches attributes ingested into MISP
- **AbuseIPDB** — AbuseIPDB scores IP reputation that can be cross-referenced with MISP attributes
- **CrowdStrike Falcon** — CrowdStrike Falcon Intelligence is a commercial threat intel platform

## FAQ

### Why is there no official OpenAPI spec for MISP Automation API?

The MISP project does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MISP Automation API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the MISP Automation API use?

MISP uses an API key in the `Authorization` request header (apiKey scheme). Each user on the MISP instance can mint a personal automation key via the UI. Through Jentic the key is stored in the vault per deployment URL.

### Can I search MISP attributes by tag with this API?

Yes. POST `/attributes/restSearch` accepts a JSON body with filters including type, tag, value, to_ids, and date ranges, returning paginated matching attributes. It is the primary discovery endpoint for downstream automation.

### How do I record a sighting through Jentic?

Run `pip install jentic`, search Jentic for 'record a sighting in MISP', and Jentic returns the matching MISP sighting endpoint. Provide the attribute id and the source identifier; the sighting is recorded against the attribute.

### How does the API handle the per-deployment base URL?

Each MISP instance runs at its own URL (often inside a private network - the spec uses `https://misp.local` as a placeholder). Set the base URL on the client to point at your deployment, and Jentic stores it alongside the API key for that instance.

### Can I add analyst notes to events?

Yes. POST `/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}` attaches a note, opinion, or relationship to an existing event or attribute. Use GET `/analystData/index/{analystType}` to list existing analyst data by type.

### Can I limit what my agent is allowed to do with the MISP Automation API?

Yes. Because you run Jentic One yourself, your own rules decide which MISP operations and credentials the agent may use, so you can grant read-only calls like POST `/attributes/restSearch` and POST `/events/restSearch` while leaving out a destructive one such as DELETE `/attributes/delete/{attributeId}` unless you explicitly add it. Since MISP puts the event id and attribute id in the URL path, for example `/attributes/add/{eventId}` and `/attributes/edit/{attributeId}`, you can pin the agent to a single event's attributes. The API key is injected only at execution time and never enters the agent's prompt or context.