feat(misp): new MISP threat-intel integration

10 commands: event/attribute search, event read/create/publish/delete, attribute add, event tagging, sightings. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 22:58:16 +02:00
parent 7bec81ad0a
commit 7d0e4aa18a
11 changed files with 675 additions and 0 deletions
@@ -0,0 +1,131 @@
+id: misp
+name: MISP
+version: 1.0.0
+description: "MISP (threat-intelligence platform, REST API) — search events and attributes, read and create events, add attributes, tag events, add sightings, publish and delete events. API-key authentication; stdlib-only, no extra Python dependencies. Works with any MISP instance."
+changelog: "1.0.0 — Initial release: event/attribute search, event read/create/publish/delete, attribute add, event tagging and sightings."
+category: enrichment
+
+# Per-instance configuration. The API key (auth key) is sent in the
+# 'Authorization' header. Set insecure for MISP instances with a self-signed cert.
+config_schema:
+  properties:
+    server_url:
+      type: string
+      description: "MISP instance URL (e.g. https://misp.example.com)"
+    api_key:
+      type: string
+      description: "MISP API authentication key"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - server_url
+    - api_key
+
+commands:
+  - id: search_events
+    name: misp-search-events
+    description: "Search events with MISP REST-search filters (returns matching events)."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Attribute value to match" }
+        type: { type: string, description: "Attribute type filter (e.g. ip-dst, domain, sha256)" }
+        tags: { type: string, description: "Comma-separated tags" }
+        limit: { type: number, description: "Maximum events (default 25)" }
+        filter_json: { type: string, description: "Raw restSearch filter as a JSON object (advanced; merged last)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: search_attributes
+    name: misp-search-attributes
+    description: "Search attributes with MISP REST-search filters."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Attribute value to match" }
+        type: { type: string, description: "Attribute type filter" }
+        category: { type: string, description: "Attribute category filter" }
+        tags: { type: string, description: "Comma-separated tags" }
+        limit: { type: number, description: "Maximum attributes (default 25)" }
+        filter_json: { type: string, description: "Raw restSearch filter as a JSON object (advanced; merged last)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_event
+    name: misp-get-event
+    description: "Get a full event by ID or UUID."
+    risk: read
+    inputs_schema:
+      properties:
+        event_id: { type: string, description: "Event ID or UUID" }
+      required: [event_id]
+    outputs_schema: { properties: {} }
+  - id: create_event
+    name: misp-create-event
+    description: "Create a new event."
+    inputs_schema:
+      properties:
+        info: { type: string, description: "Event description/info" }
+        distribution: { type: number, description: "Distribution level 0-4 (default 0 = your org only)" }
+        threat_level_id: { type: number, description: "Threat level 1 (high) - 4 (undefined), default 4" }
+        analysis: { type: number, description: "Analysis state 0 (initial) - 2 (completed), default 0" }
+        published: { type: boolean, description: "Publish immediately (default false)" }
+      required: [info]
+    outputs_schema: { properties: {} }
+  - id: add_attribute
+    name: misp-add-attribute
+    description: "Add an attribute (indicator) to an event."
+    inputs_schema:
+      properties:
+        event_id: { type: string, description: "Event ID" }
+        type: { type: string, description: "Attribute type (e.g. ip-dst, domain, url, sha256)" }
+        value: { type: string, description: "Attribute value" }
+        category: { type: string, description: "Attribute category (e.g. Network activity)" }
+        to_ids: { type: boolean, description: "Mark the attribute for IDS export (default true)" }
+        comment: { type: string, description: "Comment" }
+      required: [event_id, type, value]
+    outputs_schema: { properties: {} }
+  - id: add_tag_to_event
+    name: misp-add-tag-to-event
+    description: "Attach a tag to an event."
+    inputs_schema:
+      properties:
+        event_id: { type: string, description: "Event ID or UUID" }
+        tag: { type: string, description: "Tag name (e.g. tlp:amber)" }
+      required: [event_id, tag]
+    outputs_schema: { properties: {} }
+  - id: add_sighting
+    name: misp-add-sighting
+    description: "Add a sighting for an attribute value."
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Attribute value that was sighted" }
+        sighting_type: { type: number, description: "0 = sighting, 1 = false positive, 2 = expiration (default 0)" }
+      required: [value]
+    outputs_schema: { properties: {} }
+  - id: publish_event
+    name: misp-publish-event
+    description: "Publish an event."
+    inputs_schema:
+      properties:
+        event_id: { type: string, description: "Event ID" }
+      required: [event_id]
+    outputs_schema: { properties: {} }
+  - id: delete_event
+    name: misp-delete-event
+    description: "Delete an event."
+    inputs_schema:
+      properties:
+        event_id: { type: string, description: "Event ID" }
+      required: [event_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: misp-test-connection
+    description: "Verify connectivity and the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }