id: misp
name: MISP
version: 1.0.0
description: "MISP (threat-intelligence platform, REST API) — search events and attributes, read and create events, add attributes, tag events, add sightings, publish and delete events. API-key authentication; stdlib-only, no extra Python dependencies. Works with any MISP instance."
changelog: "1.0.0 — Initial release: event/attribute search, event read/create/publish/delete, attribute add, event tagging and sightings."
category: enrichment

# Per-instance configuration. The API key (auth key) is sent in the
# 'Authorization' header. Set insecure for MISP instances with a self-signed cert.
config_schema:
  properties:
    server_url:
      type: string
      description: "MISP instance URL (e.g. https://misp.example.com)"
    api_key:
      type: string
      description: "MISP API authentication key"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - server_url
    - api_key

commands:
  - id: search_events
    name: misp-search-events
    description: "Search events with MISP REST-search filters (returns matching events)."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Attribute value to match" }
        type: { type: string, description: "Attribute type filter (e.g. ip-dst, domain, sha256)" }
        tags: { type: string, description: "Comma-separated tags" }
        limit: { type: number, description: "Maximum events (default 25)" }
        filter_json: { type: string, description: "Raw restSearch filter as a JSON object (advanced; merged last)" }
      required: []
    outputs_schema: { properties: {} }
  - id: search_attributes
    name: misp-search-attributes
    description: "Search attributes with MISP REST-search filters."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Attribute value to match" }
        type: { type: string, description: "Attribute type filter" }
        category: { type: string, description: "Attribute category filter" }
        tags: { type: string, description: "Comma-separated tags" }
        limit: { type: number, description: "Maximum attributes (default 25)" }
        filter_json: { type: string, description: "Raw restSearch filter as a JSON object (advanced; merged last)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_event
    name: misp-get-event
    description: "Get a full event by ID or UUID."
    risk: read
    inputs_schema:
      properties:
        event_id: { type: string, description: "Event ID or UUID" }
      required: [event_id]
    outputs_schema: { properties: {} }
  - id: create_event
    name: misp-create-event
    description: "Create a new event."
    inputs_schema:
      properties:
        info: { type: string, description: "Event description/info" }
        distribution: { type: number, description: "Distribution level 0-4 (default 0 = your org only)" }
        threat_level_id: { type: number, description: "Threat level 1 (high) - 4 (undefined), default 4" }
        analysis: { type: number, description: "Analysis state 0 (initial) - 2 (completed), default 0" }
        published: { type: boolean, description: "Publish immediately (default false)" }
      required: [info]
    outputs_schema: { properties: {} }
  - id: add_attribute
    name: misp-add-attribute
    description: "Add an attribute (indicator) to an event."
    inputs_schema:
      properties:
        event_id: { type: string, description: "Event ID" }
        type: { type: string, description: "Attribute type (e.g. ip-dst, domain, url, sha256)" }
        value: { type: string, description: "Attribute value" }
        category: { type: string, description: "Attribute category (e.g. Network activity)" }
        to_ids: { type: boolean, description: "Mark the attribute for IDS export (default true)" }
        comment: { type: string, description: "Comment" }
      required: [event_id, type, value]
    outputs_schema: { properties: {} }
  - id: add_tag_to_event
    name: misp-add-tag-to-event
    description: "Attach a tag to an event."
    inputs_schema:
      properties:
        event_id: { type: string, description: "Event ID or UUID" }
        tag: { type: string, description: "Tag name (e.g. tlp:amber)" }
      required: [event_id, tag]
    outputs_schema: { properties: {} }
  - id: add_sighting
    name: misp-add-sighting
    description: "Add a sighting for an attribute value."
    inputs_schema:
      properties:
        value: { type: string, description: "Attribute value that was sighted" }
        sighting_type: { type: number, description: "0 = sighting, 1 = false positive, 2 = expiration (default 0)" }
      required: [value]
    outputs_schema: { properties: {} }
  - id: publish_event
    name: misp-publish-event
    description: "Publish an event."
    inputs_schema:
      properties:
        event_id: { type: string, description: "Event ID" }
      required: [event_id]
    outputs_schema: { properties: {} }
  - id: delete_event
    name: misp-delete-event
    description: "Delete an event."
    inputs_schema:
      properties:
        event_id: { type: string, description: "Event ID" }
      required: [event_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: misp-test-connection
    description: "Verify connectivity and the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }