lookup-misp

Two-way bridge to a MISP threat-intelligence platform. Unlike the other lookup-* skills, this one also writes — it can create events, add attributes, tag events, and import STIX 2 bundles. Treat write commands as deliberate actions; don't use them in autonomous enrichment loops.

When to invoke

Read:

• An indicator was found by another lookup (VT, OTX, …) — check whether MISP already has it
• An analyst wants the most recent published events for a threat actor or campaign
• You need to export a slice of MISP as a STIX 2 bundle for sharing

Write:

• A finished investigation produced indicators that should be shared with the community
• An existing event needs to be enriched with newly observed attributes
• A STIX 2 bundle written via /stix-bundle should be pushed into MISP as event(s)

Do NOT invoke for:

• Bulk enrichment (use VT/OTX first; only push the high-confidence subset to MISP)
• Pivoting on raw indicators — MISP is a curated dataset, not a scanning service. Use Shodan/Censys for that.

How to invoke

Single Python CLI (stdlib only — no install).

Read operations

# Search published events containing a value, optionally filtered by tag/date/published
python3 tools/clis/misp.py search-events --value 1.2.3.4 --tag tlp:white --limit 20
python3 tools/clis/misp.py search-events --tag misp-galaxy:threat-actor=\"APT28\" --from 2026-01-01

# Search attributes (the most common indicator lookup)
python3 tools/clis/misp.py search-attributes --type ip-dst --value 1.2.3.4
python3 tools/clis/misp.py search-attributes --type sha256 --value <hash> --limit 5

# Inspect a single event (full attribute + object detail)
python3 tools/clis/misp.py get-event 12345

# Search objects within an event
python3 tools/clis/misp.py search-objects --event-id 12345 --name file

# Resolve tag names → ids (needed before applying tags)
python3 tools/clis/misp.py list-tags --search tlp

# Export a search result as a STIX 2 bundle (cross-platform sharing)
python3 tools/clis/misp.py search-events --tag malware-family:lockbit --returnFormat stix2 > out.json

Write operations

# Add one attribute to an existing event
python3 tools/clis/misp.py add-attribute 12345 \
  --type ip-dst --value 185.220.101.45 \
  --category 'Network activity' \
  --comment 'C2 observed 2026-04-25' \
  --to-ids true \
  --distribution 1 \
  --tags 'tlp:amber,kill-chain:command-and-control'

# Create a new event (skeleton — add attributes/objects after)
python3 tools/clis/misp.py create-event \
  --info 'APT28 C2 cluster — April 2026' \
  --threat-level 2 --analysis 1 \
  --distribution 1 \
  --tags 'tlp:amber,misp-galaxy:threat-actor="APT28"'

# Upload a STIX 2 bundle as one or more events (the canonical bulk-import path)
python3 tools/clis/misp.py upload-stix data/stix-bundles/2026-04-26-apt28-c2.json \
  --publish --galaxies-as-tags --force-contextual-data

# Tag an existing event (resolves tag name → id automatically)
python3 tools/clis/misp.py tag-event 12345 'tlp:amber'

# Publish an event (makes it visible to other orgs at the chosen distribution)
python3 tools/clis/misp.py publish-event 12345

All commands accept --dry-run (preview the HTTP call without sending) and --insecure (skip TLS verification, common on internal MISP deployments).

The CLI exits 2 if MISP_URL or MISP_API_KEY is unset (when not in dry-run). Report missing credentials; do not fabricate.

Distribution levels

--distribution N on add-attribute and create-event:

Default to 0 while drafting. Bump to 1+ only after review and TLP alignment.

STIX 2 round-tripping

This is the killer feature. The pack already writes STIX 2.1 bundles via /stix-bundle; upload-stix pushes them into MISP intact:

1. Run an investigation (e.g. /ip-investigation)
2. Build a STIX bundle from the findings (/stix-bundle)
3. Apply TLP + Admiralty (/apply-tlp, /score-source)
4. python3 tools/clis/misp.py upload-stix <bundle.json> --galaxies-as-tags
5. Review in MISP → add context → publish

For exporting MISP → STIX, set --returnFormat stix2 on search-events.

Gotcha: MISP's STIX 2 importer rejects inline TLP marking-definition objects (the STIX 2.0 definition_type: "tlp" shape that /stix-bundle produces). Either drop the marking-definition from the bundle and apply TLP via tag-event after import, or trim the bundle to references only. See tools/integrations/misp.md for details.

Response format

Read commands return:

source: misp
operation: search-events | search-attributes | get-event | ...
query_time: <ISO8601>
filters: <echoed filters>
count: <n>
events|attributes|objects: [<distilled summaries>]
raw: <full response on get-event for completeness>

Write commands return:

source: misp
operation: add-attribute | create-event | upload-stix | ...
query_time: <ISO8601>
event_id|event|attribute: <created/updated object summary>
result|raw: <MISP response envelope>

Source reliability (Admiralty default)

Default rating for downstream /score-source: B2 (usually reliable, probably true). MISP is a sharing platform — the underlying org's reliability matters more than MISP itself. Adjust based on the event's Org/Orgc:

• Sector CSIRT or national CERT (CIRCL, FIRST, ISAC) → A1
• Reputable vendor (Mandiant, CrowdStrike, ESET) → A2 / B2
• Anonymous community contributor → C3
• Your own org (self-hosted) → A1 — primary source

Read the event tags too: admiralty-scale:source-reliability="b" and admiralty-scale:information-credibility="2" are common. They are the Admiralty rating of the party that set them. Show them as such.

Evidence grades are a different instrument. Admiralty ratings apply to lookup results and single items; the evidence grade from /quality-of-information-check applies to claims from documents; neither is converted into the other. When pushing graded claims, do not tag them with the admiralty-scale taxonomy. Use the plain tags cti-skills:access-level="direct" and cti-skills:claim-support="firm" per attribute, as set out in /ioc-export. When reading, a MISP confidence value becomes claim support by the import table in /ioc-export, with access level indirect and the flag derived_from_confidence.

Operational notes

• Distribution is sticky. Once a published event syncs to other servers, it can't be recalled. Default to draft (0) and review before publishing.
• Tagging matters. TLP, kill-chain, and galaxy tags drive how MISP routes events to subscribers. Don't skip them.
• PyMISP exists — for complex workflows (sightings, warninglists, feed management) the PyMISP library is the right tool. This CLI covers the 80% case for query + write, stdlib-only.
• Don't autopublish. --publish on upload-stix is convenient but bypasses the human review step. Skip it for intel you haven't manually validated.

Related skills

• /stix-bundle — write STIX 2.1 bundles that this CLI's upload-stix consumes
• /lookup-virustotal, /lookup-otx — community reputation lookups; chain before pushing to MISP
• /score-source — apply Admiralty rating before publishing
• /apply-tlp — set TLP markings before publishing
• /intelligence-sharing — broader sharing-model context (TAXII, ISACs, MISP communities)
• /lookup-opencti — the knowledge-base sibling; MISP = community exchange, OpenCTI = internal knowledge graph
• /ip-investigation, /domain-investigation, /hash-investigation, /url-investigation — produce findings that MISP write commands consume

See also

• Integration setup: tools/integrations/misp.md
• Python CLI source: tools/clis/misp.py
• MISP project: https://www.misp-project.org/
• OpenAPI reference: https://www.misp-project.org/openapi/
• PyMISP (full SDK, when this CLI isn't enough): https://github.com/MISP/PyMISP
• Tag taxonomies: https://github.com/MISP/misp-taxonomies
• Galaxy clusters: https://github.com/MISP/misp-galaxy