Misp Project MISP Automation API

Name: MISP Automation API
Brand: MISP Automation API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey165 EndpointsREST

For Agents

Query, enrich, and publish threat intelligence on a MISP instance - events, attributes, indicators, sightings, and warninglists - through a single automation API.

Use for: Search MISP for every IP attribute tagged 'tlp:white' in the last 24 hours, Add a new IP indicator to event 12345, Record a sighting of file hash abc on the production sensor, List the current warninglists configured on the instance

Not supported: Does not handle endpoint detection, network packet capture, or vulnerability scanning - use for threat intelligence storage, sharing, and querying only.

Jentic publishes the only available OpenAPI specification for MISP Automation API, keeping it validated and agent-ready. MISP (Malware Information Sharing Platform) is the open-source threat intelligence platform used to share indicators of compromise across CERTs, ISACs, and security teams. The automation API exposes 165 endpoints covering events, attributes, objects, analyst data, sharing groups, taxonomies, galaxies, warninglists, sightings, feeds, and the full restSearch query language. Each MISP deployment runs at its own URL.

Jentic One on Github

Install Jentic One Beta

Connect the MISP Automation API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the MISP Automation API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmisp-project.org%2Fmisp" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmisp-project.org%2Fmisp" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with MISP Automation API.

Run filtered intel queries with POST /attributes/restSearch and POST /events/restSearch returning paginated indicators

Add, edit, and delete attributes on existing events through /attributes/add/{eventId}, /attributes/edit/{attributeId}, and /attributes/delete/{attributeId}

Manage analyst notes, opinions, and relationships via the /analystData endpoints across notes, opinions, and analyst objects

Record sightings of an indicator to track which observers have seen it where

GET STARTED

Start building with MISP Automation API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use MISP Automation API for, with concrete tasks.

★ Indicator Enrichment Pipeline

Pull indicators from MISP into a SOC pipeline using POST /attributes/restSearch with structured filters such as type, tag, or to_ids flag. The agent can paginate through results, transform them for the SIEM or EDR, and push them as detection rules. Reduces the time between intel publication and detection coverage.

POST /attributes/restSearch with type=ip-dst and tag=tlp:white, paginate results, and write each value to the SIEM watchlist

Sighting and False Positive Tracking

When a sensor matches an indicator, record the observation back into MISP as a sighting and, if the match turns out to be benign, delete the attribute via /attributes/delete/{attributeId}. The two-way flow keeps the shared intelligence accurate for the wider community.

POST a sighting for the matched attribute, then if confirmed benign POST /attributes/delete/{attributeId} with a note in the analystData

Event-Driven Incident Response

Triage an incoming alert by creating a MISP event, adding the observed indicators with /attributes/add/{eventId}, and attaching analyst notes via the /analystData/add endpoints. Automation can package an alert into a MISP event in seconds rather than the analyst manually keying values into the UI.

Create the MISP event, POST /attributes/add/{eventId} for each observable, and POST /analystData/add/Note/{eventUUID}/Event with the analyst summary

Threat Intel Feed Maintenance

Schedule periodic feed refreshes and validate incoming indicators against warninglists to prevent benign infrastructure (CDNs, DNS roots, RFC1918) from polluting detections. The agent runs the refresh, then queries warninglists to filter the new attributes.

Refresh feeds, then POST /attributes/restSearch and cross-check each value against /warninglists/checkValue to filter known-good infrastructure

Agent-Driven Threat Hunting

An AI agent uses Jentic to drive MISP operations during hunts: pull recent events, score relevance for the environment, and post sightings for matches. Jentic isolates the MISP API key for the per-tenant base URL so the agent never holds it directly.

Search Jentic for 'search MISP attributes', load the restSearch schema, and pull every IP attribute added in the last hour

Key Endpoints

165 endpoints — jentic publishes the only available openapi specification for misp automation api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/attributes/restSearch

Search attributes with rich filters

POST

/events/restSearch

Search events with rich filters

POST

/attributes/add/{eventId}

Add an attribute to an event

PUT

/attributes/edit/{attributeId}

Edit an attribute

DELETE

/attributes/delete/{attributeId}

Delete an attribute

POST

/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}

Add analyst note, opinion, or relationship

GET

/analystData/index/{analystType}

List analyst data by type

POST

/attributes/restSearch

Search attributes with rich filters

POST

/events/restSearch

Search events with rich filters

POST

/attributes/add/{eventId}

Add an attribute to an event

PUT

/attributes/edit/{attributeId}

Edit an attribute

DELETE

/attributes/delete/{attributeId}

Delete an attribute

POST

/analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType}

Add analyst note, opinion, or relationship

GET

/analystData/index/{analystType}

List analyst data by type

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring MISP by hand means handling its API key in the Authorization header, pointing at your own deployment URL, and coding the attribute, event, and analyst-data calls across a large endpoint surface yourself. Through Jentic you install once, import MISP from the API Directory, store the key once, and your agent calls it.

Permission scoping

MISP puts the event id and attribute id in the URL path (/attributes/add/{eventId}, /attributes/edit/{attributeId}), so a rule can pin your agent to one event's attributes. You choose the operations it may call, so a destructive one like deleting an attribute is not included unless you add it.

Credential isolation

Your MISP API key is stored once, encrypted, by your own Jentic One instance per deployment URL and injected at execution time. It never enters the agent's prompt, logs, or context, even when the deployment is on a private network address.

Intent-based discovery

Agents search Jentic by intent such as 'search MISP attributes' or 'add an attribute to an event', and Jentic returns the matching MISP operation with its input schema so the agent calls the right endpoint without navigating the full endpoint surface.

FAQs

Specific to using MISP Automation API through Jentic.

Why is there no official OpenAPI spec for MISP Automation API?

The MISP project does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MISP Automation API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the MISP Automation API use?

MISP uses an API key in the `Authorization` request header (apiKey scheme). Each user on the MISP instance can mint a personal automation key via the UI. Through Jentic the key is stored in the vault per deployment URL.

Can I search MISP attributes by tag with this API?

Yes. POST /attributes/restSearch accepts a JSON body with filters including type, tag, value, to_ids, and date ranges, returning paginated matching attributes. It is the primary discovery endpoint for downstream automation.

How do I record a sighting through Jentic?

Run `pip install jentic`, search Jentic for 'record a sighting in MISP', and Jentic returns the matching MISP sighting endpoint. Provide the attribute id and the source identifier; the sighting is recorded against the attribute.

How does the API handle the per-deployment base URL?

Each MISP instance runs at its own URL (often inside a private network - the spec uses `https://misp.local` as a placeholder). Set the base URL on the client to point at your deployment, and Jentic stores it alongside the API key for that instance.

Can I add analyst notes to events?

Yes. POST /analystData/add/{analystType}/{analystObjectUUID}/{analystObjectType} attaches a note, opinion, or relationship to an existing event or attribute. Use GET /analystData/index/{analystType} to list existing analyst data by type.

Can I limit what my agent is allowed to do with the MISP Automation API?

Yes. Because you run Jentic One yourself, your own rules decide which MISP operations and credentials the agent may use, so you can grant read-only calls like POST /attributes/restSearch and POST /events/restSearch while leaving out a destructive one such as DELETE /attributes/delete/{attributeId} unless you explicitly add it. Since MISP puts the event id and attribute id in the URL path, for example /attributes/add/{eventId} and /attributes/edit/{attributeId}, you can pin the agent to a single event's attributes. The API key is injected only at execution time and never enters the agent's prompt or context.

Misp Project MISP Automation API

Connect the MISP Automation API to your agent

Capabilities

Start building with MISP Automation API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs