Type to search.

MISP connector

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The MISP connector uses the Malware Information Sharing Platform (MISP) automation API so workflow authors and agents can enrich detections from a self-hosted MISP instance and write sightings, events, attributes, and tags back.

You can use this connector in Agent Builder and Workflows.

Create an MISP connector from the Connectors page. To open the page, find Connectors in the navigation or under Alerts and Insights / Connectors in the global search bar.

MISP URL
Base URL of your MISP instance, for example https://misp.example.com or https://localhost. Don't include a trailing slash or an /attributes path.
Authentication
Automation API key. Kibana sends the key as Authorization: <key>. Do not add a Bearer prefix. MISP rejects that form. Create the key from Administration → List Auth Keys.
For self-signed TLS (common on local Docker MISP), set verification mode to none. Use full when the instance presents a publicly trusted certificate. Optionally provide a Client Authentication Privacy Enhanced Mail (CA PEM) for private certificate authorities (CAs).
Action Description
searchAttributes Search attributes by value, type, category, tags, or event. Parameters: value, type, category, tags, eventId, limit (default 10), page (default 1).
searchEvents Search events by indicator, tags, info, or date range. Parameters: value, tags, eventInfo, from, to, limit, page.
checkIndicator Reputation-style lookup for one IOC. Returns verdict (unknown | known | malicious) plus matches. Empty results mean unknown, not clean. Parameters: value (required), type.
addSighting Record a sighting on an attribute by id/UUID or value. Parameters: attributeId or value (at least one required), type (0=sighting, 1=false-positive, 2=expiration; default 0), source.
getEvent Fetch a full event by id or UUID. Parameters: eventId (required).
checkWarninglist Check values against enabled warninglists. Parameters: values (required array).
createEvent Create an event. Parameters: info (required), distribution, threatLevelId, analysis, published (default false).
addAttribute Add an IOC to an event. Parameters: eventId, type, value (required), category, toIds (default true), comment.
publishEvent Publish an event. Parameters: eventId (required).
addTagToEvent Apply a tag to an event. Parameters: eventId, tag (required).

Use the Action configuration settings to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings to set per-host configurations.

  1. Sign in to your MISP instance as an administrator.
  2. Open Administration → List Auth Keys (or Sync Actions → List Auth Keys, depending on version).
  3. Create an automation key for a user that can search attributes and events. If you use write actions, grant that user permission to create events, attributes, tags, and sightings. The user also needs permission to publish events.
  4. Copy the API key into the connector (no Bearer prefix).
  5. If the instance uses a self-signed certificate, set verification mode to none (or supply the PEM CA).