Integration

MISP integration

MISP threat intelligence sharing platform API: search events and attributes with the rich restSearch filters, create and publish events, add and edit attributes, apply tags to events, attributes and objects, record sightings of an indicator, and check values against the warning lists that catch known-good infrastructure. MISP is self hosted, so the instance host is part of the credential alongside the automation key.

Connect MISP How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in MISP.Built from the 18 MISP tools below, on the connection you add once.

Common MISP use cases

resolving a tag name before applying it to an event
clearing a workflow tag once processing has finished
creating an internal workflow tag for automated triage
removing an indicator that was added to the wrong event
marking an event as reviewed once automated triage has run
publishing an event once its indicators have been reviewed
removing an event created in error by an automated importer
validating a stored MISP credential before an ingestion run
creating an event to hold the indicators of a fresh incident
raising the threat level of an event as an incident develops

What you can do with MISP

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Event, 6 operations

add_eventAdd eventPOSTCreates a MISP event to hold indicators from an incident or a report.
delete_eventDelete eventDELETEDeletes a MISP event with its attributes and objects.
get_eventGet eventGETReturns a single MISP event with everything attached to it.
publish_eventPublish eventPOSTPublishes a MISP event so connected instances and feeds receive it.
search_eventsSearch eventsPOSTSearches MISP events by value, type, tag, organisation or time window.
update_eventUpdate eventPOSTChanges the title, distribution, threat level or analysis state of a MISP event.

Attribute, 4 operations

add_attributeAdd attributePOSTAdds an indicator value to a MISP event as a typed attribute.
delete_attributeDelete attributeDELETEDeletes an attribute from its MISP event.
search_attributesSearch attributesPOSTSearches MISP attributes by value, type, tag or time window across every event.
update_attributeUpdate attributePOSTChanges the value, type, detection flag or comment of a MISP attribute.

Tag, 4 operations

add_tagAdd tagPOSTCreates a tag that can then be applied to events, attributes and objects.
attach_tag_to_objectAttach tag to objectPOSTApplies a tag to a MISP event, attribute or object by uuid.
list_tagsList tagsGETReturns every tag defined on the MISP instance with its identifier and colour.
remove_tag_from_objectRemove tag from objectPOSTRemoves a tag from a MISP event, attribute or object by uuid.

Warninglist, 2 operations

check_values_against_warninglistsCheck values against warninglistsPOSTTells you which of the supplied values appear on a MISP warning list of known-good infrastructure.
list_warninglistsList warninglistsGETReturns the MISP warning lists that flag known-good values, with their enabled state.

Server, 1 operation

get_versionGet versionGETReturns the MISP version and what the authenticated key is allowed to do.

Sighting, 1 operation

add_sightingAdd sightingPOSTRecords a sighting of one or more indicator values so the community learns they are still active.

Use MISP from Claude Code, Cursor or Codex

Connect MISP in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its MISP operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect MISP

Create your workspace
Sign up free. Nothing to install.
Connect MISP once
Add your MISP connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

MISP integration FAQ

What can you do with the MISP integration?

LiveContext exposes 18 operations on MISP, covering event, attribute, tag and warninglist. Common uses include resolving a tag name before applying it to an event, clearing a workflow tag once processing has finished and creating an internal workflow tag for automated triage.