MISP n8n integrationAutomate MISP with n8n.

New values land in MISP as attributes, and this call creates one inside an event you already identified.

• Event UUID: the UUID of the event the attribute gets attached to, often {{ $json.field }} from the node that created the event.
• Type: three choices, text, url and comment.
• Value: required, so the node halts the execution while it stays empty.
• Distribution: an additional field that decides who will be able to see this event once published.

Removal is the whole job here: the attribute disappears from the event it was attached to.

• Attribute ID: the UUID or the numeric ID of the attribute, both accepted.

Reading one attribute back gives the following nodes its full record rather than the identifier alone.

• Attribute ID: the UUID or numeric ID of the attribute you want.

Listing attributes without a filter returns them in a batch, one n8n item per attribute.

• Return All: switched on, n8n chains the pages of the API until every attribute is in; switched off, it stops at Limit.
• Limit: the maximum number of attributes returned when Return All stays off.

Search narrows the list down to the attributes that match what you pass in, instead of pulling everything and filtering afterwards.

• Value: the value to match, an address in the shape of 127.0.0.1 for example.
• Tags: a comma-separated list of tags.
• Category: restricts the search to one category.
• Use JSON to Specify Fields: turned on, the search fields are written as JSON instead of filled in the form.

Editing an existing attribute happens through this operation, which leaves the fields you do not fill untouched.

• Attribute ID: the ID of the attribute to update.
• Distribution: an update field for who will be able to see this event once published.
• Sharing Group Name or ID: only useful when Sharing Group is the value selected in Distribution, chosen from the list or given as an expression.

Every MISP event starts somewhere, and this operation opens a new one under an organization you select.

• Organization Name or ID: picked from the list, or given as an expression when the value comes from an earlier node.
• Information: the description of the event, up to 65535 characters.
• Threat Level ID: High, Medium, Low or Undefined.
• Analysis: the analysis maturity level, Initial, Ongoing or Complete.

Deleting an event takes it out of the instance, and the attributes attached to it go with the event.

• Event ID: the UUID or numeric ID of the event.

Pulling one event back by its identifier hands the rest of the workflow the full record to work from.

• Event ID: the UUID or numeric ID of the event, accepted in either form.

Bulk reading is what this call is for: MISP returns the events, and n8n turns each one into a separate item.

• Return All: on, n8n follows the pages until the whole list is retrieved; off, it stops early.
• Limit: the ceiling on how many events come back while Return All is off.

Publishing moves an event into its published state, the point from which its distribution setting decides who sees it.

• Event ID: the UUID or numeric ID of the event to publish.

Filtering at the source keeps the run light: MISP returns only the events matching the criteria you set.

• Value: the value to match, 127.0.0.1 for instance.
• Published: a boolean filter on the published state.
• Search All: matches against any tag names, event descriptions, attribute values or attribute comments.
• Deleted: a boolean that brings deleted records into the scope.

The reverse move: the event leaves its published state and goes back to being an internal record.

• Event ID: the UUID or numeric ID of the event.

Editing an event after the fact goes through here, field by field, without touching what you leave blank.

• Event ID: the UUID or numeric ID of the event to change.
• Information: the description, up to 65535 characters.
• Analysis: Initial, Ongoing or Complete.
• Distribution: who will be able to see this event once published.

Tags are how events stay findable later, and this call attaches one to an event that already exists.

• Event ID: the UUID or numeric ID of the event receiving the tag.
• Tag Name or ID: chosen from the list, or given as an expression when the tag depends on the incoming item.

Detaching a tag leaves the event itself alone, only the link between the two disappears.

• Event ID: the UUID or numeric ID of the event.
• Tag Name or ID: the tag to detach, from the list or as an expression.

A feed is registered in MISP with a name, a provider and a URL, and this operation writes that registration.

• Name: required text.
• Provider: required text.
• URL: required, in the shape of https://example.com.
• Rules: an additional field holding the filter rules for the feed.

Turning a feed off is a single call, and the registration stays in place for later.

• Feed ID: the UUID or numeric ID of the feed.

Switching a feed back on takes the same shape, with the identifier as the only thing to provide.

• Feed ID: the UUID or numeric ID of the feed to enable.

One feed, read by its identifier, with its registration returned to the next node.

• Feed ID: the UUID or numeric ID of the feed.

The full inventory of feeds comes back here, one n8n item per feed.

• Return All: on, every feed is retrieved page after page; off, the run stops at Limit.
• Limit: how many feeds at most come back while Return All is off.

Changing a registration without deleting it is what this operation is for.

• Feed ID: the ID of the feed to update.
• URL: the address the feed points at.
• Provider: the provider recorded for the feed.
• Rules: the filter rules for the feed.

Removing a galaxy is a one shot call: the node sends a single identifier and MISP drops that galaxy from the instance the credential points to.

• Galaxy ID: the UUID or the numeric ID of the galaxy to delete. When the value arrives from an earlier node, reference it with an expression, the n8n syntax that reads a field of the incoming item, written {{ $json.field }}.

Point the node at one galaxy and it returns that record on its own, so a workflow never has to walk the whole instance to find it.

• Galaxy ID: the UUID or the numeric ID of the galaxy to read.

Listing galaxies hands the workflow the inventory the instance holds, which is the usual first step before anything gets filtered or compared further down.

• Return All: switched on, n8n keeps requesting pages until every galaxy has come back; switched off, the node stops at Limit.
• Limit: the maximum number of galaxies returned while Return All stays off.

A single noticelist comes back when the node is given its number, without touching the rest of the catalog. That keeps the output small enough to read in one look when the run is being debugged.

• Noticelist ID: the numeric ID of the noticelist to fetch, hardcoded when the workflow always reads the same one, or taken from the incoming item with an expression written {{ $json.field }}.

Pulling the full set of noticelists gives a workflow the view of everything that catalog carries at a given moment.

• Return All: on, the node walks through the API pages until nothing is left; off, it hands back only what Limit allows.
• Limit: caps how many noticelists the node returns.

Searching objects starts from a value: the node sends it to MISP and returns the objects that match.

• Value: required, the value to look for, an IP address such as 127.0.0.1 in the example the field shows.
• Tags: a comma separated list of tags, in the tag1,tag2 form.
• Search All: matches any tag names, event descriptions, attribute values or attribute comments.

Creating an organization writes a new entry in MISP under the name the node sends.

• Name: required, the organization name, and the only value the operation needs to run.
• Additional Fields: the optional block that carries Description, Sector, Nationality, Type, Created by Email and User Count in the same call.

Once an organization no longer belongs on the instance, this operation removes its record in a single call. Since nothing in the node asks for a confirmation, the safety net belongs in the workflow itself.

• Organisation ID: the UUID or the numeric ID of the organisation to remove, which is why a read step usually runs first to confirm the right record was picked.

Reading one organization record is all this does: the node returns the entry matching the identifier it was given, and nothing around it.

• Organisation ID: the UUID or the numeric ID of the organisation to read, mapped from the preceding node with an expression such as {{ $json.field }}.

The full roster of organizations known to the instance comes back here, one item per organization.

• Return All: enabled, n8n chains the API pages until every organization sits in the output; disabled, Limit decides how many come back.
• Limit: the ceiling on the number of organizations returned.

Editing an existing organization means naming it by ID, then listing what should change in the Update Fields block.

• Organisation ID: required, the ID of the organisation to update.
• Update Fields: the block that carries Name, Description, Sector, Nationality and Type.

Tags are created from a name, and the node can give the new tag its color in the same call.

• Name: required, the tag name.
• Color: a hex color code for the tag, inside Additional Fields.

When a tag stops being used, this operation removes it from the instance by number.

• Tag ID: required, the numeric ID of the tag to delete, often taken from an earlier node with an expression such as {{ $json.field }}.

Every tag defined on the instance comes back through this operation, the list most other tag work starts from.

• Return All: on, the node pages through the API until the tag list is complete; off, Limit sets the cutoff.
• Limit: the maximum number of tags in the output.

Renaming a tag or changing its color runs through this operation, with the tag named by its ID.

• Tag ID: required, the ID of the tag to update.
• Update Fields: carries Name and Color, the hex color code of the tag.

Onboarding an account takes two values, an address and a role, and the node creates the user from them.

• Email: required, the address of the account, in the name@email.com form the field shows.
• Role ID: required, and role IDs are available in the MISP dashboard at /roles/index.
• Organization Name or ID: chosen from the list the node loads, or given as an ID through an expression.

Offboarding ends here: the node removes the user whose number it is given, and the workflow moves on to whatever comes next.

• User ID: required, the numeric ID of the user to delete. A run that leaves it empty stops there, since an empty required field blocks the node.

One user record, fetched by number, lands in the output of this operation. It reads a single account, so it pairs well with a loop when several have to be checked.

• User ID: required, the numeric ID of the user to read, usually mapped from the item the previous node produced with an expression such as {{ $json.field }}.

This operation walks the user directory of the instance and returns the accounts it finds.

• Return All: on, every page of users is fetched; off, Limit caps the number of accounts returned.
• Limit: how many users at most come back in one run.

Changes to an existing account travel through Update Fields, with the account named by its ID.

• User ID: required, the ID of the user to update.
• Update Fields: carries Email, GPG Key, Inviter Name or ID and Organization Name or ID.

Warninglists are read one at a time here, by number, which keeps the payload down when only one of them matters to the run.

• Warninglist ID: required, the numeric ID of the warninglist. When the number comes from an earlier step rather than being typed in, an expression like {{ $json.field }} carries it over.

The catalog of warninglists the instance carries comes back in one run.

• Return All: on, n8n requests page after page until the catalog is complete; off, Limit trims the output.
• Limit: the maximum number of warninglists returned.