Skip to content
One platform. From customer conversation to completed work.Take a closer look
All connections
Monitoring ยท CONNECTION

MISP + NodeHub

Manage MISP events, attributes, tags, feeds, organisations and users, and read galaxies, noticelists, warninglists and objects.

Explore 44 workflow actions for MISP, including account permissions and operation limits.

20 read actions24 write actions
WORKFLOW ACTIONS

What you can configure.

Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.

Add tag to event

Write

Tag an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create attribute

Write

Add an attribute to an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create event

Write

Create an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create feed

Write

Add a feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create organisation

Write

Create an organisation (site admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create tag

Write

Create a tag.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create user

Write

Create a user (admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Operation limits

  • MISP takes no idempotency key, so a lost create answer stays uncertain and is never resent automatically.

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete attribute

Write

Delete an attribute.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete event

Write

Delete an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete galaxy

Write

Delete a galaxy.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete organisation

Write

Delete an organisation (site admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete tag

Write

Delete a tag.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete user

Write

Delete a user (admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Disable feed

Write

Disable a feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Enable feed

Write

Enable a feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Get attribute

Read

Read one attribute.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get event

Read

Read one event with its attributes and objects.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get feed

Read

Read one feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get galaxy

Read

Read one galaxy with its clusters.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get noticelist

Read

Read one noticelist.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get organisation

Read

Read one organisation.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get user

Read

Read one user (admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Get warninglist

Read

Read one warninglist with its entries.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List attributes

Read

Read the attributes the key can see.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List events

Read

Read the events the key can see.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List feeds

Read

Read every feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List galaxies

Read

Read every galaxy.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List noticelists

Read

Read every noticelist.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List organisations

Read

Read the organisations the key can see.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List tags

Read

Read every tag.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List users

Read

Read every user (admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

List warninglists

Read

Read every warninglist.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Publish event

Write

Publish an event and send its alerts.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Remove tag from event

Write

Remove a tag from an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Search attributes

Read

Search attributes with restSearch filters.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Search events

Read

Search events with restSearch filters.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Search objects

Read

Search objects with restSearch filters.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

Unpublish event

Write

Unpublish an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update attribute

Write

Change an attribute.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update event

Write

Change an event.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update feed

Write

Change a feed.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update organisation

Write

Change an organisation (site admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update tag

Write

Change a tag.

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update user

Write

Change a user (admin).

Permissions and limits

Account permissions

  • A MISP API key whose role allows the action

A repeated request may repeat the external action. Review the previous result before retrying a write.

SETUP

Start with a controlled test.

01Connect the intended account

Use the account and permissions required for your process. Review the connection check before configuring a workflow action.

02Review inputs and access

Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.

03Confirm the result

Inspect step outputs and confirm the result in MISP. A saved workflow is not a completed provider action.

Follow the workflow quickstart
EXPLORE YOUR STACK

More in Monitoring.

AirbrakeCronlyDatadogDynatrace
MISP integration | NodeHub