STEP 1
Select MISP in workflow
Pick MISP app in the workflow builder [4] - just one click to select the app.
MISP Integration
Share and enrich threat intelligence events, attributes, and indicators with MISP. Connect MISP events to the tools your engineering teams already use. Start with Watch Events, then follow with Check If a List of Values Matches Any Warninglists or Enable/disable Noticelist to automate the next step.
3-day trialCancel anytimeUp to 10 minutes quick set up
- GDPR
- Data Encryption
- 2FA
- Local Data Region
Supported triggers and actions for MISP integration
Triggers can detect changes in MISP and run actions that can create, search or modify data inside MISP automatically [3] — exactly how you set them.
- Watch EventsTriggers when events are detected.
- Check If a List of Values Matches Any WarninglistsRetrieves check if a list of values matches any warninglists.
- Enable/disable NoticelistRetrieves enable/disable noticelist.
- Enable/disable WarninglistsRetrieves enable/disable warninglists.
- Export Taxonomy.Retrieves export taxonomy..
- Fetch from All FeedsFetches from All Feeds.
- Fetch from Feed by IDFetches from Feed by ID.
- Get a Feed by IDReturns a feed by id.
- Get a Filtered and Paginated List of AttributesReturns a filtered and paginated list of attributes.
- Get a Filtered and Paginated List of EventsReturns a filtered and paginated list of events.
- Get a Filtered and Paginated List of ObjectsReturns a filtered and paginated list of objects.
- Get a List of AttributesReturns a list of attributes.
- Get a List of Collections with Optional FilteringReturns a list of collections with optional filtering.
- Get a List of EventsReturns a list of events.
- Get a List of FeedsReturns a list of feeds.
- Get a List of NoticelistsReturns a list of noticelists.
- Get a List of Sharing GroupsReturns a list of sharing groups.
- Get a List of the Available Attribute TypesReturns a list of the available attribute types.
- Get a List of WarninglistsReturns a list of warninglists.
- Get a Noticelist by IDReturns a noticelist by id.
How to integrate MISP in automation workflow?
3 simple steps to make your MISP connected with other apps in automation workflows on WEXTL. Up to 10 minutes integration set up.
STEP 2
Connect MISP
When prompted, authorize access to MISP in WEXTL once. MISP credentials are encrypted and never shared with WEXTL. Authorization will be reused in any future API calls [3].
WEXTL wants to integrate with your MISP account. Approve?
STEP 3
Build a workflow
Build your workflow with MISP yourself or with WEXTL® AI Builder. Connect MISP to any available integrations [5], or use HTTP node to go beyond them.
MISP
How MISP connects and integrates with WEXTL
Save and approve your credentials once — WEXTL® stores authorization information encrypted and reuses the authentication whenever MISP app is called in workflows. That allows your developer tools automations to run without your attention, per defined schedule [7]. Explore documentation [6] for a detailed list of fields that MISP supports.
The following table illustrates what fields MISP integration require during authorization flow inside our workflow builder [4].
Connect MISP
API Key*Text
••••••••
Base URL*Text
••••••••
Demonstration of MISP connection step inside WEXTL Workflow Builder [4].
| Field | Type | Help |
|---|---|---|
API KeyRequired | password | — |
Base URLRequired | text | Instance origin with no trailing slash and no path, e.g. https://misp.example.com. |
Connect MISP to popular apps on WEXTL
Enter a name of the other app you want to sync with MISP below. Click on selected app to explore integration options with MISP. If the app you search for is not available in WEXTL yet, you can use HTTP node [10] instead to integrate it directly.
Example automation with MISP integration
Select Watch Events trigger from MISP - this will be a starting point in your automation. Whenever event happens in MISP, workflow will start [7] from Watch Events node.
Search for Add an Object to an Event, connect it as the next step of integration sequence. You can use filters between Watch Events and Add an Object to an Event, so only important data pass from Watch Events to the next step. WEXTL gives you full control over the process of MISP automation. All parts of workflow are visible on the canvas [4].
MISP on WEXTL has 139 modules for creating developer tools automations. Explore MISP documentation for more.
MISP
Watch Events
AWS Cognito
Performs action
OR
AWS Cognito
Triggers
MISP
Add an Object to an Event
Demonstration of how visual MISP automation [6] looks in WEXTL.
Frequently asked questions
Common questions about automating MISP in your workflows.
MISP has 1 trigger, including "Watch Events". Triggers are start points of the workflow, and automations may start from them.
Integration has 138 actions, including "Check If a List of Values Matches Any Warninglists", "Enable/disable Noticelist", and "Enable/disable Warninglists", and more. Refer to our MISP Documentation for detailed inputs and outputs.
No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but our customers do that in rare cases [4].
Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.
The MISP integration on WEXTL runs directly on its vendor public API — every field name, authentication method, and rate limit is controlled by MISP official API and covered in documentation [3]. WEXTL handles the request signing and pagination for you.
Absolutely. Where MISP provides native webhooks, you can use instant triggers to eliminate polling delay. For custom webhooks, WEXTL offers Custom Webhook node, so you can start automation whenever MISP or any other service sends event to webhook URL.
WEXTL is an AI-first visual canvas. The platform allows you to describe automation in plain text — and AI will wire nodes for MISP inside the workflow builder [4]. You can also use built-in workflow nodes (AI Agent, Human in the Loop, Condition, Aggregate Results) in pair with MISP modules to craft complex integration flows with branches, filtering, and conditional logic. There are absolutely no limits of what you can build.
References
List of sources used to gather information about the MISP integration.
- MISP integration source code, module specs and credentials implementation.
- Internal MISP integration documentation, structured input and output parameters, scopes, and authentication methods.
- Official MISP vendor API documentation — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
- WEXTL® Visual Workflow Builder, anonymized data from our technical support team.
- WEXTL® Apps Library
- WEXTL® MISP App Documentation
- WEXTL® Workflow Scheduler
- WEXTL® HTTP node documentation