Requirements
Connecting MISP takes an active account plus an API access token from your account settings — no other setup is required.[3]
Get your MISP credentials
- API KeypasswordRequired
- Base URLtextRequired
Instance origin with no trailing slash and no path, e.g. https://misp.example.com.
[1]
Connect MISP in WEXTL
- Log in to your WEXTL account, add the MISP node module to your workflow, and click Create new credential.
- Optional: In the Credential name field, enter a name for the credential.
- Enter the authentication credentials you copied from your MISP account, or follow the on-screen instructions to create the credential.
- If prompted, authenticate your account and confirm access.
- If you want to make changes to your credential in the future, follow the steps in Manage credentials →
Notes
Credentials are org-scoped; share them with teammates from the Credentials picker on any of its nodes.For detailed information on connecting an application, see Connect an application →
MISP node modules
The list below is a reference of every MISP node module the integration supports. You will be able to pick any of them on the workflow canvas while building automations.
Expand any MISP node module below to see exactly what it takes in, what it returns, and what connection it needs.
Watch EventsTrigger
Output fields[3]
| Field | Type |
|---|---|
| ID | number |
| Name | text |
| Created at | text |
Check If a List of Values Matches Any WarninglistsSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Enable/disable NoticelistSearch
Enable/disable WarninglistsSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Export Taxonomy.Search
Fetch from All FeedsAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Fetch from Feed by IDAction
Get a Feed by IDSearch
Get a Filtered and Paginated List of AttributesSearch
Get a Filtered and Paginated List of EventsSearch
Get a Filtered and Paginated List of ObjectsSearch
Get a List of AttributesSearch
Get a List of Collections with Optional FilteringSearch
Get a List of EventsSearch
Get a List of FeedsSearch
Get a List of NoticelistsSearch
Get a List of Sharing GroupsSearch
Get a List of the Available Attribute TypesSearch
Get a List of WarninglistsSearch
Get a Noticelist by IDSearch
Get a Sharing Group by IDSearch
Get a Taxonomy by IDSearch
Get a Taxonomy Extended with Tags Used in Events and Attributes.Search
Get an Attribute by IDSearch
Get Analyst Data by IDSearch
Get Current Instance Py MISP VersionSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Get Current Instance Settings and DiagnosticsSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Get Current Instance VersionSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Get Event by IDSearch
Get Event Report by IDSearch
Get Event ReportsSearch
Get GalaxiesSearch
Get Galaxy by IDSearch
Get Galaxy Cluster by IDSearch
Get Galaxy ClustersSearch
Get Instance UUIDSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Get Object by IDSearch
Get Organisation by IDSearch
Get OrganisationsSearch
Get Server Setting by NameSearch
Get Sightings by Event IDSearch
Get Tag by IDSearch
Get TaxonomiesSearch
Get the Count of Attributes per CategorySearch
Get User by IDSearch
Get User Setting by IDSearch
Get User Setting by NameSearch
Get User SettingsSearch
Get Warninglist by IDSearch
Get WorkersSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
List Analyst DataSearch
List Minimal Analyst DataSearch
Pull ServerSearch
Push ServerSearch
Search EventsSearch
Search GalaxiesSearch
Search Galaxy ClustersSearch
Search TagSearch
Search User SettingsSearch
Search WarninglistsSearch
Update NoticelistsSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Update WarninglistsSearch
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
View a Collection by IDSearch
Add a CollectionAction
Add a FeedAction
Add a Server to a Sharing GroupAction
Add a Sharing GroupAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Add an AttributeAction
Add an Object to an EventAction
Add an Organisation to a Sharing GroupAction
Add Analyst DataAction
Add EventAction
Add Event ReportAction
Add Event TagAction
Add Galaxy ClusterAction
Add OrganisationAction
Add ServerAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Add Sighting of an AttributeAction
Add Sightings of a List of ValuesAction
Add TagAction
Add Tag(s) to Attribute(s)Action
Add UserAction
Attach the Galaxy Cluster Tag a Given EntityAction
Cache FeedsAction
Delete a CollectionAction
Delete a GalaxyAction
Delete a Server from a Sharing GroupAction
Delete a Sharing GroupAction
Delete a Tag from an AttributeAction
Delete an AttributeAction
Delete an Organisation from a Sharing GroupAction
Delete Analyst DataAction
Delete EventAction
Delete Event ReportAction
Delete Event Report PermanentlyAction
Delete Event TagAction
Delete Galaxy ClusterAction
Delete ObjectAction
Delete OrganisationAction
Delete ServerAction
Delete SightingAction
Delete TagAction
Delete UserAction
Delete User Setting by IdAction
Disable FeedAction
Disable TaxonomyAction
Edit a CollectionAction
Edit a FeedAction
Edit a Sharing GroupAction
Edit an AttributeAction
Edit Analyst DataAction
Edit EventAction
Edit Event ReportAction
Edit Galaxy ClusterAction
Edit OrganisationAction
Edit ServerAction
Edit TagAction
Edit UserAction
Enable FeedAction
Enable TaxonomyAction
Enrich an Attribute with the Given ModulesAction
Enrich an Event with the Given ModulesAction
Export Galaxy ClustersAction
Import a Galaxy ClusterAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Import Report From URLAction
Make an API Calluniversal
Publish EventAction
Publish Galaxy ClusterAction
Restore AttributeAction
Restore Event ReportAction
Restore Galaxy ClusterAction
Set User SettingAction
Sync Galaxies From DefinitionsAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Unpublish EventAction
Unpublish Galaxy ClusterAction
Update TaxonomiesAction
Output fields[3]
| Field | Type |
|---|---|
| ID | text |
| Name | text |
| Created at | text |
Templates
Look for MISP templates in the WEXTL template library.
Browse templates →Explore alternative apps
- AWS Cognito[2]Amazon Cognito User Pools — manage users, groups, app clients, and identity providers with SigV4.
- Bunny.netCDN control plane — manage pull zones, storage zones, DNS, video libraries, and cache purge.
- AWS LambdaServerless compute that runs your code without managing servers.
- ClerkAuthentication and user management with sign-in, sign-up, and MFA.
- Azure StorageManage containers and blobs in Azure Blob Storage.
References
- WEXTL® MISP Source Code connector implementation.
- Our users use cases and automations.
- Official API Documentation for MISP.
- WEXTL® visual workflow builder data.
Last updated: Sep 3, 2026 08:05