MISP Threat Intelligence ExecModule

Overview

MispModule connects ValkyrAI workflows to a MISP threat-intelligence platform through the native map I/O ExecModule ABI. It implements the highest-value event, attribute, search, publication, and event-tag actions from n8n's MISP node while enforcing ValkyrAI's IntegrationAccount, validation, retry, redaction, and metadata contracts.

The module provides 14 operations. Read-only event/attribute retrieval and restSearch calls retry bounded transient failures. Creates, updates, publication changes, tag changes, and deletes are single-attempt because a lost response can leave provider state ambiguous. Event publication and unpublication require an explicit acknowledgement. Irreversible attribute deletion requires a separate destructive acknowledgement.

Usage

1. Operate a supported MISP 2.4 or 2.5 instance behind trusted public HTTPS.
2. Create a dedicated MISP automation user with only the roles and organization access required by the workflow.
3. Generate an automation key from MISP's Automation surface.
4. Store the key in encrypted IntegrationAccount.apiKey and the public MISP origin in IntegrationAccount.accountId.
5. Set the account to READY and bind it through ExecModuleConfig.authConfig.integrationAccount.
6. Choose one documented operation and provide only its typed identifiers, allowlisted record, search filters, and bounds.
7. Require human or policy approval before publication changes or irreversible deletion.

Workflow input cannot supply the automation key, authorization header, arbitrary path or method, TLS verification bypass, private-network target, or unbounded provider body.

Inputs

Name	Type	Requirement	Default	Description and constraints
operation	string	Required	None	One of the 14 documented operations.
baseUrl	string	Required unless the account supplies it	IntegrationAccount.accountId	Public HTTPS MISP origin, optionally with a bounded path. Credentials, custom ports, query strings, fragments, localhost, IP literals, and untrusted TLS are rejected.
resourceId	string	Get/update/publish/delete	None	Numeric MISP ID or UUID with a path-safe bounded format.
eventId	string	Attribute create and event-tag operations	None	Numeric event ID or UUID.
tagId	string	Event-tag operations	None	Positive numeric tag ID.
record	object	Create/update	None	Non-empty event/attribute allowlist; at most 32 properties and 512 KiB. Credential-like fields are rejected.
filters	object	Search; optional for list_events	{}	Up to 32 allowlisted restSearch fields with bounded scalar or scalar-array values.
page	integer	Search	1	First provider page, 1–100,000.
limit	integer	Search	100	Maximum aggregate result count, 1–10,000. Provider requests use pages of at most 100.
returnAll	boolean	Search	false	Follow provider pages until exhaustion or the aggregate result cap.
confirmPublication	boolean	Publish/unpublish	false	Must be true for either publication-state operation.
confirmDestructive	boolean	Attribute delete	false	Must be true for irreversible deletion.
timeoutMs	integer	Optional	30000	Total/connect/read/write timeout, 100–300,000 ms.

Event records allow info, date, threat level, analysis state, distribution, sharing group, publication state, correlation control, and extension UUID. Attribute records allow type, category, value, IDS eligibility, distribution, sharing group, comment, correlation control, and first/last-seen timestamps. Distribution 4 requires a positive sharing-group ID.

Search filters cover common MISP event and attribute selectors such as value, type, category, organization, tags, event ID/info, time windows, publication state, distribution, and context flags. The module fixes returnFormat to JSON and owns page/limit values.

Outputs

Name	Type	When present	Description
status	string	Always	success or error.
operation	string	Always	Normalized operation name.
resource	string	Valid operation	event, attribute, or event_tag.
data / id	object / string	Single-resource success	Normalized provider result and verified identifier when present.
items / count	array / integer	Search success	Unwrapped bounded MISP resources and emitted count.
hasMore / nextPage	boolean / integer	Search success	Whether another provider page may exist and its page number.
httpStatus	integer	Single-resource success	MISP HTTP status.
attempts	integer	Always	Total provider attempts, including search pages.
error	object	Failure	Safe {code, message, retryable} details.

Automation keys, authorization values, and credential-bearing provider text are redacted from errors and outputs.

IntegrationAccount Requirements

Setting	Requirement
Provider	MISP REST API
accountName	Human-readable threat-intelligence automation identity
accountId	Public HTTPS MISP origin, for example https://misp.example.com
apiKey	Encrypted dedicated MISP automation key; password is accepted only as a legacy secure-field fallback
status	READY; every other status fails closed
Permissions	Minimum event/attribute read, write, publish, and tag permissions required by selected operations

Use a dedicated non-admin automation user when possible. MISP distribution and sharing-group controls govern which organizations may receive an event or attribute; do not use a broadly privileged key to compensate for a poorly scoped workflow.

Configuration

{
  "version": "1.0.0",
  "authConfig": {
    "authStrategy": 1,
    "integrationAccount": "integration-account:misp-threat-intel"
  },
  "retryPolicy": {
    "maxAttempts": 3,
    "backoffStrategy": "EXPONENTIAL",
    "initialDelayMs": 1000,
    "maxDelayMs": 5000,
    "jitter": false
  },
  "executionConfig": {"timeoutMs": 30000},
  "payloadConfig": {
    "parameters": "{\"operation\":\"search_attributes\",\"limit\":100,\"filters\":{\"tags\":[\"tlp:amber\"],\"last\":\"24h\"}}"
  }
}

The integration-account reference is symbolic. Persisted workflows use the generated relationship, never embedded credentials.

Operations

Operation	MISP behavior	Side effect
create_event	Creates an event from bounded intelligence, analysis, and distribution fields.	Event write; single attempt.
get_event	Reads one event by numeric ID or UUID and unwraps Event.	Read-only; safe retries.
list_events	Uses JSON events/restSearch with owned page/limit controls and no required filter.	Read-only; paginated safe retries.
search_events	Searches events by allowlisted value, tag, organization, time, publication, and distribution selectors.	Read-only; paginated safe retries.
update_event	Updates allowlisted event fields and verifies the returned ID or UUID.	Event write; single attempt.
publish_event	Publishes an event after explicit acknowledgement.	Outbound publication; single attempt.
unpublish_event	Removes an event's published state after explicit acknowledgement.	Publication-state write; single attempt.
add_attribute	Adds a bounded attribute/indicator to an event.	Indicator write; single attempt.
get_attribute	Reads one attribute by numeric ID or UUID and unwraps Attribute.	Read-only; safe retries.
search_attributes	Searches attributes by value, type, category, tags, event, time, IDS, and distribution selectors.	Read-only; paginated safe retries.
update_attribute	Updates allowlisted attribute fields and verifies the returned ID or UUID.	Indicator write; single attempt.
delete_attribute	Irreversibly deletes one attribute after explicit destructive acknowledgement.	Destructive write; single attempt.
add_event_tag	Adds one existing numeric tag ID to an event.	Classification write; single attempt.
remove_event_tag	Removes one existing numeric tag ID from an event.	Reversible classification write; single attempt.

Errors and Failure Modes

Code	Typical cause	Retryable	Resolution
VALIDATION_ERROR	Invalid origin, account, ID, payload, distribution, filter, bound, or acknowledgement.	No	Correct the named field; validation failures send no request.
UNSUPPORTED_OPERATION	Unknown operation.	No	Select a documented operation.
INTEGRATION_ACCOUNT_REQUIRED	No bound account.	No	Bind a MISP IntegrationAccount.
INTEGRATION_ACCOUNT_NOT_READY	Account is not READY.	No	Repair or reconnect the account.
MISP_HTTP_400 / 403	Malformed input, revoked key, insufficient MISP role, or distribution constraint.	No	Correct the payload or least-privilege account permissions. MISP may report malformed requests as 403.
MISP_HTTP_404	Resource or route is absent.	No	Verify the ID/UUID and supported MISP version.
MISP_HTTP_429 / 5xx	Rate limit or transient service failure.	Yes for reads	Honor Retry-After; reconcile writes before repeating them.
NETWORK_ERROR	DNS, TLS, timeout, or connectivity failure.	Yes for reads	Verify MISP connectivity; never blindly retry an ambiguous mutation.
RESPONSE_TOO_LARGE	One response exceeded 5 MiB.	No	Narrow filters or reduce result bounds.
RESOURCE_ID_MISMATCH	A get/update response returned another ID/UUID.	No	Stop and reconcile proxy/plugin behavior before retrying.

Example

Find recent IP indicators carrying an approved traffic-light marking:

{
  "operation": "search_attributes",
  "baseUrl": "https://misp.example.com",
  "filters": {
    "type": ["ip-src", "ip-dst"],
    "tags": ["tlp:amber"],
    "last": "24h",
    "to_ids": true
  },
  "limit": 100,
  "returnAll": true
}

Expected result:

{
  "status": "success",
  "operation": "search_attributes",
  "resource": "attribute",
  "count": 2,
  "hasMore": false,
  "attempts": 1,
  "items": [
    {"id": "781", "type": "ip-dst", "value": "203.0.113.8", "to_ids": true},
    {"id": "782", "type": "ip-src", "value": "198.51.100.17", "to_ids": true}
  ]
}

Notes

• Pagination: event and attribute searches call MISP's JSON restSearch, set page and limit internally, use pages of at most 100, stop after one page unless returnAll is enabled, and cap aggregate results at 10,000.
• Rate limits: GET and restSearch operations retry HTTP 408, 429, 500, 502, 503, and 504 up to three attempts with bounded backoff and integer Retry-After. Mutations never retry automatically.
• API limits: responses are capped at 5 MiB, records and filters at 512 KiB and 32 fields, arrays at 100 values, and aggregate results at 10,000. Hosts, paths, identifiers, dates, distribution values, and sensitive field names are validated before dispatch.
• Idempotency: get/list/search operations are safe reads. Create, update, publication, tagging, and delete operations are not assumed idempotent; a timeout is ambiguous and requires provider reconciliation. Correlate through returned MISP IDs/UUIDs and an approved event-info convention.
• Destructive behavior: delete_attribute is irreversible and requires confirmDestructive: true. Event deletion, organization/user deletion, feed deletion, and galaxy deletion are intentionally unavailable.
• Publication: MISP publication can distribute intelligence to connected organizations and feeds according to event distribution. Both publish and unpublish require confirmPublication: true; policy or human review should precede either action.
• Privacy: events and attributes can contain restricted indicators, internal incident details, organization identities, or personal data. Respect MISP distribution, sharing groups, traffic-light markings, downstream ACLs, retention, and logging policy.
• TLS and routing: production requests use a validated public HTTPS origin and trusted certificates. HTTP downgrade, embedded credentials, custom ports, localhost, IP literals, arbitrary endpoints, and n8n's optional unauthorized-certificate mode are rejected.
• External verification: request construction, automation-key authentication, pagination, validation, retry safety, response mapping, identity checks, redaction, and metadata discovery are deterministic local tests. Live MISP roles, organizations, taxonomies, galaxies, warning lists, sharing groups, feeds, plugins, and provider data require separately authorized credentials and are not exercised in repository tests.
• Deferred operations: event deletion, attribute bulk actions, sightings, objects, feeds, galaxies, taxonomies, organizations, users, warning/noticelists, proposals, file/sample uploads, STIX import/export, synchronization, webhooks/triggers, and arbitrary raw requests.
• Functional references: n8n MISP node, n8n MISP source, MISP project, and PyMISP REST client.