MISP API

misp-cli feed pull; misp-cli event search

Manage the MISP threat intel platform with the CLI: update feeds and search community events and IOCs.

Run it when you want MISP management from the command line: misp-cli feed pull updates feeds (community sources, vendors) and misp-cli event search searches events and IOCs — campaign indicators with context. It's the reference threat intel platform (from MISP Project): IOC sharing between organizations. In the SOC and threat intel, MISP is the central platform: updated feeds and IOC searches (group events) feed detections and cases.

Don't use it without the platform: misp-cli requires the MISP server (instance) and API credentials — the infrastructure is the requirement. And watch out: feeds and events require curation — IOCs from public feeds have noise and false positives; correlation with context and prioritization are part of the flow. The MISP API (endpoints) is managed with the token. For event analysis, use the MISP interface; the CLI is for programmatic operations (SOC automations).