{"id":"127ada1f-309f-4f83-b6d7-dc48c2d708a5","task":"Pull events and attributes from a MISP instance to build blocklists","domain":"misp-project.org","steps":["Authenticate to your MISP instance by including your API key in the Authorization: YOUR_API_KEY header on all requests; obtain the key from Event Actions > Automation in the MISP UI.","Search for relevant events with POST https://{misp-host}/events/restSearch, supplying a JSON body with filters such as tags (e.g., tlp:white), type_attribute (e.g., ip-dst, domain, url), to_ids: true, and a limit parameter.","Extract attribute values from the returned events; each event contains an Attribute array with fields value, type, to_ids, and category — filter to to_ids: true for actionable indicators.","Alternatively, query attributes directly with POST /attributes/restSearch using the same filter parameters to receive a flat list of attributes without full event context, which is faster for large datasets.","Deduplicate and format extracted values into your blocklist format (firewall ACL, DNS RPZ zone, proxy blocklist); record the MISP event UUID and attribute UUID as provenance for each blocked indicator."],"gotchas":["MISP's restSearch pagination is controlled by a page parameter and a limit; omitting limit on large instances can trigger very slow queries or timeouts — always set a reasonable limit and paginate.","The to_ids flag is the MISP community convention for 'safe to use in automated blocking'; indicators with to_ids: false are informational only and should not be automatically blocked without analyst review.","MISP API responses default to XML in older versions; send Accept: application/json and Content-Type: application/json headers to ensure JSON responses."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/127ada1f-309f-4f83-b6d7-dc48c2d708a5"}