MISP Feed

Details
Content
Dependencies
Version History

Download With Dependencies

Indicators feed from MISP

What does this content pack do?

MISP Feed fetches attributes from MISP and creates indicators from them.

Authentication

MISP Feed uses an API key.

What does this content pack do?

MISP Feed fetches attributes from MISP and creates indicators from them.

Authentication

MISP Feed uses an API key.

Name	Description
MISP Feed	Indicators feed from MISP.

Name	Description
MISP Feed	Indicators feed from MISP.

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (2)

Pack Name	Pack By
Aggregated Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.1.2 - 9302376 (May 25, 2026)

Integrations

Tags applied at the event level (such as TLP) are now retrieved alongside attribute-level tags. Inherited event tags now appear in the indicator's Tags field and are surfaced to the indicator mapper.
Updated the Docker image to: demisto/python3:3.12.13.9059085.

Related pull requests:
- 44405

Download

1.1.1 - 8121169 (April 6, 2026)

Integrations

MISP Feed

Fixed an issue where the Test button would fail due to a missing field in the body of the HTTP request used to validate the configuration.

Related pull requests:
- 43772

Download

1.1.0 - 7656273 (March 13, 2026)

Integrations

MISP Feed

Added support for the Client Certificate and Private Key configuration parameters to enable connections to MISP servers that require client certificates.

Related pull requests:
- 43277

Download

1.0.46 - 7645318 (March 12, 2026)

Integrations

MISP Feed

Fixed an issue where fetch-indicators command was not functioning as expected with the Max. indicators per fetch argument.
Updated the Docker image to: demisto/python3:3.12.13.7444307.

Related pull requests:
- 43434

Download

1.0.45 - 5827772 (November 11, 2025)

Integrations

MISP Feed

Fixed an issue where fetch-indicators fetched the same indicators.
Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41806

Download

1.0.44 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.0.43 - 4096037 (July 8, 2025)

Integrations

MISP Feed

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40498

Download

1.1.2 - 9302376 (May 25, 2026)

Integrations

MISP Feed

Tags applied at the event level (such as TLP) are now retrieved alongside attribute-level tags. Inherited event tags now appear in the indicator's Tags field and are surfaced to the indicator mapper.
Updated the Docker image to: demisto/python3:3.12.13.9059085.

Related pull requests:
- 44405

Download

1.1.1 - 8121169 (April 6, 2026)

Integrations

MISP Feed

Fixed an issue where the Test button would fail due to a missing field in the body of the HTTP request used to validate the configuration.

Related pull requests:
- 43772

Download

1.1.0 - 7656273 (March 13, 2026)

Integrations

MISP Feed

Added support for the Client Certificate and Private Key configuration parameters to enable connections to MISP servers that require client certificates.

Related pull requests:
- 43277

Download

1.0.46 - 7645318 (March 12, 2026)

Integrations

MISP Feed

Fixed an issue where fetch-indicators command was not functioning as expected with the Max. indicators per fetch argument.
Updated the Docker image to: demisto/python3:3.12.13.7444307.

Related pull requests:
- 43434

Download

1.0.45 - 5827772 (November 11, 2025)

Integrations

MISP Feed

Fixed an issue where fetch-indicators fetched the same indicators.
Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41806

Download

1.0.44 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.0.43 - 4096037 (July 8, 2025)

Integrations

MISP Feed

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40498

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	October 21, 2021
Last Release	May 25, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.