MISP

Details
Content
Dependencies
Version History

Download With Dependencies

Malware information and threat sharing platform.

Pack Contributors:

Martin Ohl
nikstuckenbrock
Charon De Beukelaer

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Pack Contributors:

Martin Ohl
nikstuckenbrock
Charon De Beukelaer

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
misp_download_sample	Deprecated. No available replacement. Download malicious file sample from MISP.
misp_upload_sample	Deprecated. No available replacement. Upload malicious file sample to MISP.

Integrations

Name	Description
MISP v2 (Deprecated)	Deprecated. Use the MISP v3 integration instead.
MISP v3	Malware information sharing platform and threat sharing.

Integrations

Name	Description
MISP v2 (Deprecated)	Deprecated. Use the MISP v3 integration instead.
MISP v3	Malware information sharing platform and threat sharing.

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

2.2.0 - 4881695 (September 14, 2025)

Integrations

MISP v3

Added support for misp-get-warninglists command that gets all warninglists from MISP.
Added support for misp-get-warninglist command that get a specific warninglist by it's ID.
Added support for misp-change-warninglist command that changes a warninglist in MISP.
Added support for source argument in the misp-add-sighting command.
Added support for value argument in the misp-add-sighting command.
Updated the Docker image to: demisto/pymisp2:2.5.10.3725488.

Related pull requests:
- 41266
- 41270

Download

2.1.54 - R3980324 (June 26, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.10.3545364.

Related pull requests:
- 40141

Download

2.1.53 - 3769759 (June 12, 2025)

Integrations

MISP v3

Fixed an issue where the misp-add-tag-to-attribute, misp-add-tag-to-event* commands did not return an error on a failed attempt to add tags.

Related pull requests:
- 40241

Download

2.1.52 - 3398781 (May 13, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.10.3055654.

Related pull requests:
- 39848

Download

2.1.51 - R3318350 (May 6, 2025)

Integrations

MISP v3

Metadata and documentation improvements.

Related pull requests:
- 38986

Download

2.1.50 - R2040490 (January 22, 2025)

Integrations

MISP v3

Fixed an issue where an indicator with a tag defined in the Malicious tag IDs parameter returned a score of unknown instead of malicious.

Related pull requests:
- 38106

Download

2.1.49 - 1950870 (January 8, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.4.1858064.

Related pull requests:
- 37992

Download

2.1.48 - R1741355 (December 3, 2024)

Integrations

MISP v3

Fixed an issue with temporary file cleanup when using certificates.
Updated the Docker image to: demisto/pymisp2:2.5.2.117270.

Related pull requests:
- 37410

Download

2.1.47 - 1590379 (November 4, 2024)

Integrations

MISP v3

Added the Search warninglists parameter in order to search in the warninglists for an attribute.

Related pull requests:
- 36668
- 37055

Download

2.1.46 - 1438938 (September 26, 2024)

Integrations

MISP v3

Add parameter to define tags recognized as benign.

Related pull requests:
- 36399
- 36514

Download

2.2.0 - 4881695 (September 14, 2025)

Integrations

MISP v3

Added support for misp-get-warninglists command that gets all warninglists from MISP.
Added support for misp-get-warninglist command that get a specific warninglist by it's ID.
Added support for misp-change-warninglist command that changes a warninglist in MISP.
Added support for source argument in the misp-add-sighting command.
Added support for value argument in the misp-add-sighting command.
Updated the Docker image to: demisto/pymisp2:2.5.10.3725488.

Related pull requests:
- 41266
- 41270

Download

2.1.54 - R3980324 (June 26, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.10.3545364.

Related pull requests:
- 40141

Download

2.1.53 - 3769759 (June 12, 2025)

Integrations

MISP v3

Fixed an issue where the misp-add-tag-to-attribute, misp-add-tag-to-event* commands did not return an error on a failed attempt to add tags.

Related pull requests:
- 40241

Download

2.1.52 - 3398781 (May 13, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.10.3055654.

Related pull requests:
- 39848

Download

2.1.51 - R3324525 (May 6, 2025)

Integrations

MISP v3

Metadata and documentation improvements.

Related pull requests:
- 38986

Download

2.1.50 - R2040490 (January 22, 2025)

Integrations

MISP v3

Fixed an issue where an indicator with a tag defined in the Malicious tag IDs parameter returned a score of unknown instead of malicious.

Related pull requests:
- 38106

Download

2.1.49 - 1950870 (January 8, 2025)

Integrations

MISP v3

Updated the Docker image to: demisto/pymisp2:2.5.4.1858064.

Related pull requests:
- 37992

Download

2.1.48 - R1741355 (December 3, 2024)

Integrations

MISP v3

Fixed an issue with temporary file cleanup when using certificates.
Updated the Docker image to: demisto/pymisp2:2.5.2.117270.

Related pull requests:
- 37410

Download

2.1.47 - 1590379 (November 4, 2024)

Integrations

MISP v3

Added the Search warninglists parameter in order to search in the warninglists for an attribute.

Related pull requests:
- 36668
- 37055

Download

2.1.46 - 1441232 (September 27, 2024)

Integrations

MISP v3

Add parameter to define tags recognized as benign.

Related pull requests:
- 36399
- 36514

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 19, 2020
Last Release	September 14, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.