These instructions are for logging in to the PrecisionSec MISP server, creating an API key, and using it to download threat intelligence indicators programmatically with the MISP REST API.

Credentials required. Your login is the read-only account emailed to you for https://misp.precisionsec.com. If you have not yet received evaluation credentials, please request access.

Looking to pull the feed into your own MISP instance instead? See the MISP Feed Integration Guide.

Generate an API key

  1. Browse to https://misp.precisionsec.com and log in with the username and password you were emailed. On first login you are prompted to set your own password.

  2. From the top menu, go to Global Actions → My Profile.

  3. Open the Auth keys page from the profile’s left-hand menu.

  4. Click Add authentication key.

  5. In the Comment field, enter a note describing where the key will be used, such as SIEM export.

  6. Optionally, restrict the key:

    • Allowed IPs: limit use of the key to specific source addresses.
    • Expiration: set a date after which the key stops working.

  7. Click Submit. The new key is displayed once.

  8. Copy the key now and store it as you would a password. MISP cannot show it again; if you lose it, delete it and create a new one.

The key carries your account’s Read Only role, so it can search and download data but cannot create or change anything on the server.

Test your key

Set the key in a shell variable so it stays out of your command history and scripts:

export MISP_KEY='paste-your-key-here'

curl -s \
  -H "Authorization: $MISP_KEY" \
  -H "Accept: application/json" \
  https://misp.precisionsec.com/users/view/me

A JSON document describing your user means the key works.

Download indicators

The attributes/restSearch endpoint returns individual indicators (domains, URLs, IPs, hashes) matching the filters you give it.

Everything flagged for detection (to_ids) from the last 24 hours, as JSON:

curl -s -X POST https://misp.precisionsec.com/attributes/restSearch \
  -H "Authorization: $MISP_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"returnFormat": "json", "last": "1d", "to_ids": true}'

Domains, URLs and IP addresses as CSV:

curl -s -X POST https://misp.precisionsec.com/attributes/restSearch \
  -H "Authorization: $MISP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"returnFormat": "csv", "last": "1d", "to_ids": true,
       "type": ["domain", "url", "ip-dst"]}' \
  -o indicators.csv

A plain-text domain blocklist, one value per line:

curl -s -X POST https://misp.precisionsec.com/attributes/restSearch \
  -H "Authorization: $MISP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"returnFormat": "text", "last": "1d", "to_ids": true,
       "type": "domain"}' \
  -o domains.txt

The last value accepts durations such as 1h, 1d and 7d.

Download full events

The events/restSearch endpoint returns whole events with their context, objects and tags rather than individual attributes.

curl -s -X POST https://misp.precisionsec.com/events/restSearch \
  -H "Authorization: $MISP_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"returnFormat": "json", "last": "1d", "published": true}' \
  -o events.json

Set "returnFormat": "stix2" to receive STIX 2 bundles instead. To narrow the results to a malware family, add a tags filter using a tag name you see on the server’s event list.

Page through large results

For large result sets, request them in pages with limit and page:

curl -s -X POST https://misp.precisionsec.com/attributes/restSearch \
  -H "Authorization: $MISP_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"returnFormat": "json", "last": "7d", "to_ids": true,
       "limit": 1000, "page": 1}'

Increment page until a response comes back empty. For ongoing synchronisation, schedule a job that asks only for a short, recent window (for example "last": "1h" every hour) rather than re-downloading the full history.

Use PyMISP

PyMISP is the official Python client for the MISP API.

pip install pymisp
import os
from pymisp import PyMISP

misp = PyMISP("https://misp.precisionsec.com", os.environ["MISP_KEY"], ssl=True)

attributes = misp.search(
    controller="attributes",
    last="1d",
    to_ids=True,
    type_attribute=["domain", "url", "ip-dst"],
    pythonify=True,
)

for attr in attributes:
    print(attr.type, attr.value)

Import events into your own MISP instance

To copy PrecisionSec events into your own MISP instance, read them with your PrecisionSec key and write them with an API key from your own instance. The key on your instance needs permission to add and edit events.

The script below matches events by UUID, so it can run on a schedule without creating duplicates: events your instance doesn’t have are added, events that PrecisionSec has updated since the last run are updated, and everything else is skipped.

import os
from pymisp import PyMISP

src = PyMISP("https://misp.precisionsec.com", os.environ["PSEC_MISP_KEY"], ssl=True)
dst = PyMISP(os.environ["LOCAL_MISP_URL"], os.environ["LOCAL_MISP_KEY"], ssl=True)

added = updated = skipped = 0

for event in src.search(controller="events", last="1d", published=True, pythonify=True):
    # Look the event up on your instance by its UUID.
    existing = dst.search(
        controller="events", uuid=event.uuid, metadata=True, pythonify=True
    )

    # Keep imported events private to your organisation until you review them.
    event.distribution = 0

    if not existing:
        dst.add_event(event)
        added += 1
    elif existing[0].timestamp < event.timestamp:
        dst.update_event(event, event_id=event.uuid)
        updated += 1
    else:
        skipped += 1

print(f"added={added} updated={updated} skipped={skipped}")

Run it with:

export PSEC_MISP_KEY='your-precisionsec-key'
export LOCAL_MISP_URL='https://your-misp.example.org'
export LOCAL_MISP_KEY='your-local-key'
python3 import_psec_events.py

Notes:

  • The first run with a wide window (for example last="30d") can take a while; after that, a daily window is enough.
  • distribution = 0 limits imported events to your organisation. Change it if you want to share them with connected communities.
  • If you only need the indicators and not the events, use Download indicators and load the CSV or text output into your own tooling.
  • To have your instance pull the data on a schedule without any script, subscribe it to the feed instead, as described in the MISP Feed Integration Guide.

Troubleshooting

  • 403 Forbidden or “Authentication failed”: the key was copied incorrectly, has passed its expiration date, or the request came from an address outside the key’s Allowed IPs.
  • An empty result: the filters matched nothing. Widen the last window or remove the type filter.
  • Basic-auth credentials do not work here: the feed URL used in the MISP Feed Integration Guide uses separate credentials and is not a MISP API endpoint.
← Back to MISP (REST API) integration overview

Ready to see all of our data?

Request a 15-day free trial and get live, curated threat intelligence feeds.

Request a 15-day trial