Actions
Search Attributes
Returns a list of attributes.
To learn more, visit the MISP documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Deleted | Whether to include soft-deleted attributes. If set to True, only deleted attributes will be returned. |
| Event Info | Quick event description. |
| Published | Was the attribute published. |
| UUID | The uuid of the attribute. |
| Value 1 | Search attribute by value. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Attack Galaxy | The attack galaxy. |
| Attribute Timestamp | The timestamp of the attribute. |
| Category | The category of the attribute. |
| Decaying Model | Specify the decaying model from which the decaying score should be calculated. |
| Enforce Warning List | Should the warning list be enforced. Adds blocked field for matching attributes. |
| Event ID | The unique identifier of an event. |
| Event Timestamp | The timestamp of the event. |
| Exclude Decayed | Should the decayed elements by excluded. |
| First Seen | First seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). |
| From | Get the attributes starting from this time.Note : You can use time related filters.Examples: 7d, timestamps, [14d, 7d](For ranges) |
| Headerless | Removes header in the CSV export. |
| Include Context | Adds events context fields in the CSV export. |
| Include Correlations | Includes correlations. |
| Include Decay Score | Include all enabled decaying score. |
| Include Event Tags | Include tags of matching events in the response. |
| Include Event UUID | Include matching eventUuids in the response. |
| Include Full Model | Include all model information of matching events in the response. |
| Include Proposals | Include proposals of matching events in the response. |
| Include Sightings | Extend response with Sightings DB results if the module is enabled. |
| Include Warninglist Hits | Includes the warning lists hits. |
| Last | Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp. |
| Last Seen | Last seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). |
| Limit | Limit the amount of pages shown. |
| Model Overrides | The model overrides.Example:{ "lifetime": 3, "decay_speed": 2.3, "threshold": 30, "default_base_score": 80, "base_score_config": { "estimative-language:confidence-in-analytic-judgment": 0.25, "estimative-language:likelihood-probability": 0.25, "phishing:psychological-acceptability": 0.25, "phishing:state": 0.2 }} |
| Object Relation | Filter by the attribute object relation value. |
| Organization ID | The unique identifier of the organization. |
| Page | The page number. |
| Publish Timestamp | The timestamp of publish. |
| Requested Attributes | List of properties that will be selected in the CSV export. |
| Score | An alias to override on-the-fly the threshold of the decaying model. |
| Sharing Group | Sharing group ID(s), either as single string or list of IDs. |
| Tags | Search by the tags of the attributes. |
| Threat Level ID | - |
| Timestamp | The timestamp. |
| To | Get the attributes until this time.Note : You can use time related filters.Examples: 7d, timestamps, [14d, 7d](For ranges) |
| To IDs | To IDs. |
| Type | The type of attribute.Visit https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes under the parameter typefor the full list of types. |
| Value 2 | Search attribute by value. |
| Value 3 | Search attribute by value. |
| With Attachments | Extends the response with the base64 representation of the attachment, if there is one. |
Example Output
Workflow Library Example
Search Attributes with Misp and Send Results Via Email
Preview this Workflow on desktop
Was this page helpful?