Search Attributes - BlinkOps Documentation

Returns a list of attributes.

External DocumentationTo learn more, visit the MISP documentation.

Basic Parameters

Parameter	Description
Deleted	Whether to include soft-deleted attributes. If set to `True`, only deleted attributes will be returned.
Event Info	Quick event description.
Published	Was the attribute published.
UUID	The uuid of the attribute.
Value 1	Search attribute by value.

Advanced Parameters

Parameter	Description
Attack Galaxy	The attack galaxy.
Attribute Timestamp	The timestamp of the attribute.
Category	The category of the attribute.
Decaying Model	Specify the decaying model from which the decaying score should be calculated.
Enforce Warning List	Should the warning list be enforced. Adds blocked field for matching attributes.
Event ID	The unique identifier of an event.
Event Timestamp	The timestamp of the event.
Exclude Decayed	Should the decayed elements by excluded.
First Seen	First seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m).
From	Get the attributes starting from this time. `Note` : You can use time related filters. Examples: `7d`, timestamps, `[14d, 7d]`(For ranges)
Headerless	Removes header in the CSV export.
Include Context	Adds events context fields in the CSV export.
Include Correlations	Includes correlations.
Include Decay Score	Include all enabled decaying score.
Include Event Tags	Include tags of matching events in the response.
Include Event UUID	Include matching eventUuids in the response.
Include Full Model	Include all model information of matching events in the response.
Include Proposals	Include proposals of matching events in the response.
Include Sightings	Extend response with Sightings DB results if the module is enabled.
Include Warninglist Hits	Includes the warning lists hits.
Last	Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp.
Last Seen	Last seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m).
Limit	Limit the amount of pages shown.
Model Overrides	The model overrides. Example: `{ “lifetime”: 3, “decay_speed”: 2.3, “threshold”: 30, “default_base_score”: 80, “base_score_config”: { “estimative-language:confidence-in-analytic-judgment”: 0.25, “estimative-language:likelihood-probability”: 0.25, “phishing:psychological-acceptability”: 0.25, “phishing:state”: 0.2 } }`
Object Relation	Filter by the attribute object relation value.
Organization ID	The unique identifier of the organization.
Page	The page number.
Publish Timestamp	The timestamp of publish.
Requested Attributes	List of properties that will be selected in the CSV export.
Score	An alias to override on-the-fly the threshold of the decaying model.
Sharing Group	Sharing group ID(s), either as single string or list of IDs.
Tags	Search by the tags of the attributes.
Threat Level ID	-
Timestamp	The timestamp.
To	Get the attributes until this time. `Note` : You can use time related filters. Examples: `7d`, timestamps, `[14d, 7d]`(For ranges)
To IDs	To IDs.
Type	The type of attribute. Visit `https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes` under the parameter `type` for the full list of types.
Value 2	Search attribute by value.
Value 3	Search attribute by value.
With Attachments	Extends the response with the base64 representation of the attachment, if there is one.

Example Output

{
	"response": {
		"Attribute": [
			{
				"id": "<string>",
				"event_id": "<string>",
				"object_id": "<string>",
				"object_relation": "<string>",
				"category": "<string>",
				"type": "<string>",
				"to_ids": true,
				"uuid": "<string>",
				"timestamp": "<string>",
				"distribution": "<string>",
				"sharing_group_id": "<string>",
				"comment": "<string>",
				"deleted": false,
				"disable_correlation": false,
				"first_seen": null,
				"last_seen": null,
				"value": "<string>",
				"Event": {
					"org_id": "<string>",
					"distribution": "<string>",
					"publish_timestamp": "<string>",
					"id": "<string>",
					"info": "<string>",
					"orgc_id": "<string>",
					"uuid": "<string>"
				},
				"Object": {
					"id": "<string>",
					"distribution": "<string>",
					"sharing_group_id": "<string>"
				}
			},
			{
				"id": "<string>",
				"event_id": "<string>",
				"object_id": "<string>",
				"object_relation": "<string>",
				"category": "<string>",
				"type": "<string>",
				"to_ids": true,
				"uuid": "<string>",
				"timestamp": "<string>",
				"distribution": "<string>",
				"sharing_group_id": "<string>",
				"comment": "<string>",
				"deleted": false,
				"disable_correlation": false,
				"first_seen": null,
				"last_seen": null,
				"value": "<string>",
				"Event": {
					"org_id": "<string>",
					"distribution": "<string>",
					"publish_timestamp": "<string>",
					"id": "<string>",
					"info": "<string>",
					"orgc_id": "<string>",
					"uuid": "<string>"
				},
				"Object": {
					"id": "<string>",
					"distribution": "<string>",
					"sharing_group_id": "<string>"
				}
			}
		]
	}
}

Workflow Library Example

Search Attributes with Misp and Send Results Via Email

Preview this Workflow on desktop

​Basic Parameters

​Advanced Parameters

​Example Output

​Workflow Library Example

Basic Parameters

Advanced Parameters

Example Output

Workflow Library Example