{
  "name": "MISP",
  "author": "Nils Kuhnert, CERT-Bund",
  "license": "AGPL-V3",
  "url": "https://github.com/BSI-CERT-Bund/cortex-analyzers",
  "version": "2.1",
  "description": "Query multiple MISP instances for events containing an observable.",
  "dataTypeList": [
    "domain",
    "ip",
    "url",
    "fqdn",
    "uri_path",
    "user-agent",
    "hash",
    "mail",
    "mail_subject",
    "registry",
    "regexp",
    "other",
    "filename",
    "mail-subject"
  ],
  "baseConfig": "MISP",
  "command": "MISP/misp.py",
  "configurationItems": [
    {
      "name": "name",
      "description": "Name of MISP servers",
      "multi": true,
      "required": false,
      "type": "string"
    },
    {
      "name": "url",
      "description": "URL of MISP servers",
      "type": "string",
      "multi": true,
      "required": true
    },
    {
      "name": "key",
      "description": "API key for each server",
      "type": "string",
      "multi": true,
      "required": true
    },
    {
      "name": "cert_check",
      "description": "Verify server certificate",
      "type": "boolean",
      "multi": false,
      "required": true,
      "defaultValue": true
    },
    {
      "name": "cert_path",
      "description": "Path to the CA on the system used to check server certificate",
      "type": "string",
      "multi": true,
      "required": false
    }
  ],
  "config": {
    "check_tlp": true,
    "max_tlp": 2,
    "auto_extract": false
  },
  "registration_required": false,
  "subscription_required": false,
  "free_subscription": true,
  "service_homepage": "https://www.misp-project.org/",
  "service_logo": {
    "path": "assets/misp.png",
    "caption": "logo"
  },
  "screenshots": [
    {
      "path": "assets/long_report.png",
      "caption": "MISP: long report"
    }
  ]
}