MISP Scheduled feed and live enrichment

Blocklist feed in MISP

1. Sync Actions → Feeds → Add Feed. Source format Simple CSV, value field 1 — comment lines starting with # are skipped, whereas Freetext would import the URL in the header.
2. URL: https://api.ismalicious.com/blocklist/download/blocklist-domains-critical.txt. Swap domains for ips, and critical for high, medium, low, all or a category such as phishing, c2 or ransomware.
3. Headers: X-API-KEY: base64(apiKey:apiSecret), one header per line. A Free key returns a 10% sample, paid plans the full list.
4. Tick Enabled and Caching enabled, pick a distribution, run Fetch and store all feed data once, then let the daily fetch_feeds scheduled task keep it current.

STIX objects via TAXII 2.1

MISP only pushes to TAXII 2.1 servers. To bring STIX objects in, pull the collection with taxii2-client and create the event with PyMISP (pip install taxii2-client pymisp):

from pymisp import MISPEvent, PyMISP
from taxii2client.v21 import Server

# API key and secret: https://ismalicious.com/app/account
server = Server("https://api.ismalicious.com/taxii2/", user=API_KEY, password=API_SECRET)
collection = next(c for c in server.api_roots[0].collections if c.id == "malicious-domains")
bundle = collection.get_objects(limit=1000)  # add added_after="2026-09-20T00:00:00Z" on later runs

misp = PyMISP("https://misp.example.org", MISP_KEY)
event = MISPEvent()
event.info = "isMalicious malicious-domains"
for obj in bundle.get("objects", []):
    if obj["type"] == "indicator":
        # pattern is [domain-name:value = 'evil.example'] (ipv4-addr:value for malicious-ips)
        event.add_attribute("domain", obj["pattern"].split("'")[1], comment=obj.get("name", ""))
misp.add_event(event)

Run it daily after the nightly refresh, passing added_after with the previous run's timestamp so each pass fetches only new indicators. Collections: malicious-domains, malicious-ips, malicious-urls, c2-indicators, phishing-indicators, ransomware-iocs.