MISP TAXII ingest and live enrichment
Pull STIX 2.1 collections on a schedule, then enrich individual attributes with the isMalicious expansion module.
No credit card required · Free API key
Key features. Everything you need to protect your infrastructure and users.
TAXII 2.1 server
Add isMalicious under Sync Actions → Servers and select collections to fetch.
Expansion + hover
Live /check lookups for IPs, domains, hostnames, and URLs without leaving the event.
Score and categories
Malicious flag, 0–100 risk score, threat categories, and detection source count.
Same credential
X-API-KEY, or Basic Auth with apiKey:apiSecret (legacy: password = the Base64 credential).
Use cases. How security teams use this tool.
Scheduled feed
Import malicious-ips and malicious-domains into events, then correlate with your own attributes.
Analyst hover
Hover an IP on an event to see the isMalicious score before expanding.
Sharing communities
Keep org-reported collections separate from the global malicious-* feeds.
isMalicious as a MISP threat feed
MISP treats any TAXII 2.1 server as a feed source, so no custom plugin is needed: add isMalicious under Sync Actions → Servers, point discovery at https://api.ismalicious.com/taxii2/, authenticate with your API credentials, and select the malicious-ips and malicious-domains collections. Pulls run on the schedule you configure in MISP; the collections themselves are refreshed nightly, so a daily pull picks up each day's new indicators in one pass. Feed access is part of the Pro and Enterprise plans, feed polls sit outside the monthly API quota, and pagination is by size with a next token — up to 1,001 pages per collection on Pro, no page cap on Enterprise.
Filtering the feed by score
Every indicator in the feed carries a 0–100 risk score, threat categories, and a detection source count — the same fields the expansion module returns when an analyst hovers an attribute. Filter on score inside MISP before wiring a collection into a blocklist, so low-confidence sightings never block production traffic and analysts and automation act on one number.
TAXII server in MISP
- Sync Actions → Servers → New TAXII server.
- Discovery URL:
https://api.ismalicious.com/taxii2/ - Username
api, password = dashboard API credential. - Start with
malicious-domainsandmalicious-ips. Filter on score before using a collection as a blocklist.
Frequently asked questions.
Do I need a custom MISP plugin to ingest the feed?
What is the discovery URL?
How often is the MISP feed refreshed?
Do TAXII feed pulls count against my API quota?
Where is the expansion module?
Which attributes does the module enrich?
Ready to get started?
Join thousands of security teams using isMalicious to protect their infrastructure.
No credit card required · Free API key