Skip to main content
Integration

MISP TAXII ingest and live enrichment

Pull STIX 2.1 collections on a schedule, then enrich individual attributes with the isMalicious expansion module.

No credit card required · Free API key

Capabilities

Key features. Everything you need to protect your infrastructure and users.

TAXII 2.1 server

Add isMalicious under Sync Actions → Servers and select collections to fetch.

Expansion + hover

Live /check lookups for IPs, domains, hostnames, and URLs without leaving the event.

Score and categories

Malicious flag, 0–100 risk score, threat categories, and detection source count.

Same credential

X-API-KEY, or Basic Auth with apiKey:apiSecret (legacy: password = the Base64 credential).

Applications

Use cases. How security teams use this tool.

Scheduled feed

Import malicious-ips and malicious-domains into events, then correlate with your own attributes.

Analyst hover

Hover an IP on an event to see the isMalicious score before expanding.

Sharing communities

Keep org-reported collections separate from the global malicious-* feeds.

isMalicious as a MISP threat feed

MISP treats any TAXII 2.1 server as a feed source, so no custom plugin is needed: add isMalicious under Sync Actions → Servers, point discovery at https://api.ismalicious.com/taxii2/, authenticate with your API credentials, and select the malicious-ips and malicious-domains collections. Pulls run on the schedule you configure in MISP; the collections themselves are refreshed nightly, so a daily pull picks up each day's new indicators in one pass. Feed access is part of the Pro and Enterprise plans, feed polls sit outside the monthly API quota, and pagination is by size with a next token — up to 1,001 pages per collection on Pro, no page cap on Enterprise.

Filtering the feed by score

Every indicator in the feed carries a 0–100 risk score, threat categories, and a detection source count — the same fields the expansion module returns when an analyst hovers an attribute. Filter on score inside MISP before wiring a collection into a blocklist, so low-confidence sightings never block production traffic and analysts and automation act on one number.

TAXII server in MISP

  1. Sync Actions → Servers → New TAXII server.
  2. Discovery URL: https://api.ismalicious.com/taxii2/
  3. Username api, password = dashboard API credential.
  4. Start with malicious-domains and malicious-ips. Filter on score before using a collection as a blocklist.
Support

Frequently asked questions.

Do I need a custom MISP plugin to ingest the feed?

No. Add isMalicious as a TAXII 2.1 server (Sync Actions → Servers) and pull collections. The expansion module is for live attribute lookups, not bulk ingest.

What is the discovery URL?

https://api.ismalicious.com/taxii2/ with Basic Auth. Prefer username = API key and password = API secret. Username api with password = the Base64 credential still works.

How often is the MISP feed refreshed?

The isMalicious collections are refreshed nightly. Schedule your MISP TAXII pull daily, after the refresh, so each run picks up the day's new malicious IPs and domains in a single pass.

Do TAXII feed pulls count against my API quota?

No. Feed access comes with the Pro and Enterprise plans, and on paid plans feed polls sit outside the monthly API quota. Pagination is by size with a next token — Pro can page through up to 1,001 pages per collection, Enterprise has no page cap.

Where is the expansion module?

The module is proposed upstream in MISP/misp-modules#798. Until that merges, drop ismalicious.py into misp_modules/modules/expansion/ (auto-discovered).

Which attributes does the module enrich?

ip-src, ip-dst, hostname, domain, url, and domain|ip. Hover and expansion both return malicious flag, risk score, categories, and source count.
Get Started

Ready to get started?

Join thousands of security teams using isMalicious to protect their infrastructure.

No credit card required · Free API key