Outgoing feed - MISP

This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Configure outgoing feeds general options.


Transport type

MISP upload

Content type


Published data

Events, attributes, and objects.


Publish events, attributes, and objects to MISP platform.

IDS flags

This extension sets the IDS flag (to_ids) to true on packaged event attributes if the corresponding entities on the platform have a tag named “IDS”.

Configure the outgoing feed

  1. Create or edit an outgoing feed.

  2. Under Transport and content, fill out these fields:

    Required fields are marked with an asterisk (*).



    Transport type*

    Select MISP upload from the drop-down menu.

    Content type*

    Select MISP JSON model from the drop-down menu.


    Select an existing dataset from the drop-down menu. The menu only displays datasets that are compatible with the Transport type you’ve selected.

    Update strategy*

    Select an update strategy.

    Supported update strategies:

    • APPEND


    MISP server URL*

    Enter the URL you use to reach your MISP instance.

    MISP server API key*

    Enter the API key used to authenticate with your MISP instance.

  3. Store your changes by selecting Save.

View and retrieve outgoing feed content

  1. In the top navigation bar click Data configuration > Outgoing feeds.

  2. In the Outgoing feeds view, click anywhere in the row corresponding to the outgoing feed whose content you want to view or retrieve.

  3. In the selected outgoing feed detail pane, click the Created packages tab.

  4. In the Created packages tab, under the Download column header, click the name of a package to download it, and to save it to a target location.