> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MISP

> Search, publish, and enrich threat intelligence with MISP.

## Overview

The MISP connector searches attributes, retrieves events, creates events, adds
attributes, and records sightings from CaseBender.

## Configure

<Steps>
  <Step title="Create an automation key">
    Create a dedicated MISP automation user with permissions limited to the
    organizations, sharing groups, and distribution levels you require.
  </Step>

  <Step title="Store the credential">
    In **Settings → Integrations**, select **Add integration**, choose **MISP**, enter the instance URL and
    API key, and add the MISP hostname to the allowed-host list.
  </Step>

  <Step title="Create and test a connection">
    Bind the credential to the MISP URL and verify the server version can be
    retrieved.
  </Step>
</Steps>

## Available actions

* Search attributes and retrieve events
* Create events and attributes
* Add sightings

<Warning>
  Align MISP distribution and TLP values with your organization's sharing policy
  before publishing indicators.
</Warning>