MISP

Add the blocklist as a MISP feed so every listed address becomes an attribute you can correlate with your events and sightings.

Set it up

1. Go to Sync Actions › Feeds › Add Feed.
2. Fill in:
   • Name: isipsafe blocklist, Provider: isipsafe
   • Input source: Network
   • URL: https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=90
   • Source format: Freetext Parsed Feed
   • Creator organisation and Target event: your choice; "Fixed event" keeps everything in one event that is updated each pull
   • Default tags: for example tlp:clear and a source:isipsafe tag
3. Save, enable the feed and caching, then Fetch and store all feed data.
4. Schedule regular pulls under Administration › Scheduled Tasks (fetch_feeds), or with MISP's CLI: cake Server fetchFeed 1 all.

Freetext parsing detects the addresses as ip-src or ip-dst depending on your settings; set the default type to ip-src if MISP asks.

Want scores and categories too?

The csv format includes confidence, country, ASN and category codes per address. Use a "Simple CSV Parsed Feed" with the ip column as the value.

Need a hand?

If something here does not work with your version of MISP, or you have improved it, tell us. We update these pages with what people send.

MISP and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.