# MISP integrations: attributes and tags

> Add an attribute, add an event report and add an organisation in MISP. Connect MISP to the rest of your security and compliance stack with Tray.ai.

**Canonical page:** https://tray.ai/connectors/misp-integrations/
**Categories:** Security and compliance
**Connects through:** HTTP Connector

## Overview

MISP is an open-source threat intelligence platform where security teams store, correlate and share indicators of compromise, events and attack data with partner organisations. Tray.ai connects to MISP through the HTTP Connector, so your workflows can call the MISP API alongside the rest of your stack.

## Use cases

### Events

Read, create, update, and delete events in MISP from any Tray.ai workflow. The MISP API covers calls such as search events and add an event.

- Search events
- Add an event
- Edit an event

### Attributes

Read, create, update, and delete attributes in MISP from any Tray.ai workflow. The MISP API covers calls such as search attributes and add an attribute.

- Search attributes
- Add an attribute
- Edit an attribute

### Tags

Update and delete tags in MISP from any Tray.ai workflow. The MISP API covers calls such as tag an event and remove a tag from an event.

- Tag an event
- Remove a tag from an event
- Tag an attribute

### Event reports

Read, create, and update event reports in MISP from any Tray.ai workflow. The MISP API covers calls such as list event reports and add an event report.

- List event reports
- Add an event report
- Edit an event report

### Organisations

Read, create, and update organisations in MISP from any Tray.ai workflow. The MISP API covers calls such as list organisations and add an organisation.

- List organisations
- Add an organisation
- Edit an organisation

### Users

Read, create, update, and delete users in MISP from any Tray.ai workflow. The MISP API covers calls such as list users and add a user.

- List users
- Add a user
- Edit a user

## Challenges Tray.ai solves

### Keeping MISP credentials out of logs

A raw API call usually means pasting a key or token into the request, where it ends up in step inputs, logs, and screenshots.

**How Tray.ai helps:** Store MISP credentials once as a Tray.ai authentication and reference them from the HTTP Connector. Tray.ai masks authentication values in logs, so the secret never shows up in a step's input or output.

### Going from the MISP API docs to a working call

Translating an example request from API docs into a workflow step means copying the method, URL, headers, and body by hand.

**How Tray.ai helps:** Paste a cURL example from the MISP API docs into the HTTP Connector and Tray.ai fills in the method, URL, headers, and body for you.

### Handling files and non-JSON responses

Not every API answers in JSON. Some return XML, files, or binary data, or expect a multipart upload.

**How Tray.ai helps:** The HTTP Connector parses JSON and XML responses, returns files you can pass to the next step, and sends multipart form data for uploads.

## Frequently asked questions

### Does Tray.ai connect to MISP?

Yes. Tray.ai connects to MISP through the HTTP Connector, which calls the MISP API directly. Any call the MISP API documents can run as a step in a Tray.ai workflow.

### How does Tray.ai authenticate with MISP?

The MISP API uses an API key in a request header. You save it once as a Tray.ai authentication, and the HTTP Connector adds it to every request.

### Can I get a dedicated MISP connector?

MISP runs through the HTTP Connector rather than a dedicated connector. If your team wants one, the Tray.ai connector SDK can build a dedicated MISP connector from the MISP API.

## Learn more

- Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/
- Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/
- Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/
- Book a demo: https://tray.ai/contact/