.DkNUKaKx_ZLAT4m.webp?dpl=dpl_Crv6NFYc4gRVqEEsmHdUK26mPGZB){kind=small}
Connectors / Security and compliance · HTTP Connector
Automate MISP with Tray.ai
Add an attribute, add an event report and add an organisation in MISP. Connect MISP to the rest of your security and compliance stack with Tray.ai.
Thanks — someone from our team will be in touch soon.
What can you do with MISP on Tray.ai?
MISP is an open-source threat intelligence platform where security teams store, correlate and share indicators of compromise, events and attack data with partner organisations. Tray.ai connects to MISP through the HTTP Connector, so your workflows can call the MISP API alongside the rest of your stack.
- Add an attribute to an event for each malicious indicator your security team confirms.
- Search attributes for indicators found in a new alert before your analysts triage it.
- Publish an event once a threat review is approved, so partner teams get the indicators.
- Connects through
- HTTP Connector
- Authentication
- An API key in a request header
Set it up
Connect MISP to Tray.ai
Each step uses MISP's own API details, from its documentation.
Step 1
Save MISP's API key
Save the key as a Tray.ai authentication. The HTTP Client puts it in the request header, read from $.auth. The key stays out of the workflow and out of the logs.
Step 2
Import a request from MISP's docs
Add an HTTP Client step and paste a cURL example from MISP's API docs. Tray.ai fills in the method, URL, headers, and query.
Step 3
Start with “Search events”
It's one of 22 documented actions, under Events. The response comes back as data the next step can map into your other apps.
Step 4
Hand it to an AI agent
Wrap “Add an event” and “Edit an event” in workflows, and Tray.ai's Agent Gateway for MCP publishes them as governed tools Claude and other AI agents can call.
What the MISP API covers
6 resources and 22 documented actions, each one a call the HTTP Connector can make from a Tray.ai workflow. Connecting it takes a few clicks: here's how.
Events
- Search events
- Add an event
- Edit an event
- Delete an event
- Publish an event
Attributes
- Search attributes
- Add an attribute
- Edit an attribute
- Delete an attribute
Tags
- Tag an event
- Remove a tag from an event
- Tag an attribute
Event reports
- List event reports
- Add an event report
- Edit an event report
Organisations
- List organisations
- Add an organisation
- Edit an organisation
Users
- List users
- Add a user
- Edit a user
- Delete a user
Checked against MISP's own documentation on 2026-10-22
How Tray.ai makes this work
MISP plugs into the whole Tray.ai platform
Intelligent Integration
Integrate and automate across 9,000+ apps, databases, APIs, and services with visual workflows, error handling, and observability.
Learn more →Agent Builder
Build AI agents that read, write, and take action in MISP — with guardrails, audit, and human-in-the-loop.
Learn more →Agent Gateway for MCP
Expose MISP actions as governed MCP tools — observable, rate-limited, authenticated.
Learn more →Tray Helix
Build apps on MISP data with your AI assistant, then deploy, run, and govern them on Tray.ai.
Learn more →More security and compliance apps on Tray.ai
Dedicated connectors and other apps Tray.ai reaches in the same category. See every security and compliance connector →
Frequently asked questions
What can a Tray.ai workflow do in MISP?
+
The MISP API documents 22 actions across 6 resources (Events, Attributes, Tags, Event reports, Organisations, Users). For example: Search events; Search attributes; Tag an event. A workflow can make any documented call through the HTTP Connector.
How does Tray.ai authenticate with MISP?
+
The MISP API uses an API key in a request header. You save it once as a Tray.ai authentication, and the HTTP Connector adds it to every request.
See MISP working against your stack.
We'll walk through a tailored demo with your systems plugged in.
Thanks — someone from our team will be in touch soon.