Push STIX 2.1 Bundle into MISP via misp-stix Converter

The misp-stix Python package converts STIX 2.1 bundles into MISP event JSON and back, relying on the misp_stix_converter library to map STIX Domain Objects (Indicator, Malware, ThreatActor) to MISP event structures, galaxies, and attribute types. When invoked, it parses the STIX bundle, resolves embedded relationships, and produces a MISP-compatible JSON payload that can be POSTed to /events/add. The conversion preserves TLP markings, external references, and object relationships using MISP's object templates.

This workflow is essential when ingesting intelligence from ISACs, CERT feeds, or commercial providers that publish STIX 2.1. SOC teams use it as part of automated ingestion pipelines triggered by email or webhook, while threat hunters use it interactively to explore a bundle before committing it to the MISP instance.

Security implications include losing context if the STIX bundle uses custom objects not mapped by the converter, and inadvertently importing TLP:RED indicators into a shared instance. Always validate the generated JSON with jq and inspect the TLP field before publishing. Performance-wise, large bundles with thousands of objects can take minutes and consume significant RAM; run conversion in a container with a memory limit and stream validation to avoid OOM kills.

> System.Execute()

python3 -m misp_stix_converter.stix21_to_misp \
  --input-file /tmp/bundle.json \
  --output-file /tmp/misp_event.json \
  --distribution 0 \
  --threat-level 2 \
  --analysis 1

jq '.Event.info, .Event.distribution, (.Event.Attribute | length)' /tmp/misp_event.json

curl -sS -X POST https://misp.example.com/events/add \
  -H "Authorization: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  --data @/tmp/misp_event.json | jq '.Event.id'

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-467DE2882394