---
id: pymisp
version: "2.5.34.2"
license: BSD-2-Clause
license_treatment: permissive
maintenance: active
---

# pymisp — Python API for MISP.

License: permissive · Maintenance: active · Downloads: 829.5K/mo

## What it is and what it does

PyMISP is a Python wrapper around the MISP REST API that lets you programmatically interact with MISP threat intelligence platforms. It abstracts away HTTP details so you can fetch events, add or update attributes, manage samples, and search for indicators using Python code instead of manual API calls. The library represents MISP objects (events, attributes, samples) as Python dictionaries through an AbstractMISP base class, making them easy to manipulate and serialize to JSON.

The package is designed for security teams, threat researchers, and automation engineers who need to integrate MISP data into workflows, build detection pipelines, or synchronize threat intelligence across systems. It has three core dependencies (deprecated, python-dateutil, requests) and optional extras for specialized tasks like PDF report generation, VirusTotal integration, and email object creation. The library is actively maintained, supports Python 3.10 through 3.14, and has been in development since 2015.

Use it for:

- Automate the ingestion of threat indicators from MISP into your detection or response platform.
- Build scripts to bulk-create or update MISP events and attributes from external threat feeds.
- Query MISP for indicators matching specific criteria and export them for use in firewalls or SIEMs.
- Programmatically attach samples or malware hashes to MISP events as part of an incident response workflow.
- Synchronize threat intelligence between multiple MISP instances or integrate MISP data into custom dashboards.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

PyMISP is a Python library that connects to MISP platforms via their REST API to fetch, create, update, and search threat intelligence events and attributes.

Yes. PyMISP is actively maintained, has low install friction, carries no known vulnerabilities, and is the standard Python client for MISP platforms. Install it if you need to automate threat intelligence workflows or integrate MISP into a larger security system. The permissive BSD-2-Clause license poses no restriction.

## Install

pip install pymisp
uv add pymisp
poetry add pymisp

## Installing pymisp

Before you install: Low install friction with three core runtime dependencies (deprecated, python-dateutil, requests). Active maintenance with a release on 2026-08-14 and recent commits. Supports modern Python versions (3.10–3.14).

License in practice: Distributed under BSD-2-Clause (permissive license), which allows commercial and private use with minimal restrictions—only requiring preservation of copyright and license notices.

Quickstart:

pip3 install pymisp

from pymisp import PyMISP
misp = PyMISP('https://your-misp-instance.com', 'your-api-key')
events = misp.search(eventid=1)

Requires a running MISP instance and valid API credentials; the MISP automation key must be obtained from the web interface's Automation section.

Verify before relying:

- Whether optional dependencies (fileobjects, virustotal, pdfexport, etc.) are required for specific use cases or truly optional.
- Performance characteristics when working with large event datasets or high-frequency API calls.
- Compatibility guarantees with specific MISP server versions.

## Package facts

- License: BSD-2-Clause (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 829.5K/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

MISP REST API client, threat intelligence event management, fetch and update MISP events, attribute search and creation, malware sample management, security event automation, threat-intelligence, misp-integration, security-automation

[View on SkillFed](https://skillfed.io/packages/pymisp) · [View on PyPI](https://pypi.org/project/pymisp/)