Select the MISP instance from the dropdown

The title of this alert.

The description to send with the alert.

To update existing MISP events, provide valid event UUID or ID or a field name containing them (this allows to update several events in one run).

Provide a field name to group into distinct MISP event(s) all lines sharing the same value of this field. If not provided, all results will be added to a single MISP event.

The default Info field for the MISP events if not provided in results.

Your organisation only This community only Connected communities All communities Sharing Group Change the Distribution. Defaults to "Your organisation only".

High Medium Low Undefined Change the Threat Level. Defaults to "Undefined".

Initial Ongoing Complete Change Analysis status. Default to Initial

WHITE CLEAR GREEN AMBER AMBER+STRICT RED UNCLEAR EX_CHR Change the TLP of the created alert. Defaults to TLP:AMBER

WHITE GREEN AMBER RED Permissible Actions Protocol. Default to PAP:RED

NO YES By default events are not published at time of creation (No).

Use single comma-separated string without quotes for multiple tags (eg. badIP,spam).