MISP Pullable Feed

MISP-Format Pullable Feed

A standing, unauthenticated, cacheable endpoint that other threat-intelligence platforms subscribe to and pull on a schedule. It serves the exact layout MISP's built-in Feeds fetcher expects — a manifest.json, one MISP Event JSON per indicator category, and a hashes.csv for fast cache checks — plus RSS 2.0 and flat JSON variants for generic consumers. Unlike Export (a one-shot manual download), this feed is polled continuously and streams every artifact in bounded chunks so it scales to millions of indicators.

Feed Base URL

Point MISP (or any puller) at this base. It appends /manifest.json, /<uuid>.json and /hashes.csv automatically — no rewrite rules needed (routing uses PATH_INFO).

Copy & Paste — Subscribe

# 1) Preview the manifest (what MISP polls first)
curl "https://threats.quantus.biz/misp-feed.php/manifest.json"

# 2) Pull one event (full MISP Event JSON, streamed)
curl "https://threats.quantus.biz/misp-feed.php/09454141-6cba-460f-a32b-7a66526b3c13.json"

# 3) Fast cache correlation file
curl "https://threats.quantus.biz/misp-feed.php/hashes.csv"

# 4) Generic consumers (SIEM / reader) — RSS or flat JSON
curl "https://threats.quantus.biz/misp-feed.php/rss.xml?limit=200"
curl "https://threats.quantus.biz/misp-feed.php/feed.json?type=ip&limit=5000&tlp=green"

# MISP CLI subscribe (adds + immediately fetches the feed)
#   Admin -> Sync Actions -> List Feeds -> Add Feed  (Source Format: MISP Feed)
#   URL:  https://threats.quantus.biz/misp-feed.php

Published Events (one per category)

Type Mix in Feed