Comprehensive Threat Intelligence Tool Server for MISP - n8n Workflow

• Cybersecurity analysts and security engineers who manage MISP instances.


• Automation developers building AI agents for threat intelligence querying and manipulation.


• Users looking for robust n8n templates for complex security integrations.


• Organizations requiring comprehensive security orchestration automation and response (SOAR) capabilities powered by n8n.

This is one of the most comprehensive n8n templates available for cybersecurity professionals, designed to transform your MISP instance into a powerful set of callable tools accessible by AI agents or other systems using the Multi-Channel Protocol (MCP). Instead of building dozens of small, isolated automations, this single, consolidated n8n workflow centralizes access to 44 critical MISP operations. The power of this n8n automation lies in its ability to enable sophisticated threat intelligence automation—from creating new attributes and events to managing users, organizations, and galaxies—all orchestrated efficiently. Utilizing the special MCP n8n trigger allows external systems to dynamically choose and execute the exact MISP function required, offering unparalleled flexibility in building smart security protocols. This ensures your security response remains agile and integrated.

This powerful n8n workflow operates as an AI tool server, providing a centralized entry point for dozens of MISP functions.

1. Initiation (The n8n Trigger): The process begins with the MISP Tool MCP Server n8n trigger. This trigger listens for incoming requests formatted according to the MCP standard, typically from a language model or an AI agent framework.


2. Tool Selection: Based on the input request, the MCP server determines which of the 44 available tools (the individual MISP Tool n8n node instances) needs to be executed. For example, if the AI agent wants to retrieve data, it might call the Get an attribute or Get many events tool.


3. Execution: The selected MISP Tool n8n node executes its specified operation against the connected MISP instance, handling tasks ranging from creating a user (Create a user) to deleting specific threat indicators (Delete an attribute).


4. Response: The output from the executed MISP operation is routed back through the initial MCP Server n8n trigger, delivering the structured result directly to the calling AI agent or system.

To deploy this comprehensive n8n workflow, follow these steps:

1. Import the n8n Template: Copy the provided JSON code and import it directly into your n8n instance via the 'Workflows' section using the 'New' -> 'Import from JSON' option.


2. Set Up MISP Credentials: Locate any of the MISP Tool n8n node instances (e.g., Create an event). You will need to configure your MISP credentials (API Key and MISP server URL) on the node's settings.


3. Configure the MCP Trigger: The MISP Tool MCP Server n8n trigger is configured with a unique Webhook ID. Note this ID, as it is what your external AI agent or system will use to target this specific n8n workflow and its exposed tools.


4. Activate the n8n Workflow: Ensure the workflow is activated. Once running, the n8n trigger will listen for requests, making the 44 operations immediately accessible to your AI tools.

This highly structured n8n workflow utilizes two main types of n8n node components:

MISP Tool MCP Server (n8n Trigger):
Function: Serves as the activation point and MCP endpoint. This crucial n8n trigger registers all subsequent MISP operations as callable tools for AI agents.
Key Configuration: Uses a webhook ID (868abd57-657e-49b0-9f14-a9ed10235d92) to expose the endpoint.

MISP Tool (44 Instances):
Function: Each instance represents a specific MISP API operation. This includes core CRUD operations across various objects in MISP. This n8n node connects to your MISP instance using API credentials.
Key Configuration: Operations cover:
Attributes: Create an attribute, Delete an attribute, Get an attribute, Update an attribute, etc.
Events: Create an event, Publish an event, Unpublish an event, Delete an event, etc.
Feeds: Create a feed, Enable a feed, Disable a feed.
Users & Organizations: Full management capabilities including Create a user, Update an organization, and various 'Get many' operations.
* Tags & Galaxies: Tools like Add a tag to an event and Delete a galaxy are included.

All 44 MISP Tool n8n node instances are connected to the central MCP n8n trigger via the ai_tool connection, registering them automatically for AI agent use.