Information Extractor and MISP integration

Make sure you have n8n installed and running:

• Install n8n on any platform using npm or Docker;
• Or let n8n host it for you on its cloud infrastructure.

In n8n, click the "Add workflow" button in the Workflows tab to create a new workflow.

Add the starting point – a trigger on when your workflow should run: on schedule, on a webhook call, when called by another workflow, or manually. In some situations, either Information Extractor or MISP could already be your first step. To set this up, click "On App Event", search for either Information Extractor or MISP, and choose a trigger to kick off your workflow.

Drag the Information Extractor node from the nodes panel on the left to the workflow canvas. Before dragging, choose the action Information Extractor will perform.

Click on the Information Extractor node, then click on the "Select credential" dropdown option next to the “Credential to connect with” field. Follow the authentication process to grant n8n access to your Information Extractor. You can also share credentials you've created, and store sensitive credential information in an external vault using n8n's external secrets feature.

Drag the MISP node from the nodes panel to the canvas. Before dragging, choose the action MISP will perform.

Click on the MISP node, then click on the "Select credential" dropdown option next to the “Credential to connect with” field. Follow the authentication process to grant n8n access to your MISP.

Click on each node to configure its settings. You see the input data on the left. Manipulate the data in the middle by specifying parameters: resources, operations, etc. See the output on the right.

Connect the output of the Information Extractor node to the input of the MISP node or swop nodes to route the integration the other way around.

Use n8n's core nodes to transform data the way you need and extend the integration:

• Splitting: IF and Switch
• Merging: Merge, Compare Datasets
• Looping: IF and Loop Over Items
• Waiting: Wait
• Creating sub-workflows: Execute Workflow and Execute Workflow Trigger
• Error handling: Stop And Error and Error Trigger
• Code: write custom JavaScript or Python and run it as a step in your workflow.

Once you've configured Information Extractor, MISP and/or additional nodes make sure to save your workflow and activate it. Activating a workflow means that it will run automatically every time a trigger node receives input or meets a condition. By default, all newly created workflows are deactivated.

Run the workflow to see if Information Extractor and MISP integration is working as expected. Based on your configuration, data should flow from Information Extractor to MISP or vice versa. Easily debug your workflow: you can check past executions to isolate the mistake and fix it.