Install & Compatibility
Where this runs
tested against v2.5.34.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
77MB installed
● package 77MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
PyMISP
✓ from pymisp import PyMISP
MISPEvent
✓ from pymisp import MISPEvent
MISPAttribute
✓ from pymisp import MISPAttribute
This quickstart demonstrates how to initialize the PyMISP object using environment variables for the MISP URL and API key, and then how to fetch the last 5 published events. It includes basic error handling for connection issues.
import os
from pymisp import PyMISP
# Configure MISP connection from environment variables
misp_url = os.environ.get('MISP_URL', 'https://your.misp.instance')
misp_key = os.environ.get('MISP_KEY', 'YOUR_MISP_AUTOMATION_KEY') # Your MISP automation key
misp_verifycert = os.environ.get('MISP_VERIFYCERT', 'True').lower() == 'true'
# Initialize PyMISP object
try:
misp = PyMISP(misp_url, misp_key, misp_verifycert)
print(f"Successfully connected to MISP instance at {misp_url}.")
# Example: Fetch last 5 published events
last_events = misp.search(limit=5, controller='events', published=True)
if last_events:
print(f"Found {len(last_events)} published events:")
for event in last_events:
print(f" Event ID: {event['Event']['id']}, Info: {event['Event']['info']}")
else:
print("No published events found in the last search.")
except Exception as e:
print(f"Error connecting to MISP or fetching events: {e}")
print("Please ensure MISP_URL, MISP_KEY, and MISP_VERIFYCERT are correctly set.")
Debug
Known issues
breakingVersion 2.5.33.1 introduced backward incompatible changes related to `pyfaup-rs` (and implicitly `faup-rs`). If you rely on URL object parsing, review your code and potentially update `pyfaup-rs` or pin an older PyMISP version if issues arise.fixUpdate `pyfaup-rs` to its latest compatible version, or adapt code to new `pyfaup-rs` expectations. Alternatively, if compatibility is critical, pin `pymisp<2.5.33.1`.
affects: >=2.5.33.1
gotchaSSL certificate verification is `True` by default (`misp_verifycert=True`). In development environments or with self-signed certificates, this often leads to `SSLError` exceptions.fixSet `misp_verifycert=False` during PyMISP object initialization when necessary. For production, ensure proper SSL certificate setup and verification.
affects: All versions
gotchaPyMISP requires an 'automation key' from your MISP user profile. Regular user API keys may not have sufficient permissions for automated tasks, leading to authorization errors (e.g., 'Not available: you don't have "Auth key access" role').fixEnsure the API key used for PyMISP is an automation key, which can be generated or found in the 'Automation' section of the MISP web interface or your user profile.
affects: All versions
breakingWith MISP v2.5.35, the default ordering for `restsearch` (e.g., when searching for attributes or events) has changed due to a transition to cursor-based pagination. If your application relies on a specific default order, your search results might appear different.fixExplicitly specify the desired ordering using the `order_by` and `direction` parameters in your `misp.search()` calls to maintain consistent result ordering.
affects: All versions when connecting to MISP server >=2.5.35
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'pymisp'
The pymisp library is not installed in your Python environment or the environment where the script is being executed.
fixInstall the library using pip: `pip install pymisp`
pymisp.exceptions.PyMISPError: Unable to connect to MISP (https://your-misp-url/). Please make sure the API key and the URL are correct (http/https is required): ...
PyMISP cannot establish a connection to the MISP instance due to an incorrect URL, an invalid API key, network issues, or SSL certificate problems.
fixVerify the MISP URL and API key are correct. Ensure network connectivity to the MISP instance. If using a self-signed certificate, pass `ssl=False` during PyMISP initialization or provide the CA certificate path: `PyMISP(url, key, ssl=False)` or `PyMISP(url, key, cert='/path/to/your/ca.crt')`.
ERROR Something went wrong (403): {'name': 'Could not add Attribute', 'message': 'Could not add Attribute', 'url': '/attributes/add', 'errors': {'value': ['A similar attribute already exists for this event. ']}}
You are attempting to add an attribute that is a duplicate of an existing attribute within the same event, or it violates MISP's validation rules (e.g., incorrect type/category for the value).
fixEnsure the attribute you are adding is unique or correctly configured. To update an existing attribute, use the appropriate update method or set `break_on_duplicate=False` when adding attributes if supported by the specific PyMISP method.
KeyError: 'name'
This typically occurs when trying to access a dictionary key that does not exist in the API response or in a PyMISP object being constructed, often due to an unexpected API response format or incorrect data access.
fixInspect the structure of the data returned by the API or the PyMISP object to ensure the key `name` (or whichever key is missing) actually exists at that level. Use `.get('name')` with a default value to safely access potentially missing keys. AttributeError: 'ExpandedPyMISP' object has no attribute 'update_sharing_group'
This error indicates that you are calling a method (e.g., `update_sharing_group`) that either does not exist in your specific version of PyMISP or has been renamed/deprecated, while the replacement method is not yet available or correctly implemented in your client library version.
fixConsult the PyMISP documentation or GitHub repository for the version you are using to confirm the correct method name and usage. Update your PyMISP library to the latest version (`pip install --upgrade pymisp`) to access new functionalities and fixes.
Upgrade
Version history
2.5.34.2latest on PyPI · released Aug 14, 2026
Audit
Dependencies
requestsrequiredCore HTTP client for API communication.
pyfaupoptionalRequired for generating URL objects and improved URL parsing.
LIEFoptionalEnables creation and analysis of PE/ELF/Mach-o objects.
python-magicoptionalUsed for file type detection when creating file objects.
brotlioptionalProvides Brotli compression support for interacting with MISP instances.
oletoolsoptionalNeeded for parsing and generating MISP Email objects.