{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/crimsoncrawler-com/json-schema/crimsoncrawler-com-post-v1-search-misp-request-schema.json",
  "title": "PostV1SearchMispRequest",
  "x-generated": "2026-10-30",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_ae-authored/crimsoncrawler-com-openapi-generated.yml#/components/schemas/PostV1SearchMispRequest",
  "type": "object",
  "properties": {
    "value": {
      "type": "string",
      "description": "Indicator value to match (IP, hash, domain, etc.)"
    },
    "eventinfo": {
      "type": "string",
      "description": "Search events by title or description text"
    },
    "event_id": {
      "type": "string",
      "description": "Look up one event directly by ID"
    },
    "type_attribute": {
      "type": "string",
      "description": "Restrict to one attribute type (e.g. ip-dst, md5, domain)"
    },
    "category": {
      "type": "string",
      "description": "Restrict to one MISP attribute category (e.g. Network activity, Payload delivery)"
    },
    "tags": {
      "type": "array",
      "description": "Match any of the given tags (supports tlp: prefixes and galaxy cluster names)"
    },
    "to_ids": {
      "type": "boolean",
      "description": "Attribute selector: true returns only attributes flagged for IDS detection, false only attributes NOT flagged"
    },
    "threat_level_id": {
      "type": "string",
      "description": "Event threat level: 1 (high), 2 (medium), 3 (low), 4 (undefined)"
    },
    "date_from": {
      "type": "string",
      "description": "Restrict to an event date range start (YYYY-MM-DD)"
    },
    "date_to": {
      "type": "string",
      "description": "Restrict to an event date range end (YYYY-MM-DD)"
    },
    "published": {
      "type": "boolean",
      "description": "Restrict to events published by their owning org (excludes analyst drafts)"
    },
    "include": {
      "type": "array",
      "description": "Include result layers: event_reports, feeds, misp_events_full, objects, sightings, stats, tags, version"
    }
  }
}