MISP

Add the feed

1. 1Sync Actions, Feeds, Add Feed.
2. 2Input Source: Network. Source Format: Simple CSV.
3. 3URL: https://ctif.orvteam.com/api/blocklist?format=csv&min_score=70&limit=50000&key=YOUR_API_KEY
4. 4Value field: 1, which is the ip column. Delimiter: a comma.
5. 5Enable the feed, enable caching if you want correlation without importing, then Fetch and cache.

The CSV header line is not a valid indicator and is discarded on import. Columns after the first carry the score, country, sighting count, last-seen time and the source that produced the entry.

Choosing what to import

Two knobs matter. min_score decides how much evidence an address needs before it reaches your instance, and first_party_only=true drops the public lists we import so you receive only what our own sensors observed. If your MISP already ingests the Tor exit list and blocklist.de from their publishers, use that flag and avoid duplicate correlation hits.

Notes

MISP fetches on its own schedule; each fetch is one request against your daily quota. Score is a snapshot at fetch time and decays as evidence ages, so refetching replaces stale values.