# Filebeat ThreatIntel MISP Module

**URL:** <https://discuss.elastic.co/t/filebeat-threatintel-misp-module/274019>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 26, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-threatintel-misp-module/274019 "2021-05-26T07:21:02Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [May 26, 2021, 8:55pm UTC](https://discuss.elastic.co/t/filebeat-threatintel-misp-module/274019/2 "2021-05-26T20:55:59Z")

</div>

Hello @AndreiRD . I added an answer to a similar question here, hope this helps! 🙂

> [@Threatintel anomali error: the requested root field is empty](https://discuss.elastic.co/t/threatintel-anomali-error-the-requested-root-field-is-empty/270841):
>
> Hi, I gave the threatintel module a try. Successfully ingesting abuseurl, abusemalware and otx. I've a problem with getting anomali to work. First I figured, I have to uncomment the username/password fields to send default guest credentials. But then I get: Apr 21 12:14:47 ingester filebeat[29141]: 2021-04-21T12:14:47.524Z#011INFO#011[input.httpjson-cursor]#011v2/input.go:145#011Input stopped because context was cancelled with: context canceled#011{"input\_source": "https://limo.anomali.com/…

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-threatintel-misp-module/274019)._