# MISP integration no data

**URL:** <https://discuss.elastic.co/t/misp-integration-no-data/341190>\
**Category:** Elastic Security\
**Created:** [August 20, 2023, 5:40pm UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190 "2023-08-20T17:40:15Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lamp123432](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lamp123432](https://discuss.elastic.co/u/lamp123432)\
**Post date:** [August 20, 2023, 5:40pm UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/1 "2023-08-20T17:40:15Z")

</div>

Good day,

Setup a MISP server and trying to ingest data with MISP integration but there is no data coming into elastic. Got the right authkey and no restrictions on the MISP Server firewall. Also able to get data when running curl command off the VM that got the agent, so the MISP server is reachable and data can be obtained but the integration is not working. Also checked datasets but nothing for misp.

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [August 22, 2023, 1:52pm UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/2 "2023-08-22T13:52:26Z")

</div>

Hi @lamp123432,

Welcome back! How are you ingesting the data into Elasticsearch? Are you using the [MISP agent integration](https://docs.elastic.co/integrations/ti_misp) or something else? Are there any errors in the logs at all?

---

<div class="post-metadata">

**Author:** ![lamp123432](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lamp123432](https://discuss.elastic.co/u/lamp123432)\
**Post date:** [August 23, 2023, 3:35am UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/3 "2023-08-23T03:35:53Z")

</div>

Using MISP agent integration. Nothing in the logs

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [August 23, 2023, 9:46am UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/4 "2023-08-23T09:46:25Z")

</div>

Ok, which version of the integration are you using? And which version of Elastic have you installed the integration?

---

<div class="post-metadata">

**Author:** ![lamp123432](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lamp123432](https://discuss.elastic.co/u/lamp123432)\
**Post date:** [August 23, 2023, 9:35pm UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/5 "2023-08-23T21:35:21Z")

</div>

Everything being used is the latest version.

Agent version: 8.9.1

MISP Integration version: 1.20.0

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [August 24, 2023, 8:37am UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/6 "2023-08-24T08:37:10Z")

</div>

It's difficult to say without any log errors or obvious misconfiguration. Does the system persist after you reinstall the integration?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2023, 12:48am UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190/9 "2023-09-24T00:48:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.