Incorrect IOC category mapping from IRIS to MISP (all mapped to 'external-analysis')

[vasimakop]

Hi community,
Could you help me with the below issue?

Description

We are integrating IRIS with MISP and noticed that IOC category mapping is not preserved correctly.

Problem

IRIS IOCs with different semantic meanings are all mapped to the same category in MISP attributes.

Examples

IRIS IOC categories:

• ip-source / ip-dst
• filename|sha256

Expected MISP attribute mapping:

• Category: Network activity

• Type: ip-src / ip-dst (depending on context)

• Category: payload delivery

• Type: filename|sha256

Actual result:

• Category: External analysis (for all IOCs)

This results in loss of context and makes correlation and analysis in MISP less effective (screenshots are attached).

Question

Is there:

1. A built-in mapping configuration for IOC types between IRIS and MISP?
2. A recommended mapping standard?
3. A way to customize/configure this behavior (e.g. mapping table)?

---

Additional context

We are currently using a custom integration script, but we would prefer aligning with a standard or supported mapping approach if available.

Environments used

• IRIS version: <v2.4.26>
• MISP version: <v2.5.31>
• Integration method: API / custom script (PyMISP)

---

Thanks in advance,