def convert_to_misp(input_file, output_file):
    # Load your input JSON
    with open(input_file, "r") as f:
        input_data = json.load(f)["data"]

    today = datetime.today().strftime("%Y-%m-%d")
    event_uuid = str(uuid.uuid4())

    # Base MISP event (NO "Event" wrapper for /events/add)
    misp_event = {
        "orgc_id": "1",
        "org_id": "1",
        "date": today,
        "threat_level_id": "3",
        "info": f"Feed {today}",
        "published": False,
        "uuid": event_uuid,
        "attribute_count": str(len(input_data)),
        "analysis": "0",
        "timestamp": str(int(datetime.now().timestamp())),
        "distribution": "0",
        "event_creator_email": "admin@admin.test",
        "Attribute": []
    }

    # Convert each IP entry into a MISP Attribute
    for idx, entry in enumerate(input_data, start=1):
        attr_uuid = str(uuid.uuid4())
        ip = entry.get("ipAddress")
        score = entry.get("abuseConfidenceScore")
        country = entry.get("countryCode")
        last_reported = entry.get("lastReportedAt")

        comment = f"Score: {abuse_score}, Country: {country}, Last reported: {last_reported}"

        misp_event["Attribute"].append({
            "type": "ip-dst",
            "category": "Network activity",
            "to_ids": True,
            "uuid": attr_uuid,
            "distribution": "5",
            "timestamp": str(int(datetime.now().timestamp())),
            "comment": comment,
            "value": ip,
            "disable_correlation": True
        })

    # Save locally (for record keeping)
    with open(output_file, "w") as f:
        json.dump(misp_event, f, indent=4)

    logger.info("Converted data to MISP JSON Format")
    std_print(f"[+] Converted data saved to {output_file}")

    # Upload directly via /events/add
    headers = {
        "Authorization": MISP_CONFIG["MISP_KEY"],
        "Accept": "application/json",
        "Content-Type": "application/json"
    }

    try:
        resp = requests.post(
            f"{MISP_CONFIG['MISP_URL']}/events/add",
            headers=headers,
            data=json.dumps(misp_event),
            verify=MISP_CONFIG["MISP_VERIFYCERT"]
        )
        resp.raise_for_status()  # raises an error for 4xx/5xx responses

        logger.info("Uploaded MISP Event successfully")
        std_print("Successfully uploaded MISP event!")

    except requests.exceptions.RequestException as e:
        logger.error(f"Failed to upload MISP event: {e}", exc_info=True)
        std_print(f"Failed to upload MISP event: {e}")