We are looking at the capability to pull specific MISP feeds via the ArcSight MISP Connector - e.g. https://xx.xx.xx.xx/feed1. the support for this is 02016916.
However we are unable to do so at present. Since the MISP URL is only able to accept the Fully qualified domain name or the IP address of the MISP instance.
Request you to please let us know work around this or by when the feature will be available.