mispex v0.1.0 MISP View Source

An elixir binding for MISP's API

Link to this section Summary

Functions

Create a new attribute

Create a new event

Get an event object from MISP. Can take either an event ID or an event object (mainly useful for piping events through multiple attribute creation steps)

Interact with restSearch endpoints

Link to this section Functions

Link to this function

create_attribute(event, params) View Source

Create a new attribute

iex> event_id = 955
iex> MISP.create_attribute(event_id, %{"type" =>" ip-dst", "value" => "8.8.8.8"})
%{
  "Event" => %{
    "Attribute" => [
      %{
        "type" => "ip-dst",
        "value" => "8.8.8.8"
      }
    ]
  }
}

Can also be piped with create_event

iex> MISP.create_event(%{"info" => "my event"})
     |> MISP.create_attribute(%{"type" =>" ip-dst", "value" => "8.8.8.8"})

Create a new event

Mandatory arguments: info

iex> MISP.create_event(%{"info" => "my event"})
%{            
  "Event" => %{
    "info" => "my event"
  }           
}

Get an event object from MISP. Can take either an event ID or an event object (mainly useful for piping events through multiple attribute creation steps)

iex> MISP.get_event(955)
%{
  "Event" => %{
  }
}

Interact with restSearch endpoints

iex> MISP.search("attributes", %{"value" => "8.8.8.8", "type" => "ip-dst"})
[
  %{
    "Event" => %{
    },
    "category" => "Network activity",
    "event_id" => "someId",
    "type" => "ip-dst",
    "value" => "8.8.8.8"
  },
]

iex> MISP.search("events", %{"eventid" => "12345"})
[
  %{
    "Event" => %{
    }
  }
]