mispex v0.1.4 MISP.Event View Source
Represents an event within MISP
Common usage:
iex> %MISP.EventInfo{info: "hello world!"} |> MISP.Event.create() |> MISP.Event.delete()
Link to this section Summary
Functions
Create a new attribute and add it to our event object
Add a tag to an event
Create a new event. Mandatory fields: info Can be given either an Event or an EventInfo object
Delete an event
Search for events
Update an event Will update the event's timestamp and push the result
To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases
Link to this section Types
t()
View Source
t() :: %MISP.Event{Event: MISP.EventInfo.t()}
t() :: %MISP.Event{Event: MISP.EventInfo.t()}
Link to this section Functions
add_attribute(event, attribute) View Source
Create a new attribute and add it to our event object
iex> event = %MISP.Event{}
iex> attribute = %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}
iex> event |> MISP.Event.add_attribute(attribute)
%MISP.Event{
%MISP.EventInfo{
Attribute: [
%MISP.Attribute{
value: "8.8.8.8",
type: "ip-dst"
}
]
}
}
Can also accept lists of attributes for bulk additions
iex> attrs = [%MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}, %MISP.Attribute{value: "8.8.8.8", type: "ip-src"}]
iex> MISP.Event.get(100) |> MISP.Event.add_attribute(attrs)
add_tag(event, tag) View Source
Add a tag to an event
iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test", colour: "#ff0000"})
%MISP.Event{
Event: %MISP.EventInfo{
Tag: [
%MISP.Tag{
colour: "#ff0000",
exportable: true,
hide_tag: false,
id: "1",
name: "test"
}
]
}
}
This will not save your event immediately (otherwise we end up in timestamp hell if you want to do a load at once), so make sure you call update() once you've added your tags
iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test"}) |> MISP.Event.update()
create(event) View Source
Create a new event. Mandatory fields: info Can be given either an Event or an EventInfo object
iex> MISP.Event.create(%MISP.EventInfo{info: "hello world!"})
%MISP.Event{
Event: %MISP.EventInfo{
date: "2019-02-06",
event_creator_email: "admin@admin.test",
id: "16",
info: "hello world!",
}
}
decoder() View Source
decoder(stop_recursion) View Source
delete(event) View Source
Delete an event
iex> MISP.Event.get(16) |> MISP.Event.delete()
%{
"message" => "Event deleted.",
"name" => "Event deleted.",
"url" => "/events/delete/16"
}
delete(struct, key) View Source
get(id) View Source
get(struct, key, default \\ nil) View Source
put(struct, key, val) View Source
search(params) View Source
Search for events
iex> MISP.Event.search(%{eventinfo: "my event"})
[
%MISP.Event{
Event: %MISP.EventInfo{
info: "my event"
}
}
]
Valid search keys are listed on MISP's documentation, this section may be out of date
page, limit, value, type, category, org, tag, tags, searchall, from, to, last, eventid, withAttachments, metadata, uuid, published, publish_timestamp, timestamp, enforceWarninglist, sgReferenceOnly, eventinfo
update(event) View Source
Update an event Will update the event's timestamp and push the result
iex> MISP.Event.get(16) |> put_in([:Event, :info], "new info!") |> MISP.Event.update()
%MISP.Event{
Event: %MISP.EventInfo{
info: "new info!"
}
}
wrap(event) View Source
To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases
iex> MISP.Event.wrap(%EventInfo{info: "my event"})
%MISP.Event{
Event: %EventInfo{
info: "my event"
}
}