mispex v0.1.4 MISP.Event View Source

Represents an event within MISP

Common usage:

iex> %MISP.EventInfo{info: "hello world!"} |> MISP.Event.create() |> MISP.Event.delete()

Link to this section Summary

Functions

Create a new attribute and add it to our event object

Add a tag to an event

Create a new event. Mandatory fields: info Can be given either an Event or an EventInfo object

Delete an event

Search for events

Update an event Will update the event's timestamp and push the result

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

Link to this section Types

Link to this type

t() View Source
t() :: %MISP.Event{Event: MISP.EventInfo.t()}

Link to this section Functions

Link to this function

add_attribute(event, attribute) View Source

Create a new attribute and add it to our event object

iex> event = %MISP.Event{}
iex> attribute = %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}
iex> event |> MISP.Event.add_attribute(attribute)
%MISP.Event{
    %MISP.EventInfo{
        Attribute: [
            %MISP.Attribute{
                value: "8.8.8.8",
                type: "ip-dst"
            }
        ]
    }
}

Can also accept lists of attributes for bulk additions

iex> attrs = [%MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}, %MISP.Attribute{value: "8.8.8.8", type: "ip-src"}]
iex> MISP.Event.get(100) |> MISP.Event.add_attribute(attrs)

Add a tag to an event

iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test", colour: "#ff0000"})
%MISP.Event{
  Event: %MISP.EventInfo{
    Tag: [
      %MISP.Tag{
        colour: "#ff0000",
        exportable: true,
        hide_tag: false,
        id: "1",
        name: "test"
      }
    ]
  }
}

This will not save your event immediately (otherwise we end up in timestamp hell if you want to do a load at once), so make sure you call update() once you've added your tags

iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test"}) |> MISP.Event.update()

Create a new event. Mandatory fields: info Can be given either an Event or an EventInfo object

iex> MISP.Event.create(%MISP.EventInfo{info: "hello world!"})
%MISP.Event{
    Event: %MISP.EventInfo{
        date: "2019-02-06",
        event_creator_email: "admin@admin.test",
        id: "16",
        info: "hello world!",
    }
}

Delete an event

iex> MISP.Event.get(16) |> MISP.Event.delete()
%{
    "message" => "Event deleted.",
    "name" => "Event deleted.",
    "url" => "/events/delete/16"
}
Link to this function

get(struct, key, default \\ nil) View Source

Search for events

iex> MISP.Event.search(%{eventinfo: "my event"})
[
  %MISP.Event{
    Event: %MISP.EventInfo{
      info: "my event"
    }
  }
]

Valid search keys are listed on MISP's documentation, this section may be out of date

page, limit, value, type, category, org, tag, tags, searchall, from, to, last, eventid, withAttachments, metadata, uuid, published, publish_timestamp, timestamp, enforceWarninglist, sgReferenceOnly, eventinfo

Update an event Will update the event's timestamp and push the result

iex> MISP.Event.get(16) |> put_in([:Event, :info], "new info!") |> MISP.Event.update()
%MISP.Event{
  Event: %MISP.EventInfo{
    info: "new info!"
  }
}

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

iex> MISP.Event.wrap(%EventInfo{info: "my event"})
%MISP.Event{
  Event: %EventInfo{
      info: "my event"
  }
}