mispex v0.1.4 MISP.Attribute View Source
Represents an Attribute, usually attached to an event
Common usage would be:
iex> MISP.Event.get(16) |> Map.get(:Attribute) |> List.first() |> MISP.Attribute.delete()
Link to this section Summary
Functions
Add a tag to an attribute. This will not save your event immediately, so you can add as many as you'd like and then call MISP.Event.update()
Create an attribute on an event
Get the object structure for decoding from JSON
Delete an attribute
Remove a tag from an attribute
Search for attributes
Update an attribute with new values
Link to this section Types
t()
View Source
t() :: %MISP.Attribute{
ShadowAttribute: [MISP.Attribute.t()],
SharingGroup: MISP.SharingGroup.t() | nil,
Tag: [MISP.Tag.t()],
category: String.t() | nil,
comment: String.t() | nil,
data: String.t() | nil,
deleted: boolean() | nil,
disable_correlation: boolean() | nil,
distribution: String.t() | nil,
event_id: String.t() | nil,
id: String.t() | nil,
sharing_group_id: String.t() | nil,
timestamp: String.t() | nil,
to_ids: boolean() | nil,
type: String.t() | nil,
uuid: String.t() | nil,
value: String.t() | nil
}
t() :: %MISP.Attribute{ ShadowAttribute: [MISP.Attribute.t()], SharingGroup: MISP.SharingGroup.t() | nil, Tag: [MISP.Tag.t()], category: String.t() | nil, comment: String.t() | nil, data: String.t() | nil, deleted: boolean() | nil, disable_correlation: boolean() | nil, distribution: String.t() | nil, event_id: String.t() | nil, id: String.t() | nil, sharing_group_id: String.t() | nil, timestamp: String.t() | nil, to_ids: boolean() | nil, type: String.t() | nil, uuid: String.t() | nil, value: String.t() | nil }
Link to this section Functions
add_tag(attribute, tag) View Source
Add a tag to an attribute. This will not save your event immediately, so you can add as many as you'd like and then call MISP.Event.update()
iex> MISP.Attribute.add_tag(%MISP.Attribute{}, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
Tag: [
%MISP.Tag{
colour: "#15c551",
exportable: true,
hide_tag: false,
id: "5",
name: "my tag"
}
]
}
create(event, attribute) View Source
Create an attribute on an event
iex> event = %MISP.Event{%MISP.EventInfo{id: 1}}
iex> MISP.Attribute.Create(event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
%MISP.Attribute{
value: "8.8.8.8",
type: "ip-dst",
uuid: "...."
}
decoder() View Source
decoder(stop_recursion) View Source
Get the object structure for decoding from JSON
delete(attribute) View Source
Delete an attribute
iex> MISP.Attribute.search(%{value: "1.1.1.1"}) |> List.first |> MISP.Attribute.delete
%{
"message" => "1 attribute deleted.",
"name" => "1 attribute deleted.",
"url" => "/attributes/deleteSelected/17"
}
delete(struct, key) View Source
get(struct, key, default \\ nil) View Source
put(struct, key, val) View Source
remove_tag(attribute, tag) View Source
Remove a tag from an attribute
iex> my_attribute = %MISP.Attribute{Tag: [%MISP.Tag{name: "my tag"}]}
iex> MISP.Attribute.remove_tag(my_attribute, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
Tag: [],
}
search(params) View Source
Search for attributes
iex> MISP.Attribute.search(%{value: "1.1.1.1"})
[
%MISP.Attribute{
type: "ip-dst",
value: "1.1.1.1"
}
]
update(attribute) View Source
Update an attribute with new values
In the case that you try to update an attribute in the same second it was last edited (or created), the process will sleep until we have a timestamp after the last edited time (should be max 1 second), this is to prevent the edited timestamp from being out of sync with the process timestamp
MISP.Attribute.search(%{value: "1.1.1.1"})
|> List.first()
|> Map.put(:value, "2.2.2.2")
|> MISP.Attribute.update()