mispex v0.1.5 MISP.Event View Source

An event within MISP

Common usage:

iex> %MISP.EventInfo{info: "hello world!"} |> MISP.Event.create() |> MISP.Event.delete()

Link to this section Summary

Functions

Create a new attribute and add it to our event object

Add a tag to an event

Create a new event

Delete an event

Get a single event with the specified ID

List the metadata for all events currently in MISP. Potentially expensive in memory and time

List the metadata for all events matching some criteria

Search for events

Update an event

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

Link to this section Types

Link to this type

t() View Source
t() :: %MISP.Event{Event: MISP.EventInfo.t()}

Link to this section Functions

Link to this function

add_attribute(event, attribute) View Source

Create a new attribute and add it to our event object

iex> event = %MISP.Event{}
iex> attribute = %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}
iex> event |> MISP.Event.add_attribute(attribute)
%MISP.Event{
    %MISP.EventInfo{
        Attribute: [
            %MISP.Attribute{
                value: "8.8.8.8",
                type: "ip-dst"
            }
        ]
    }
}

Can also accept lists of attributes for bulk additions

iex> attrs = [%MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}, %MISP.Attribute{value: "8.8.8.8", type: "ip-src"}]
iex> MISP.Event.get(100) |> MISP.Event.add_attribute(attrs)

Add a tag to an event

iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test", colour: "#ff0000"})
%MISP.Event{
  Event: %MISP.EventInfo{
    Tag: [
      %MISP.Tag{
        colour: "#ff0000",
        exportable: true,
        hide_tag: false,
        id: "1",
        name: "test"
      }
    ]
  }
}

This will not save your event immediately (otherwise we end up in timestamp hell if you want to do a load at once), so make sure you call update() once you've added your tags

iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test"}) |> MISP.Event.update()

Create a new event.

Wrapping a MISP.EventInfo struct in a MISP.Event struct isn't required

iex> MISP.Event.create(%MISP.EventInfo{info: "hello world!"})
%MISP.Event{
    Event: %MISP.EventInfo{
        date: "2019-02-06",
        event_creator_email: "admin@admin.test",
        id: "16",
        info: "hello world!",
    }
}

Delete an event

iex> MISP.Event.get(16) |> MISP.Event.delete()
%{
    "message" => "Event deleted.",
    "name" => "Event deleted.",
    "url" => "/events/delete/16"
}

Get a single event with the specified ID

iex>  MISP.Event.get(76)
%MISP.Event{
  Event: %MISP.EventInfo{
    id: "76"
  }
}
Link to this function

get(struct, key, default \\ nil) View Source

List the metadata for all events currently in MISP. Potentially expensive in memory and time.

I advise using MISP.Event.list/1 where you can, to not return literally everything

iex> MISP.Event.list()
[
  %MISP.Event{
    Event: %MISP.EventInfo{}
  }
]

List the metadata for all events matching some criteria

At the time of writing, valid parameters are as follows

all, attribute, published, eventid, datefrom, dateuntil, org, eventinfo, tag, tags, distribution, sharinggroup, analysis, threatlevel, email, hasproposal, timestamp, publishtimestamp, publish_timestamp, minimal

iex> MISP.Event.list(%{eventid: 67})
[
  %MISP.Event{
    Event: %MISP.EventInfo{
      id: "67"
    }
  }
]

Search for events

iex> MISP.Event.search(%{eventinfo: "my event"})
[
  %MISP.Event{
    Event: %MISP.EventInfo{
      info: "my event"
    }
  }
]

Valid search keys are listed on MISP's documentation, this section may be out of date

page, limit, value, type, category, org, tag, tags, searchall, from, to, last, eventid, withAttachments, metadata, uuid, published, publish_timestamp, timestamp, enforceWarninglist, sgReferenceOnly, eventinfo

Update an event

iex> MISP.Event.get(16) |> put_in([:Event, :info], "new info!") |> MISP.Event.update()
%MISP.Event{
  Event: %MISP.EventInfo{
    info: "new info!"
  }
}

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

iex> MISP.Event.wrap(%EventInfo{info: "my event"})
%MISP.Event{
  Event: %EventInfo{
      info: "my event"
  }
}