mispex v0.1.6 MISP.Attribute View Source

An Attribute, usually attached to an event

Common usage would be:

16
|> MISP.Event.get()
|> Map.get(:Attribute)
|> List.first()
|> MISP.Attribute.delete()

Link to this section Summary

Functions

Add a tag to an attribute. This will not save your event immediately, so you can add as many as you'd like and then call MISP.Event.update()

Create an attribute on an event

Get the object structure for decoding from JSON

Delete an attribute

Remove a tag from an attribute

Search for attributes

Update an attribute with new values

Link to this section Types

Link to this type

t() View Source
t() :: %MISP.Attribute{
  ShadowAttribute: [MISP.Attribute.t()],
  SharingGroup: MISP.SharingGroup.t() | nil,
  Tag: [MISP.Tag.t()],
  category: String.t() | nil,
  comment: String.t() | nil,
  data: String.t() | nil,
  deleted: boolean() | nil,
  disable_correlation: boolean() | nil,
  distribution: String.t() | nil,
  event_id: String.t() | nil,
  id: String.t() | nil,
  sharing_group_id: String.t() | nil,
  timestamp: String.t() | nil,
  to_ids: boolean() | nil,
  type: String.t() | nil,
  uuid: String.t() | nil,
  value: String.t() | nil
}

Link to this section Functions

Add a tag to an attribute. This will not save your event immediately, so you can add as many as you'd like and then call MISP.Event.update()

iex> MISP.Attribute.add_tag(%MISP.Attribute{}, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
  Tag: [
    %MISP.Tag{
      colour: "#15c551",
      exportable: true,
      hide_tag: false,
      id: "5",
      name: "my tag"
    }
  ]
}
Link to this function

create(event, attribute) View Source

Create an attribute on an event

iex> event = %MISP.Event{%MISP.EventInfo{id: 1}}
iex> MISP.Attribute.Create(event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
%MISP.Attribute{
    value: "8.8.8.8",
    type: "ip-dst",
    uuid: "...."
}

Get the object structure for decoding from JSON

Delete an attribute

iex> MISP.Attribute.search(%{value: "1.1.1.1"}) |> List.first |> MISP.Attribute.delete
%{
  "message" => "1 attribute deleted.",
  "name" => "1 attribute deleted.",
  "url" => "/attributes/deleteSelected/17"
}
Link to this function

get(struct, key, default \\ nil) View Source

Link to this function

remove_tag(attribute, tag) View Source

Remove a tag from an attribute

iex> my_attribute = %MISP.Attribute{Tag: [%MISP.Tag{name: "my tag"}]}
iex> MISP.Attribute.remove_tag(my_attribute, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
  Tag: [],
}

Search for attributes

Will set a default limit of 100 unless overridden via the limit parameter

iex> MISP.Attribute.search(%{value: "1.1.1.1"})
[
  %MISP.Attribute{
    type: "ip-dst",
    value: "1.1.1.1"
  }
]

Update an attribute with new values

MISP.Attribute.search(%{value: "1.1.1.1"})
|> List.first()
|> Map.put(:value, "2.2.2.2")
|> MISP.Attribute.update()