mispex v0.1.6 MISP.Event View Source
An event within MISP
Common usage:
iex> %MISP.EventInfo{info: "hello world!"} |> MISP.Event.create() |> MISP.Event.delete()
Link to this section Summary
Functions
Create a new attribute and add it to our event object
Add a tag to an event
Create a new event
Delete an event
Get a single event with the specified ID
List the metadata for all events currently in MISP. Potentially expensive in memory and time
List the metadata for all events matching some criteria
Search for events
Update an event
To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases
Link to this section Types
t()
View Source
t() :: %MISP.Event{Event: MISP.EventInfo.t()}
t() :: %MISP.Event{Event: MISP.EventInfo.t()}
Link to this section Functions
add_attribute(event, attribute) View Source
Create a new attribute and add it to our event object
iex> event = %MISP.Event{}
iex> attribute = %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}
iex> event |> MISP.Event.add_attribute(attribute)
%MISP.Event{
%MISP.EventInfo{
Attribute: [
%MISP.Attribute{
value: "8.8.8.8",
type: "ip-dst"
}
]
}
}
Can also accept lists of attributes for bulk additions
iex> attrs = [%MISP.Attribute{value: "8.8.8.8", type: "ip-dst"}, %MISP.Attribute{value: "8.8.8.8", type: "ip-src"}]
iex> MISP.Event.get(100) |> MISP.Event.add_attribute(attrs)
add_tag(event, tag) View Source
Add a tag to an event
iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test", colour: "#ff0000"})
%MISP.Event{
Event: %MISP.EventInfo{
Tag: [
%MISP.Tag{
colour: "#ff0000",
exportable: true,
hide_tag: false,
id: "1",
name: "test"
}
]
}
}
This will not save your event immediately (otherwise we end up in timestamp hell if you want to do a load at once), so make sure you call update() once you've added your tags
iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test"}) |> MISP.Event.update()
create(event) View Source
Create a new event.
Wrapping a MISP.EventInfo struct in a MISP.Event struct isn't required
iex> MISP.Event.create(%MISP.EventInfo{info: "hello world!"})
%MISP.Event{
Event: %MISP.EventInfo{
date: "2019-02-06",
event_creator_email: "admin@admin.test",
id: "16",
info: "hello world!",
}
}
decoder() View Source
decoder(stop_recursion) View Source
delete(event) View Source
Delete an event
iex> MISP.Event.get(16) |> MISP.Event.delete()
%{
"message" => "Event deleted.",
"name" => "Event deleted.",
"url" => "/events/delete/16"
}
delete(struct, key) View Source
get(id) View Source
Get a single event with the specified ID
iex> MISP.Event.get(76)
%MISP.Event{
Event: %MISP.EventInfo{
id: "76"
}
}
get(struct, key, default \\ nil) View Source
list() View Source
List the metadata for all events currently in MISP. Potentially expensive in memory and time.
I advise using MISP.Event.list/1 where you can, to not return literally everything
iex> MISP.Event.list()
[
%MISP.Event{
Event: %MISP.EventInfo{}
}
]
list(params) View Source
List the metadata for all events matching some criteria
At the time of writing, valid parameters are as follows
all, attribute, published, eventid, datefrom, dateuntil, org, eventinfo, tag, tags, distribution, sharinggroup, analysis, threatlevel, email, hasproposal, timestamp, publishtimestamp, publish_timestamp, minimal
iex> MISP.Event.list(%{eventid: 67})
[
%MISP.Event{
Event: %MISP.EventInfo{
id: "67"
}
}
]
put(struct, key, val) View Source
search(params) View Source
Search for events
Sets a default limit of 100
iex> MISP.Event.search(%{eventinfo: "my event"})
[
%MISP.Event{
Event: %MISP.EventInfo{
info: "my event"
}
}
]
Valid search keys are listed on MISP's documentation, this section may be out of date
page, limit, value, type, category, org, tag, tags, searchall, from, to, last, eventid, withAttachments, metadata, uuid, published, publish_timestamp, timestamp, enforceWarninglist, sgReferenceOnly, eventinfo
update(event) View Source
Update an event
iex> MISP.Event.get(16) |> put_in([:Event, :info], "new info!") |> MISP.Event.update()
%MISP.Event{
Event: %MISP.EventInfo{
info: "new info!"
}
}
wrap(event) View Source
To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases
iex> MISP.Event.wrap(%EventInfo{info: "my event"})
%MISP.Event{
Event: %EventInfo{
info: "my event"
}
}