mispex v0.1.7 MISP.Attribute View Source
An Attribute, usually attached to an event
Common usage would be:
16
|> MISP.Event.get()
|> Map.get(:Attribute)
|> List.first()
|> MISP.Attribute.delete()
Link to this section Summary
Functions
Add a tag to an attribute
Create an attribute on an event
Get the object structure for decoding from JSON
Delete an attribute
Remove a tag from an attribute
Search for attributes
Update an attribute with new values
Link to this section Types
Link to this type
t()
View Source
t()
View Source
t() :: %MISP.Attribute{
ShadowAttribute: [MISP.Attribute.t()],
SharingGroup: MISP.SharingGroup.t() | nil,
Tag: [MISP.Tag.t()],
category: String.t() | nil,
comment: String.t() | nil,
data: String.t() | nil,
deleted: boolean() | nil,
disable_correlation: boolean() | nil,
distribution: String.t() | nil,
event_id: String.t() | nil,
id: String.t() | nil,
sharing_group_id: String.t() | nil,
timestamp: String.t() | nil,
to_ids: boolean() | nil,
type: String.t() | nil,
uuid: String.t() | nil,
value: String.t() | nil
}
t() :: %MISP.Attribute{ ShadowAttribute: [MISP.Attribute.t()], SharingGroup: MISP.SharingGroup.t() | nil, Tag: [MISP.Tag.t()], category: String.t() | nil, comment: String.t() | nil, data: String.t() | nil, deleted: boolean() | nil, disable_correlation: boolean() | nil, distribution: String.t() | nil, event_id: String.t() | nil, id: String.t() | nil, sharing_group_id: String.t() | nil, timestamp: String.t() | nil, to_ids: boolean() | nil, type: String.t() | nil, uuid: String.t() | nil, value: String.t() | nil }
Link to this section Functions
Link to this function
add_tag(attribute, tag) View Source
Add a tag to an attribute
iex> MISP.Attribute.add_tag(%MISP.Attribute{}, %MISP.Tag{name: "my tag"})
{:ok, %MISP.Attribute{
Tag: [
%MISP.Tag{
colour: "#15c551",
exportable: true,
hide_tag: false,
id: "5",
name: "my tag"
}
]
}}
Link to this function
create(event, attribute) View Source
Create an attribute on an event
iex> event = %MISP.Event{%MISP.EventInfo{id: 1}}
iex> MISP.Attribute.Create(event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
{:ok,
%MISP.Attribute{
value: "8.8.8.8",
type: "ip-dst",
uuid: "...."
}
}
Link to this function
decoder() View Source
Link to this function
decoder(stop_recursion) View Source
Get the object structure for decoding from JSON
Link to this function
delete(attribute) View Source
Delete an attribute
iex> MISP.Attribute.search(%{value: "1.1.1.1"}) |> List.first |> MISP.Attribute.delete
%{
"message" => "1 attribute deleted.",
"name" => "1 attribute deleted.",
"url" => "/attributes/deleteSelected/17"
}
Link to this function
delete(struct, key) View Source
Link to this function
get(struct, key, default \\ nil) View Source
Link to this function
put(struct, key, val) View Source
Link to this function
remove_tag(attribute, tag) View Source
Remove a tag from an attribute
iex> my_attribute = %MISP.Attribute{Tag: [%MISP.Tag{name: "my tag"}]}
iex> MISP.Attribute.remove_tag(my_attribute, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
Tag: [],
}
Link to this function
search(params) View Source
Search for attributes
Will set a default limit of 100 unless overridden via the limit parameter
iex> MISP.Attribute.search(%{value: "1.1.1.1"})
{:ok, [
%MISP.Attribute{
type: "ip-dst",
value: "1.1.1.1"
}
]}
Link to this function
update(attribute) View Source
Update an attribute with new values
MISP.Attribute.search(%{value: "1.1.1.1"})
|> List.first()
|> Map.put(:value, "2.2.2.2")
|> MISP.Attribute.update()