mispex v0.1.7 MISP.Attribute View Source

An Attribute, usually attached to an event

Common usage would be:

16
|> MISP.Event.get()
|> Map.get(:Attribute)
|> List.first()
|> MISP.Attribute.delete()

Link to this section Summary

Functions

Add a tag to an attribute

Create an attribute on an event

Get the object structure for decoding from JSON

Delete an attribute

Remove a tag from an attribute

Search for attributes

Update an attribute with new values

Link to this section Types

Link to this type

t() View Source
t() :: %MISP.Attribute{
  ShadowAttribute: [MISP.Attribute.t()],
  SharingGroup: MISP.SharingGroup.t() | nil,
  Tag: [MISP.Tag.t()],
  category: String.t() | nil,
  comment: String.t() | nil,
  data: String.t() | nil,
  deleted: boolean() | nil,
  disable_correlation: boolean() | nil,
  distribution: String.t() | nil,
  event_id: String.t() | nil,
  id: String.t() | nil,
  sharing_group_id: String.t() | nil,
  timestamp: String.t() | nil,
  to_ids: boolean() | nil,
  type: String.t() | nil,
  uuid: String.t() | nil,
  value: String.t() | nil
}

Link to this section Functions

Add a tag to an attribute

iex> MISP.Attribute.add_tag(%MISP.Attribute{}, %MISP.Tag{name: "my tag"})
{:ok, %MISP.Attribute{
  Tag: [
    %MISP.Tag{
      colour: "#15c551",
      exportable: true,
      hide_tag: false,
      id: "5",
      name: "my tag"
    }
  ]
}}
Link to this function

create(event, attribute) View Source

Create an attribute on an event

iex> event = %MISP.Event{%MISP.EventInfo{id: 1}}
iex> MISP.Attribute.Create(event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
{:ok,
 %MISP.Attribute{
    value: "8.8.8.8",
    type: "ip-dst",
    uuid: "...."
 }
}

Get the object structure for decoding from JSON

Delete an attribute

iex> MISP.Attribute.search(%{value: "1.1.1.1"}) |> List.first |> MISP.Attribute.delete
%{
  "message" => "1 attribute deleted.",
  "name" => "1 attribute deleted.",
  "url" => "/attributes/deleteSelected/17"
}
Link to this function

get(struct, key, default \\ nil) View Source

Link to this function

remove_tag(attribute, tag) View Source

Remove a tag from an attribute

iex> my_attribute = %MISP.Attribute{Tag: [%MISP.Tag{name: "my tag"}]}
iex> MISP.Attribute.remove_tag(my_attribute, %MISP.Tag{name: "my tag"})
%MISP.Attribute{
  Tag: [],
}

Search for attributes

Will set a default limit of 100 unless overridden via the limit parameter

iex> MISP.Attribute.search(%{value: "1.1.1.1"})
{:ok, [
  %MISP.Attribute{
    type: "ip-dst",
    value: "1.1.1.1"
  }
]}

Update an attribute with new values

MISP.Attribute.search(%{value: "1.1.1.1"})
|> List.first()
|> Map.put(:value, "2.2.2.2")
|> MISP.Attribute.update()