mispex v0.1.7 MISP.Event View Source

An event within MISP

Common usage:

iex> %MISP.EventInfo{info: "hello world!"} |> MISP.Event.create() |> MISP.Event.delete()

Link to this section Summary

Functions

Append attributes to our list. Requires an update or create call afterwards

Add a tag to an event

Create a new event

Delete an event

Get a single event with the specified ID

List the metadata for all events currently in MISP. Potentially expensive in memory and time

List the metadata for all events matching some criteria

Search for events

Update an event

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

Link to this section Types

Link to this type

t() View Source
t() :: %MISP.Event{Event: MISP.EventInfo.t()}

Link to this section Functions

Link to this function

add_attribute(event_info, attribute) View Source

Append attributes to our list. Requires an update or create call afterwards.

Will append the specified attribute to your event struct and return the result.

To add it to a new event struct:

iex> my_event = %MISP.EventInfo{info: "hello world!"}
iex> my_event_with_attr = MISP.Event.add_attribute(my_event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
%MISP.EventInfo{
  Attribute: [
    %MISP.Attribute{
      value: "8.8.8.8", type: "ip-dst"
    }
  ]
}
iex> {:ok, my_event_with_attr} = MISP.Event.create(my_event)

To add a new attribute to an existing event:

iex> {:ok, my_event} = MISP.Event.get(24)
iex> my_event_with_attr = MISP.Event.add_attribute(my_event, %MISP.Attribute{value: "8.8.8.8", type: "ip-dst"})
iex> {:ok, my_event_with_attr} = MISP.Event.update(my_event)      
Link to this function

add_tag(event_info, tag) View Source

Add a tag to an event

iex> MISP.Event.get(24) |> MISP.Event.add_tag(%MISP.Tag{name: "test", colour: "#ff0000"})
%MISP.Event{
  Event: %MISP.EventInfo{
    Tag: [
      %MISP.Tag{
        colour: "#ff0000",
        exportable: true,
        hide_tag: false,
        id: "1",
        name: "test"
      }
    ]
  }
}

This will not save your event immediately (otherwise we end up in timestamp hell if you want to do a load at once), so make sure you call update() once you've added your tags

iex> {:ok, my_event} = MISP.Event.get(24)
iex> tagged = MISP.Event.add_tag(my_event, %MISP.Tag{name: "test"})
iex> {:ok, updated_event} = MISP.Event.update(tagged)

Create a new event.

Wrapping a MISP.EventInfo struct in a MISP.Event struct isn't required

iex> MISP.Event.create(%MISP.EventInfo{info: "hello world!"})
%MISP.Event{
    Event: %MISP.EventInfo{
        date: "2019-02-06",
        event_creator_email: "admin@admin.test",
        id: "16",
        info: "hello world!",
    }
}

Delete an event

iex> MISP.Event.get(16) |> MISP.Event.delete()
%{
    "message" => "Event deleted.",
    "name" => "Event deleted.",
    "url" => "/events/delete/16"
}

Get a single event with the specified ID

iex>  MISP.Event.get(76)
{:ok, 
 %MISP.Event{
   Event: %MISP.EventInfo{
     id: "76"
   }
 }
}
Link to this function

get(struct, key, default \\ nil) View Source

List the metadata for all events currently in MISP. Potentially expensive in memory and time.

I advise using MISP.Event.list/1 where you can, to not return literally everything

iex> MISP.Event.list()
[
  %MISP.Event{
    Event: %MISP.EventInfo{}
  }
]

List the metadata for all events matching some criteria

At the time of writing, valid parameters are as follows

all, attribute, published, eventid, datefrom, dateuntil, org, eventinfo, tag, tags, distribution, sharinggroup, analysis, threatlevel, email, hasproposal, timestamp, publishtimestamp, publish_timestamp, minimal

iex> MISP.Event.list(%{eventid: 67})
[
  %MISP.Event{
    Event: %MISP.EventInfo{
      id: "67"
    }
  }
]

Search for events

Sets a default limit of 100

iex> MISP.Event.search(%{eventinfo: "my event"})
{:ok, [
  %MISP.Event{
    Event: %MISP.EventInfo{
      info: "my event"
    }
  }
]}

Valid search keys are listed on MISP's documentation, this section may be out of date

page, limit, value, type, category, org, tag, tags, searchall, from, to, last, eventid, withAttachments, metadata, uuid, published, publish_timestamp, timestamp, enforceWarninglist, sgReferenceOnly, eventinfo

Update an event

iex> MISP.Event.get(16) |> put_in([:Event, :info], "new info!") |> MISP.Event.update()
%MISP.Event{
  Event: %MISP.EventInfo{
    info: "new info!"
  }
}

To allow for easier interaction with the API, wrapping EventInfo objects in Event objects can be avoided in some cases

iex> MISP.Event.wrap(%EventInfo{info: "my event"})
%MISP.Event{
  Event: %EventInfo{
      info: "my event"
  }
}