new: [transform] from (hash)tag to MISP event works now

pull/40/head
Christophe Vandeplas 2020-04-01 20:38:43 +02:00
parent 4ba072958c
commit 8512268542
1 changed files with 9 additions and 0 deletions

View File

@ -103,6 +103,15 @@ class AttributeToEvent(Transform):
return response return response
else: else:
return response return response
# from Hashtag
elif 'properties.temp' in request.entity.fields:
tag_name = get_entity_property(request.entity, 'Temp')
if not tag_name:
tag_name = request.entity.value
events_json = misp.search(controller='events', tags=tag_name, with_attachments=False)
for e in events_json:
response += event_to_entity(e, link_direction=LinkDirection.OutputToInput)
return response
# standard Entities (normal attributes) # standard Entities (normal attributes)
else: else:
events_json = misp.search(controller='events', value=request.entity.value, with_attachments=False) events_json = misp.search(controller='events', value=request.entity.value, with_attachments=False)