[ 'returnFormat', 'value', 'value1', 'value2', 'type', 'category', 'org', 'tags', 'from', 'to', 'last', 'eventid', 'withAttachments', 'uuid', 'publish_timestamp', 'published', 'timestamp', 'enforceWarninglist', 'to_ids', 'deleted', 'includeEventUuid', 'event_timestamp', 'threat_level_id', 'includeEventTags', 'includeProposals', 'limit', 'page', 'requested_attributes', 'includeContext', 'headerless', 'includeWarninglistHits', 'attackGalaxy', 'object_relation', 'includeSightings', 'includeCorrelations', 'includeDecayScore', 'decayingModel', 'excludeDecayed', 'modelOverrides', 'includeFullModel', 'score', 'attribute_timestamp', 'first_seen', 'last_seen', 'eventinfo', 'sharinggroup', 'allow_proposal_blocking', 'flatten', 'list', 'event_ids', 'includeAllTags', 'includeAttributeUuid', 'includeGalaxy', 'order', 'policy', 'walled_garden', 'ns', 'email', 'serial', 'refresh', 'retry', 'expiry', 'minimum_ttl', 'ttl' ], 'Event' => [ 'returnFormat', 'value', 'type', 'category', 'org', 'tags', 'searchall', 'from', 'to', 'last', 'eventid', 'withAttachments', 'metadata', 'uuid', 'publish_timestamp', 'timestamp', 'event_timestamp', // redundant, but kept for backwards compatibility 'event_tags', 'published', 'enforceWarninglist', 'sgReferenceOnly', 'limit', 'page', 'requested_attributes', 'includeContext', 'headerless', 'includeWarninglistHits', 'attackGalaxy', 'to_ids', 'deleted', 'excludeLocalTags', 'date', 'includeSightingdb', 'tag', 'object_relation', 'threat_level_id', 'eventinfo', 'sharinggroup', 'idList', 'includeAllTags', 'includeAttachments', 'event_uuid', 'distribution', 'sharing_group_id', 'disableSiteAdmin', 'flatten', 'blockedAttributeTags', 'eventsExtendingUuid', 'extended', 'extensionList', 'excludeGalaxy', 'includeAnalystData', 'includeRelatedTags', 'includeDecayScore', 'includeScoresOnEvent', 'includeFeedCorrelations', 'includeServerCorrelations', 'noEventReports', 'noShadowAttributes', 'order', 'protected', 'includeGranularCorrelations', 'policy', 'walled_garden', 'ns', 'email', 'serial', 'refresh', 'retry', 'expiry', 'minimum_ttl', 'ttl', 'org.sector', 'org.local', 'org.nationality', 'galaxy.*', ], 'Object' => [ 'returnFormat', 'value', 'type', 'category', 'org', 'tags', 'first_seen', 'last_seen', 'from', 'to', 'last', 'eventid', 'withAttachments', 'uuid', 'publish_timestamp', 'published', 'timestamp', 'enforceWarninglist', 'to_ids', 'deleted', 'includeEventUuid', 'event_timestamp', 'threat_level_id', 'includeEventTags', 'includeProposals', 'limit', 'page', 'requested_attributes', 'includeContext', 'headerless', 'includeWarninglistHits', 'attackGalaxy', 'object_relation', 'metadata', 'includeAllTags', 'object_name', 'object_template_uuid', 'object_template_version' ], 'Sighting' => [ 'context', 'returnFormat', 'id', 'uuid', 'type', 'from', 'to', 'last', 'org_id', 'source', 'includeAttribute', 'includeEvent', 'includeUuid', ], 'GalaxyCluster' => [ 'page', 'limit', 'id', 'uuid', 'galaxy_id', 'galaxy_uuid', 'version', 'distribution', 'org', 'orgc', 'tag_name', 'custom', 'sgReferenceOnly', 'minimal', 'list', 'first', 'count', 'order' ], ); public function getFilename($filters, $scope, $responseType) { $filename = false; if ($scope === 'Event') { $filename = 'misp.event.'; if (!empty($filters['eventid']) && !is_array($filters['eventid'])) { if (Validation::uuid(trim($filters['eventid']))) { $filename .= trim($filters['eventid']); } else if (!empty(intval(trim($filters['eventid'])))) { $filename .= intval(trim($filters['eventid'])); } } else { $filename .= 'list'; } } if ($filename !== false) { $filename .= '.' . $responseType; } return $filename; } }