Add support for attribute level tagging

pymisp/api.py

@@ -365,15 +365,24 @@ class PyMISP(object):
         misp_event = self._prepare_full_event(distribution, threat_level_id, analysis, info, date, published, orgc_id, org_id, sharing_group_id)
         return self.add_event(json.dumps(misp_event, cls=EncodeUpdate))
 
-    def add_tag(self, event, tag):
+    def add_tag(self, event, tag, attribute=False):
+        # FIXME: this is dirty, this function needs to be deprecated with something tagging a UUID
         session = self.__prepare_session()
-        to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
+        if attribute:
+            to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}}
+        else:
+            to_post = {'request': {'Event': {'id': event['id'], 'tag': tag}}}
         response = session.post(urljoin(self.root_url, 'events/addTag'), data=json.dumps(to_post))
         return self._check_response(response)
 
-    def remove_tag(self, event, tag):
+    def remove_tag(self, event, tag, attribute=False):
+        # FIXME: this is dirty, this function needs to be deprecated with something removing the tag to a UUID
         session = self.__prepare_session()
-        to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
+        if attribute:
+            to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}}
+            pass
+        else:
+            to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
         response = session.post(urljoin(self.root_url, 'events/removeTag'), data=json.dumps(to_post))
         return self._check_response(response)
 

pymisp/mispevent.py

@@ -79,6 +79,7 @@ class MISPAttribute(object):
         self.ShadowAttribute = []
         self.disable_correlation = False
         self.RelatedAttribute = []
+        self.Tag = []
 
     def _serialize(self):
         return '{type}{category}{to_ids}{uuid}{timestamp}{comment}{deleted}{value}'.format(
@@ -172,6 +173,8 @@ class MISPAttribute(object):
             self.ShadowAttribute = kwargs['ShadowAttribute']
         if kwargs.get('sig'):
             self.sig = kwargs['sig']
+        if kwargs.get('Tag'):
+            self.Tag = kwargs['Tag']
 
         # If the user wants to disable correlation, let them. Defaults to False.
         self.disable_correlation = kwargs.get("disable_correlation", False)
@@ -215,6 +218,8 @@ class MISPAttribute(object):
             to_return['sig'] = self.sig
         if self.sharing_group_id:
             to_return['sharing_group_id'] = self.sharing_group_id
+        if self.Tag:
+            to_return['Event']['Tag'] = self.Tag
         if self.data:
             to_return['data'] = base64.b64encode(self.data.getvalue()).decode()
             if self.encrypt: