diff --git a/pymisp/api.py b/pymisp/api.py index e85e9de..cb0179b 100644 --- a/pymisp/api.py +++ b/pymisp/api.py @@ -365,15 +365,24 @@ class PyMISP(object): misp_event = self._prepare_full_event(distribution, threat_level_id, analysis, info, date, published, orgc_id, org_id, sharing_group_id) return self.add_event(json.dumps(misp_event, cls=EncodeUpdate)) - def add_tag(self, event, tag): + def add_tag(self, event, tag, attribute=False): + # FIXME: this is dirty, this function needs to be deprecated with something tagging a UUID session = self.__prepare_session() - to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}} + if attribute: + to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}} + else: + to_post = {'request': {'Event': {'id': event['id'], 'tag': tag}}} response = session.post(urljoin(self.root_url, 'events/addTag'), data=json.dumps(to_post)) return self._check_response(response) - def remove_tag(self, event, tag): + def remove_tag(self, event, tag, attribute=False): + # FIXME: this is dirty, this function needs to be deprecated with something removing the tag to a UUID session = self.__prepare_session() - to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}} + if attribute: + to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}} + pass + else: + to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}} response = session.post(urljoin(self.root_url, 'events/removeTag'), data=json.dumps(to_post)) return self._check_response(response) diff --git a/pymisp/mispevent.py b/pymisp/mispevent.py index 66c172a..e8c2d6c 100644 --- a/pymisp/mispevent.py +++ b/pymisp/mispevent.py @@ -79,6 +79,7 @@ class MISPAttribute(object): self.ShadowAttribute = [] self.disable_correlation = False self.RelatedAttribute = [] + self.Tag = [] def _serialize(self): return '{type}{category}{to_ids}{uuid}{timestamp}{comment}{deleted}{value}'.format( @@ -172,6 +173,8 @@ class MISPAttribute(object): self.ShadowAttribute = kwargs['ShadowAttribute'] if kwargs.get('sig'): self.sig = kwargs['sig'] + if kwargs.get('Tag'): + self.Tag = kwargs['Tag'] # If the user wants to disable correlation, let them. Defaults to False. self.disable_correlation = kwargs.get("disable_correlation", False) @@ -215,6 +218,8 @@ class MISPAttribute(object): to_return['sig'] = self.sig if self.sharing_group_id: to_return['sharing_group_id'] = self.sharing_group_id + if self.Tag: + to_return['Event']['Tag'] = self.Tag if self.data: to_return['data'] = base64.b64encode(self.data.getvalue()).decode() if self.encrypt: