MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

new: Allow to get just event metadata after add_event and edit_event

pull/651/head
Jakub Onderka 2020-10-30 20:24:52 +01:00
parent 495af1fd9c
commit 5e4dd2b974
2 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pymisp/api.py
View File

@ -316,13 +316,14 @@ class PyMISP:
r = self._prepare_request('HEAD', f'events/view/{event_id}') r = self._prepare_request('HEAD', f'events/view/{event_id}')
return self._check_head_response(r) return self._check_head_response(r)
def add_event(self, event: MISPEvent, pythonify: bool = False) -> Union[Dict, MISPEvent]: def add_event(self, event: MISPEvent, pythonify: bool = False, metadata: bool = False) -> Union[Dict, MISPEvent]:
"""Add a new event on a MISP instance """Add a new event on a MISP instance
:param event: event to add :param event: event to add
:param pythonify: Returns a PyMISP Object instead of the plain json output :param pythonify: Returns a PyMISP Object instead of the plain json output
:param metadata: Return just event metadata after successful creating
""" """
r = self._prepare_request('POST', 'events/add', data=event) r = self._prepare_request('POST', 'events/add' + '/metadata:1' if metadata else '', data=event)
new_event = self._check_json_response(r) new_event = self._check_json_response(r)
if not (self.global_pythonify or pythonify) or 'errors' in new_event: if not (self.global_pythonify or pythonify) or 'errors' in new_event:
return new_event return new_event
@ -330,18 +331,20 @@ class PyMISP:
e.load(new_event) e.load(new_event)
return e return e
def update_event(self, event: MISPEvent, event_id: Optional[int] = None, pythonify: bool = False) -> Union[Dict, MISPEvent]: def update_event(self, event: MISPEvent, event_id: Optional[int] = None, pythonify: bool = False,
metadata: bool = False) -> Union[Dict, MISPEvent]:
"""Update an event on a MISP instance''' """Update an event on a MISP instance'''
:param event: event to update :param event: event to update
:param event_id: ID of event to update :param event_id: ID of event to update
:param pythonify: Returns a PyMISP Object instead of the plain json output :param pythonify: Returns a PyMISP Object instead of the plain json output
:param metadata: Return just event metadata after successful update
""" """
if event_id is None: if event_id is None:
eid = get_uuid_or_id_from_abstract_misp(event) eid = get_uuid_or_id_from_abstract_misp(event)
else: else:
eid = get_uuid_or_id_from_abstract_misp(event_id) eid = get_uuid_or_id_from_abstract_misp(event_id)
r = self._prepare_request('POST', f'events/edit/{eid}', data=event) r = self._prepare_request('POST', f'events/edit/{eid}' + '/metadata:1' if metadata else '', data=event)
updated_event = self._check_json_response(r) updated_event = self._check_json_response(r)
if not (self.global_pythonify or pythonify) or 'errors' in updated_event: if not (self.global_pythonify or pythonify) or 'errors' in updated_event:
return updated_event return updated_event

13
tests/testlive_comprehensive.py
View File

@ -886,6 +886,19 @@ class TestComprehensive(unittest.TestCase):
self.admin_misp_connector.delete_event(first) self.admin_misp_connector.delete_event(first)
self.admin_misp_connector.delete_event(second) self.admin_misp_connector.delete_event(second)
def test_event_add_update_metadata(self):
event = self.create_simple_event()
event.add_attribute('ip-src', '9.9.9.9')
try:
response = self.user_misp_connector.add_event(event, metadata=True)
self.assertEqual(len(response.attributes), 0) # response should contains zero attributes
event.info = "New name"
response = self.user_misp_connector.update_event(event, metadata=True)
self.assertEqual(len(response.attributes), 0) # response should contains zero attributes
finally: # cleanup
self.admin_misp_connector.delete_event(event)
def test_extend_event(self): def test_extend_event(self):
first = self.create_simple_event() first = self.create_simple_event()
first.info = 'parent event' first.info = 'parent event'