Add support for attribute level tagging

MISP · Jan 17, 2017 · 2bcc416 · 2bcc416
1 parent 619538c
commit 2bcc416
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 4 deletions.
diff --git a/pymisp/api.py b/pymisp/api.py
@@ -365,15 +365,24 @@ def new_event(self, distribution=None, threat_level_id=None, analysis=None, info
         misp_event = self._prepare_full_event(distribution, threat_level_id, analysis, info, date, published, orgc_id, org_id, sharing_group_id)
         return self.add_event(json.dumps(misp_event, cls=EncodeUpdate))
 
-    def add_tag(self, event, tag):
+    def add_tag(self, event, tag, attribute=False):
+        # FIXME: this is dirty, this function needs to be deprecated with something tagging a UUID
         session = self.__prepare_session()
-        to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
+        if attribute:
+            to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}}
+        else:
+            to_post = {'request': {'Event': {'id': event['id'], 'tag': tag}}}
         response = session.post(urljoin(self.root_url, 'events/addTag'), data=json.dumps(to_post))
         return self._check_response(response)
 
-    def remove_tag(self, event, tag):
+    def remove_tag(self, event, tag, attribute=False):
+        # FIXME: this is dirty, this function needs to be deprecated with something removing the tag to a UUID
         session = self.__prepare_session()
-        to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
+        if attribute:
+            to_post = {'request': {'Attribute': {'id': event['id'], 'tag': tag}}}
+            pass
+        else:
+            to_post = {'request': {'Event': {'id': event['Event']['id'], 'tag': tag}}}
         response = session.post(urljoin(self.root_url, 'events/removeTag'), data=json.dumps(to_post))
         return self._check_response(response)
 

diff --git a/pymisp/mispevent.py b/pymisp/mispevent.py
@@ -79,6 +79,7 @@ def _reinitialize_attribute(self):
         self.ShadowAttribute = []
         self.disable_correlation = False
         self.RelatedAttribute = []
+        self.Tag = []
 
     def _serialize(self):
         return '{type}{category}{to_ids}{uuid}{timestamp}{comment}{deleted}{value}'.format(
@@ -172,6 +173,8 @@ def set_all_values(self, **kwargs):
             self.ShadowAttribute = kwargs['ShadowAttribute']
         if kwargs.get('sig'):
             self.sig = kwargs['sig']
+        if kwargs.get('Tag'):
+            self.Tag = kwargs['Tag']
 
         # If the user wants to disable correlation, let them. Defaults to False.
         self.disable_correlation = kwargs.get("disable_correlation", False)
@@ -215,6 +218,8 @@ def _json(self):
             to_return['sig'] = self.sig
         if self.sharing_group_id:
             to_return['sharing_group_id'] = self.sharing_group_id
+        if self.Tag:
+            to_return['Event']['Tag'] = self.Tag
         if self.data:
             to_return['data'] = base64.b64encode(self.data.getvalue()).decode()
             if self.encrypt: