Update Event Info

[eljeffeg]

Couple support questions:

1. I'm trying to update the "Info" of an event and I can't figure out how to do it. I've tried doing this but it doesn't seem to update anything.

   event['Event']['info'] = info
   pymisp.update_event(event['Event']['id'], event)

   event['Event']['info'] = info
   pymisp.update(event)

2. After I upload_sample, I’m trying apply some tags to the malware-sample after I do some analysis. How do I get the attribute id for it? The return of the upload_sample just lists the event. {'name': 'Success', 'message': 'Success, saved all attributes.', 'url': '/events/view/103', 'id': '103'}

[Rafiot]

Yep, makes sense. You can either:

• get the event, load it in a MISPEvent, change the info field, and update it on the server
• do what you already do and pop the timestamp entry from the dictionary you're editing.

Note that PyMISP automatically pops the timestamps when appropriate when you load the event in a MISPEvent. If you don't do that, you have to figure it out yourself.

[eljeffeg]

Ok, so I need to put the event return into a MISPEvent. Something like this, correct? And what about question 2? You just addressed question 1, Thanks

event = MISPEvent(pymisp.create_event(...))
event.info = info
pymisp.update(event)

[Rafiot]

To update an event, you have a full example here: https://github.com/MISP/PyMISP/blob/master/docs/tutorial/FullOverview.ipynb (search for "Full example", and use the new python 3.6+ API).

Sorry, I miss your second question, I was at a conference.

If you want to add tags to a malware sample, I recommend you to first search for "Use lief to extract indicators out of binaries" (on the same link as I mentioned earlier): it creates objects and extract lots of indicators from a malware sample. Then, you have a MISPEvent that contains objects and more precisely a file object. That file object contains attributes and one of the attributes is the malware sample. To that malware sample, you can add tags. Everything is documented here: https://pymisp.readthedocs.io/modules.html