search

MISP / PyMISP

Python library using the MISP Rest API
Other
442 stars 279 forks source link

Import new Event with specific EventID #862

Open swebster96 opened 2 years ago

swebster96 commented 2 years ago

The EventId can be used in an API call or within PyMISP utility to delete or update a specific event.

Is there a MISP configuration to enable so when adding a new event, a specific EventId can be used?

{ "Event": { "id": "222222", "orgc_id": "2", "org_id": "1", "date": "2022-09-22", "threat_level_id": "3", "info": "test event", "published": false, "attribute_count": "0", "analysis": "2", "timestamp": "1663876708", "distribution": "0", "proposal_email_lock": false, "locked": true, "publish_timestamp": "0", "sharing_group_id": "0", "disable_correlation": false, "extends_uuid": "", "protected": null, } }

rather than MISP autogenerating the next available event number.

Rafiot commented 2 years ago

No, there is no way to do that, The Event ID is auto incremented ad the DB level.

I'd recommend you to use UUIDs instead.

swebster96 commented 2 years ago

Thanks for this reply. We will need to architect a solution to store the UUID in the database associated with the ID for sync/delta needs.

Scott

From: Raphaël Vinot @.> Sent: September 22, 2022 7:51 PM To: MISP/PyMISP @.> Cc: Webster, Scott @.>; Author @.> Subject: Re: [MISP/PyMISP] Import new Event with specific EventID (Issue #862)

No, there is no way to do that, The Event ID is auto incremented ad the DB level.

I'd recommend you to use UUIDs instead.

— Reply to this email directly, view it on GitHubhttps://github.com/MISP/PyMISP/issues/862#issuecomment-1255666350, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AYW7F5FL2PLO67DRNA6DC7LV7TWFPANCNFSM6AAAAAAQTMHBZ4. You are receiving this because you authored the thread. https://github.com/notifications/beacon/AYW7F5ARVQ5BRUD2O2LHZZTV7TWFPA5CNFSM6AAAAAAQTMHBZ6WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSK27ZK4.gif Message ID: @.**@.>>