Difference between revisions of "Truxton event create"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This creates an event object. You can use this to add records to the <code><nowiki>[</nowiki>Event<nowiki>]</nowiki></code> table in the database. =Syntax= <s...")
 
 
(2 intermediate revisions by the same user not shown)
Line 17: Line 17:
 
=Sample=
 
=Sample=
 
<source lang="C" highlight="3">
 
<source lang="C" highlight="3">
void initialize_investigation(uint64_t truxton, char const * media_id, char const * file_id)
+
void initialize_investigation( uint64_t truxton, char const * media_id, char const * file_id )
 
{
 
{
   uint64_t event_handle = truxton_event_create(truxton);
+
   uint64_t event_handle = truxton_event_create( truxton );
  
 
   truxton_event_set_name( event_handle, "Phase 1" );
 
   truxton_event_set_name( event_handle, "Phase 1" );
Line 26: Line 26:
 
   truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
 
   truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
 
   truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
 
   truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
   truxton_event_set_media( event_handle, media_id );
+
   truxton_event_set_media_id( event_handle, media_id );
 
   truxton_event_set_file_id( event_handle, file_id );
 
   truxton_event_set_file_id( event_handle, file_id );
  
Line 37: Line 37:
 
   printf( "Event ID is %s\n", id );
 
   printf( "Event ID is %s\n", id );
  
   truxton_event_destroy(artifact);
+
   truxton_event_destroy( event_handle );
 
}
 
}
 
</source>
 
</source>

Latest revision as of 09:03, 10 February 2021

This creates an event object. You can use this to add records to the [Event] table in the database.

Syntax

uint64_t truxton_event_create( uint64_t truxton_handle );

Parameters

truxton_handle

The Truxton instance this event will belong. This handle comes from calling truxton_create().

Return value

A handle to an event object.

Sample

void initialize_investigation( uint64_t truxton, char const * media_id, char const * file_id )
{
   uint64_t event_handle = truxton_event_create( truxton );

   truxton_event_set_name( event_handle, "Phase 1" );
   truxton_event_set_description( event_handle, "As described by SA Barnett" );
   truxton_event_set_start( event_handle, get_ticks( "2016-07-31T12:00:00-05:00" ) );
   truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
   truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
   truxton_event_set_media_id( event_handle, media_id );
   truxton_event_set_file_id( event_handle, file_id );

   truxton_event_save( event_handle );

   char id[ 65 ];

   truxton_event_get_id( event_handle, id, sizeof( id ) );

   printf( "Event ID is %s\n", id );

   truxton_event_destroy( event_handle );
}