Truxton child file create artifact

This creates an artifact from this file that you can use in the Artifact API. An artifact object is how you add records to the [Entity] table.

Syntax

uint64_t truxton_child_file_create_artifact( uint64_t child_handle );

Parameters

child_handle

The handle created by the truxton_child_file_create or truxton_file_create_child call.

Return value

A handle to an artifact object.

Sample

void add_folder( uint64_t truxton, uint64_t parent_file )
{
   truxton_start_adding_files( truxton );

   uint64_t child = truxton_child_file_create( truxton );

   char id[40];

   truxton_file_get_id( parent_file, id, sizeof(id) );
   truxton_child_file_set_parent_id( child, id );
   truxton_child_file_set_type( child, Type_Directory );
   truxton_child_file_set_name( child, "Custom Exploits Folder" );

   uint64_t now = truxton_time_now();

   truxton_child_file_set_created( child, now );
   truxton_child_file_set_accessed( child, now );
   truxton_child_file_set_modified( child, now );

   truxton_child_file_set_origin( child, ORIGIN_GENERATED );

   if ( truxton_child_file_save( child ) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }

   uint64_t artifact = truxton_child_file_create_artifact( child );

   truxton_artifact_set_type( artifact, ENTITY_TYPE_SERIAL_NUMBER );
   truxton_artifact_set_value( artifact, "1234" );
   truxton_artifact_save( artifact );
   truxton_artifact_destroy( artifact );

   truxton_child_file_destroy( child );
}