Difference between revisions of "Truxton file create event"
Jump to navigation
Jump to search
(Created page with "This creates an event from this file that you can use in the Event API. An event object is how you add records to the <code> Event</...") |
|||
| (4 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
This creates an event from this file that you can use in the [[Truxton C API#Event | Event API.]] | This creates an event from this file that you can use in the [[Truxton C API#Event | Event API.]] | ||
| − | An event object is how you add records to the <code>[[Event Table | Event]]</code> table. | + | An event object is how you add records to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to. | The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to. | ||
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
uint64_t truxton_file_create_event( uint64_t file_handle ); | uint64_t truxton_file_create_event( uint64_t file_handle ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
| Line 14: | Line 14: | ||
=Return value= | =Return value= | ||
A handle to an event object. | A handle to an event object. | ||
| + | |||
| + | =Remarks= | ||
| + | The event object created by this call will already have the [[truxton_event_set_file_id|file id]] and [[truxton_event_set_media_id|media id]] set. | ||
=Sample= | =Sample= | ||
| − | < | + | <source lang="C" highlight="5"> |
| − | void process_file(uint64_t truxton) | + | void process_file( uint64_t truxton ) |
{ | { | ||
| − | + | uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" ); | |
| − | |||
| − | uint64_t | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | uint64_t event = | + | uint64_t event = truxton_file_create_event( file ); |
| − | truxton_event_set_type(event, EVENT_TYPE_POSSIBLE_INFECTION); | + | truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION ); |
| − | truxton_event_set_start(event, truxton_file_get_created( | + | truxton_event_set_start( event, truxton_file_get_created( file ) ); |
| − | truxton_event_set_end(event, truxton_file_get_modified( | + | truxton_event_set_end( event, truxton_file_get_modified( file ) ); |
| − | truxton_event_set_title(event, "Fancy Bear Panda Hurricane" ); | + | truxton_event_set_title( event, "Fancy Bear Panda Hurricane" ); |
| − | truxton_event_set_description(event, "Russian Malware repurposed by Chinese military used in FBI investigation" ); | + | truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" ); |
| − | truxton_event_save(event); | + | truxton_event_save( event ); |
| − | truxton_event_destroy(event); | + | truxton_event_destroy( event ); |
| − | + | truxton_file_free( file ); | |
} | } | ||
| − | </ | + | </source> |
Latest revision as of 04:55, 13 February 2021
This creates an event from this file that you can use in the Event API.
An event object is how you add records to the [Event] table.
The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.
Syntax
uint64_t truxton_file_create_event( uint64_t file_handle );
Parameters
file_handle
The handle created by the truxton_file_open_id or truxton_file_open_md5 call.
Return value
A handle to an event object.
Remarks
The event object created by this call will already have the file id and media id set.
Sample
void process_file( uint64_t truxton )
{
uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );
uint64_t event = truxton_file_create_event( file );
truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION );
truxton_event_set_start( event, truxton_file_get_created( file ) );
truxton_event_set_end( event, truxton_file_get_modified( file ) );
truxton_event_set_title( event, "Fancy Bear Panda Hurricane" );
truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" );
truxton_event_save( event );
truxton_event_destroy( event );
truxton_file_free( file );
}
