Difference between revisions of "Truxton file create event"
Jump to navigation
Jump to search
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
This creates an event from this file that you can use in the [[Truxton C API#Event | Event API.]] | This creates an event from this file that you can use in the [[Truxton C API#Event | Event API.]] | ||
| − | An event object is how you add records to the <code>[[Event Table | Event]]</code> table. | + | An event object is how you add records to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to. | The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to. | ||
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
uint64_t truxton_file_create_event( uint64_t file_handle ); | uint64_t truxton_file_create_event( uint64_t file_handle ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
| Line 14: | Line 14: | ||
=Return value= | =Return value= | ||
A handle to an event object. | A handle to an event object. | ||
| + | |||
| + | =Remarks= | ||
| + | The event object created by this call will already have the [[truxton_event_set_file_id|file id]] and [[truxton_event_set_media_id|media id]] set. | ||
=Sample= | =Sample= | ||
| − | < | + | <source lang="C" highlight="5"> |
| − | void process_file(uint64_t truxton) | + | void process_file( uint64_t truxton ) |
{ | { | ||
| − | uint64_t file = truxton_file_open_md5(truxton, "9ec8fb6095c35eff2b236863b7caaf10"); | + | uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" ); |
| − | uint64_t event = truxton_file_create_event(file); | + | uint64_t event = truxton_file_create_event( file ); |
| − | truxton_event_set_type(event, EVENT_TYPE_POSSIBLE_INFECTION); | + | truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION ); |
| − | truxton_event_set_start(event, truxton_file_get_created( file ) ); | + | truxton_event_set_start( event, truxton_file_get_created( file ) ); |
| − | truxton_event_set_end(event, truxton_file_get_modified( file ) ); | + | truxton_event_set_end( event, truxton_file_get_modified( file ) ); |
| − | truxton_event_set_title(event, "Fancy Bear Panda Hurricane" ); | + | truxton_event_set_title( event, "Fancy Bear Panda Hurricane" ); |
| − | truxton_event_set_description(event, "Russian Malware repurposed by Chinese military used in FBI investigation" ); | + | truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" ); |
| − | truxton_event_save(event); | + | truxton_event_save( event ); |
| − | truxton_event_destroy(event); | + | truxton_event_destroy( event ); |
| − | + | truxton_file_free( file ); | |
} | } | ||
| − | </ | + | </source> |
Latest revision as of 04:55, 13 February 2021
This creates an event from this file that you can use in the Event API.
An event object is how you add records to the [Event] table.
The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.
Syntax
uint64_t truxton_file_create_event( uint64_t file_handle );
Parameters
file_handle
The handle created by the truxton_file_open_id or truxton_file_open_md5 call.
Return value
A handle to an event object.
Remarks
The event object created by this call will already have the file id and media id set.
Sample
void process_file( uint64_t truxton )
{
uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );
uint64_t event = truxton_file_create_event( file );
truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION );
truxton_event_set_start( event, truxton_file_get_created( file ) );
truxton_event_set_end( event, truxton_file_get_modified( file ) );
truxton_event_set_title( event, "Fancy Bear Panda Hurricane" );
truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" );
truxton_event_save( event );
truxton_event_destroy( event );
truxton_file_free( file );
}
