Difference between revisions of "TruxtonBolo"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This class lets you add to the <code>[BOLO]</code> table in Truxton. This is how you add criteria for generating alerts. =Attributes and Methods= ==<code>id</code>== This is...")
 
 
(4 intermediate revisions by the same user not shown)
Line 3: Line 3:
  
 
=Attributes and Methods=
 
=Attributes and Methods=
==<code>id</code>==
+
==<code>id: str</code>==
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the record.
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the record.
 
It becomes non-zero after <code>save()</code> has been called.
 
It becomes non-zero after <code>save()</code> has been called.
 
This corresponds to the <code>[ID]</code> column of the <code>[BOLO]</code> table.
 
This corresponds to the <code>[ID]</code> column of the <code>[BOLO]</code> table.
  
==<code>criteria</code>==
+
==<code>criteria: str</code>==
A JSON blob.
+
A [https://www.json.org JSON] blob.
  
==<code>save()</code>==
+
==<code>save() -> boolean</code>==
This will commit the information to the <code>[EntityType]</code> table.
+
This will commit the information to the <code>[BOLO]</code> table.
 
It will return [https://docs.python.org/3/library/constants.html#True True] if the record was saved to the database, [https://docs.python.org/3/library/constants.html#False False] if there was an error.
 
It will return [https://docs.python.org/3/library/constants.html#True True] if the record was saved to the database, [https://docs.python.org/3/library/constants.html#False False] if there was an error.
  
 
=Sample=
 
=Sample=
<source lang="Python" highlight="9-12">
+
<source lang="Python" highlight="9-11">
 
import sys
 
import sys
 
sys.path.append('C:/Program Files/Truxton/SDK')
 
sys.path.append('C:/Program Files/Truxton/SDK')
Line 24: Line 24:
 
   t = truxton.create()
 
   t = truxton.create()
  
   new_type = t.newartifacttype()
+
   bolo = t.newbolo()
   new_type.id = 1003
+
   bolo.id = "49DE7218-AEF1-4C2F-A73E-0A7197482D47"
   new_type.shortname = "Nuke ID"
+
   bolo.criteria = '{"Name":"Scorpio WiFi","Case":"SFPD-2015-77940","Description":"This password was seen in phones connected with the Scorpio gang house. Suspected human trafficking connection.","Contact":"Det. Callahan, 703.555.2122","SubCriteria":[{"AlertCriteriaType":2,"EntityTypeID":26,"EntityString":"EE6494848C55F3F71ACA2C2811"}]}'
  new_type.longname = "Nuclear weapon unique identifier"
+
   bolo.save()
   new_type.save()
 
  
 
if __name__ == "__main__":
 
if __name__ == "__main__":
   main()
+
   sys.exit(main())
 
</source>
 
</source>

Latest revision as of 11:16, 18 August 2023

This class lets you add to the [BOLO] table in Truxton. This is how you add criteria for generating alerts.

Attributes and Methods

id: str

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [BOLO] table.

criteria: str

A JSON blob.

save() -> boolean

This will commit the information to the [BOLO] table. It will return True if the record was saved to the database, False if there was an error.

Sample

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():
  t = truxton.create()

  bolo = t.newbolo()
  bolo.id = "49DE7218-AEF1-4C2F-A73E-0A7197482D47"
  bolo.criteria = '{"Name":"Scorpio WiFi","Case":"SFPD-2015-77940","Description":"This password was seen in phones connected with the Scorpio gang house. Suspected human trafficking connection.","Contact":"Det. Callahan, 703.555.2122","SubCriteria":[{"AlertCriteriaType":2,"EntityTypeID":26,"EntityString":"EE6494848C55F3F71ACA2C2811"}]}'
  bolo.save()

if __name__ == "__main__":
  sys.exit(main())