Truxton child file create event

This creates an event from this file that you can use in the Event API. An event object is how you add records to the [Event] table. The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.

Syntax

uint64_t truxton_child_file_create_event( uint64_t child_handle );

Parameters

child_handle

The handle created by the truxton_child_file_create or truxton_file_create_child call.

Return value

A handle to an event object.

Sample

void add_folder( uint64_t truxton, uint64_t parent_file )
{
   truxton_start_adding_files( truxton );

   uint64_t child = truxton_child_file_create( truxton );

   char id[40];

   truxton_file_get_id( parent_file, id, sizeof(id) );
   truxton_child_file_set_parent_id( child, id );
   truxton_child_file_set_type( child, Type_Directory );
   truxton_child_file_set_name( child, "Custom Exploits Folder" );

   truxton_child_file_set_origin( child, ORIGIN_GENERATED );

   if ( truxton_child_file_save( child ) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }

   uint64_t event = truxton_child_file_create_event( child );

   truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION );
   truxton_event_set_start( event, truxton_file_get_created( parent_file ) );
   truxton_event_set_end( event, truxton_file_get_modified( parent_file ) );
   truxton_event_set_title( event, "Fancy Bear Panda Hurricane" );
   truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" );
   truxton_event_save( event );
   truxton_event_destroy( event );

   truxton_child_file_destroy( child );
}