Truxton file create event

This creates an event from this file that you can use in the Event API. An event object is how you add records to the [Event] table. The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.

Syntax

uint64_t truxton_file_create_event( uint64_t file_handle );

Parameters

file_handle

The handle created by the truxton_file_open_id or truxton_file_open_md5 call.

Return value

A handle to an event object.

Remarks

The event object created by this call will already have the file id and media id set.

Sample

void process_file( uint64_t truxton )
{
   uint64_t file = truxton_file_open_md5( truxton, "9ec8fb6095c35eff2b236863b7caaf10" );

   uint64_t event = truxton_file_create_event( file );

   truxton_event_set_type( event, EVENT_TYPE_POSSIBLE_INFECTION );
   truxton_event_set_start( event, truxton_file_get_created( file ) );
   truxton_event_set_end( event, truxton_file_get_modified( file ) );
   truxton_event_set_title( event, "Fancy Bear Panda Hurricane" );
   truxton_event_set_description( event, "Russian Malware repurposed by Chinese military used in FBI investigation" );
   truxton_event_save( event );
   truxton_event_destroy( event );

   truxton_file_free( file );
}