{
  "exercise": {
    "description": "Simple Data Creation: Creation of an Event using the API",
    "expanded": "Simple Data Creation: Creation of an Event using the API",
    "meta": {
      "author": "MISP Project",
      "level": "beginner",
      "priority": 1
    },
    "name": "Simple Data Creation Via the API",
    "namespace": "data-model",
    "tags": [
      "exercise:software-scope=\"misp\"",
      "state:production"
    ],
    "total_duration": "7200",
    "uuid": "29324587-db6c-4a73-a209-cf8c79871629",
    "version": "20240624"
  },
  "inject_flow": [
    {
      "description": "Event Creation",
      "inject_uuid": "a6b5cf88-ba93-4c3f-8265-04e00d53778e",
      "reporting_callback": [],
      "requirements": {},
      "sequence": {
        "completion_trigger": [
          "time_expiration",
          "completion"
        ],
        "followed_by": [
          "00275360-d84a-4ce7-84fc-98baefd13776"
        ],
        "trigger": [
          "startex"
        ]
      },
      "timing": {
        "triggered_at": null
      }
    },
    {
      "description": "Attributes Creation",
      "inject_uuid": "00275360-d84a-4ce7-84fc-98baefd13776",
      "reporting_callback": [],
      "requirements": {
        "inject_uuid": "a6b5cf88-ba93-4c3f-8265-04e00d53778e",
        "resolution_requirement": "MISP Event created"
      },
      "sequence": {
        "completion_trigger": [
          "time_expiration",
          "completion"
        ],
        "followed_by": [
          "be1c3d25-e0df-4492-bdc1-f2e825194ef3"
        ],
        "trigger": [
        ]
      },
      "timing": {
        "triggered_at": null
      }
    },
    {
      "description": "Object Creation",
      "inject_uuid": "be1c3d25-e0df-4492-bdc1-f2e825194ef3",
      "reporting_callback": [],
      "requirements": {
        "inject_uuid": "a6b5cf88-ba93-4c3f-8265-04e00d53778e",
        "resolution_requirement": "MISP Event created"
      },
      "sequence": {
        "completion_trigger": [
          "time_expiration",
          "completion"
        ],
        "followed_by": [
          "cf149a8c-5601-4eec-aea3-5142170d309b"
        ],
        "trigger": [
        ]
      },
      "timing": {
        "triggered_at": null
      }
    },
    {
      "description": "Edition to `org-only`",
      "inject_uuid": "cf149a8c-5601-4eec-aea3-5142170d309b",
      "reporting_callback": [],
      "requirements": {
        "inject_uuid": "00275360-d84a-4ce7-84fc-98baefd13776",
        "resolution_requirement": "MISP Attributes created"
      },
      "sequence": {
        "completion_trigger": [
          "time_expiration",
          "completion"
        ],
        "followed_by": [
          "b4a8c490-4f0a-4a33-bee1-044b9f659e83"
        ],
        "trigger": [
        ]
      },
      "timing": {
        "triggered_at": null
      }
    },
    {
      "description": "Tagging `tlp:green`",
      "inject_uuid": "b4a8c490-4f0a-4a33-bee1-044b9f659e83",
      "reporting_callback": [],
      "requirements": {
        "inject_uuid": "00275360-d84a-4ce7-84fc-98baefd13776",
        "resolution_requirement": "MISP Attributes created"
      },
      "sequence": {
        "completion_trigger": [
          "time_expiration",
          "completion"
        ],
        "trigger": [
        ]
      },
      "timing": {
        "triggered_at": null
      }
    }
  ],
  "inject_payloads": [
  ],
  "injects": [
    {
      "action": "event_creation",
      "inject_evaluation": [
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            }
          ],
          "result": "MISP Event created",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            20
          ]
        }
      ],
      "name": "Event Creation",
      "target_tool": "MISP",
      "uuid": "a6b5cf88-ba93-4c3f-8265-04e00d53778e"
    },
    {
      "action": "attribute_creation",
      "inject_evaluation": [
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            },
            {
              "Event.Attribute": {
                "comparison": "contains",
                "values": [
                  {
                    "type": "ip-dst",
                    "value": "1.2.3.4"
                  },
                  {
                    "type": "domain",
                    "value": "evil.com"
                  },
                  {
                    "type": "filename",
                    "value": "evil.exe"
                  }
                ]
              }
            }
          ],
          "result": "MISP Attributes created",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            30
          ]
        }
      ],
      "name": "Attributes Creation",
      "target_tool": "MISP",
      "uuid": "00275360-d84a-4ce7-84fc-98baefd13776"
    },
    {
      "action": "object_creation",
      "inject_evaluation": [
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            },
            {
              "Event.Object": {
                "comparison": "contains",
                "values": [
                  {
                    "name": "domain-ip",
                    "template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734"
                  }
                ]
              }
            }
          ],
          "result": "MISP Object created`",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            10
          ]
        },
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            },
            {
              "Event.Object[name=\"domain-ip\"].Attribute": {
                "comparison": "contains",
                "values": [
                  {
                    "object_relation": "ip",
                    "value": "4.3.2.1"
                  },
                  {
                    "object_relation": "domain",
                    "value": "foobar.baz"
                  },
                  {
                    "object_relation": "text",
                    "value": "Classified information"
                  }
                ]
              }
            }
          ],
          "result": "MISP Object's Attributes created`",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            10
          ]
        }
      ],
      "name": "Object Creation",
      "target_tool": "MISP",
      "uuid": "be1c3d25-e0df-4492-bdc1-f2e825194ef3"
    },
    {
      "action": "edition_org_only",
      "inject_evaluation": [
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            },
            {
              "Event.Attribute": {
                "comparison": "contains",
                "values": [
                  {
                    "type": "ip-dst",
                    "value": "1.2.3.4",
                    "distribution": 0
                  }
                ]
              }
            }
          ],
          "result": "MISP Edition `org-only` done",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            10
          ]
        }
      ],
      "name": "Edition to `org-only`",
      "target_tool": "MISP",
      "uuid": "cf149a8c-5601-4eec-aea3-5142170d309b"
    },
    {
      "action": "tagging_tlp_green",
      "inject_evaluation": [
        {
          "parameters": [
            {
              "Event.info": {
                "comparison": "contains",
                "values": [
                  "event",
                  "API"
                ]
              }
            },
            {
              "Event.Attribute": {
                "comparison": "contains",
                "values": [
                  {
                    "type": "ip-dst",
                    "value": "1.2.3.4",
                    "distribution": 0
                  }
                ]
              }
            },
            {
              "Event.Attribute[value=\"1.2.3.4\"].Tag": {
                "JQ": "jq '.Event.Attribute[] | select(.value == \"1.2.3.4\") | .Tag'",
                "comparison": "contains",
                "values": [
                  {
                    "name": "tlp:green"
                  }
                ]
              }
            }
          ],
          "result": "MISP Tagging `tlp:green` done",
          "evaluation_strategy": "data_filtering",
          "evaluation_context": {
            "request_is_rest": true
          },
          "score_range": [
            0,
            20
          ]
        }
      ],
      "name": "Tagging `tlp:green`",
      "target_tool": "MISP",
      "uuid": "b4a8c490-4f0a-4a33-bee1-044b9f659e83"
    }
  ]
}