Models

Attribute

Bases: Base, UpdateMixin, DictMixin['AttributeDict']

can_access

can_access(user: User) -> bool

Checks if a user is allowed to see and access an attribute based on whether the attribute is part of the same group or organisation and or creating organisation and the publishing status of the attribute with consideration of the event the attribute is associated with.

args: self: the attribute user: the user

Returns:

Type	Description
bool	true if the user has access permission

can_edit

can_edit(user: User) -> bool

Checks if a user is allowed to modify an attribute based on whether he or someone of his organisation created the attribute.

Parameters:

Name	Type	Description	Default
self		the attribute	required
user	User	the user	required

Returns:

Type	Description
bool	true if the user has editing permission

Galaxy

Bases: Base, DictMixin['GalaxyDict'], UpdateMixin

kill_chain_order class-attribute instance-attribute

kill_chain_order: Mapped[str | None] = mapped_column(
    String(255)
)

must be serialized

Event

Bases: Base, UpdateMixin, DictMixin['EventDict']

add_tag async

add_tag(
    db: AsyncSession,
    tag: Tag,
    local: bool = False,
    relationship_type: str | None = None,
) -> EventTag

FIXME Insert page break right here

can_access

can_access(user: User) -> bool

Checks if a user is allowed to see and access an event based on whether the event is part of the same group or organisation and the publishing status of the event.

args: self: the event user: the user

Returns:

Type	Description
bool	true if the user has access permission

can_edit

can_edit(user: User) -> bool

Checks if a user is allowed to modify an event based on whether he or someone of his organisation created the event.

Parameters:

Name	Type	Description	Default
self		the event	required
user	User	the user	required

Returns:

Type	Description
bool	true if the user has editing permission

OIDCIdentityProvider

Bases: Base

scope class-attribute instance-attribute

scope: Mapped[str] = mapped_column(
    String(255), default="openid"
)

Possibility to add more scopes to be requested from the idp in addition to the default scopes, currently not used.

Role

Bases: RoleModel, UpdateMixin, DictMixin['RoleDict']

check_permission

check_permission(permission: Permission) -> bool

Checks whether the role has the specified permission

Parameters:

Name	Type	Description	Default
self	Self	the role itself	required
permission	Permission	the permission to check	required

Returns:

Type	Description
bool	true if role has permission

Workflow

Bases: Base, UpdateMixin

A python class representation of the database model for workflows in MISP.

The most central of the attributes in this model is the data attribute, containing the information about the workflow structure and the modules contained in the workflow, represented/stored as a JSON-String. (The other attributes are what their name sais, e.g. counter represents the numer of times the workflow was executed.)

WorkflowBlueprint

Bases: Base

A python class representation of the database model for blueprints of workflows in MISP.

The most attributes of this model are similar to the attributes of workflows, except the attributes "enabled", "counter", "trigger_id" and "debug_enabled", because these attributes are not useful or sensible for blueprints.

Also, the attribute "default" is added, which is a boolean clarifying whether the blueprint is a default MISP blueprint.

Log

Bases: Base

A python class representation of the database model for logs in MISP.

Further explanation for some of the central attributes of the database model: - Action: Describes the action that was logged, e.g. a login or workflow execution - Change: A string-representation of the changes made to the logged object or of central information about the logged object.