misp_create_event

Instructions

Implementation Reference

• src/tools/events.ts:150-204 (registration)

  Registration of the 'misp_create_event' tool with the MCP server, including its schema (info, distribution, threatLevel, analysis, date, tags) and the handler callback.

  // Create event
  server.tool(
    "misp_create_event",
    "Create a new MISP event for documenting incidents or threat intelligence. Does not publish - use misp_publish_event separately.",
    {
      info: z.string().describe("Event description/title"),
      distribution: z.union([z.literal(0), z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
        .describe("0=Organization only, 1=Community, 2=Connected communities, 3=All communities, 4=Sharing group"),
      threatLevel: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
        .describe("1=High, 2=Medium, 3=Low, 4=Undefined"),
      analysis: z.union([z.literal(0), z.literal(1), z.literal(2)])
        .describe("0=Initial, 1=Ongoing, 2=Complete"),
      date: z.string().optional().describe("Event date (YYYY-MM-DD)"),
      tags: z.array(z.string()).optional().describe("Tags to apply"),
    },
    async (params) => {
      try {
        const event = await client.createEvent({
          info: params.info,
          distribution: params.distribution,
          threat_level_id: params.threatLevel,
          analysis: params.analysis,
          date: params.date,
          tags: params.tags,
        });
  
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify(
                {
                  id: event.id,
                  uuid: event.uuid,
                  info: event.info,
                  date: event.date,
                  published: event.published,
                  tags: (event.Tag || []).map((t) => t.name),
                },
                null,
                2
              ),
            },
          ],
        };
      } catch (err) {
        return {
          content: [
            { type: "text", text: `Error creating event: ${err instanceof Error ? err.message : String(err)}` },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/events.ts:165-203 (handler)

  Handler function that calls client.createEvent() with the validated parameters and returns formatted response including event id, uuid, info, date, published status, and tags.

  async (params) => {
    try {
      const event = await client.createEvent({
        info: params.info,
        distribution: params.distribution,
        threat_level_id: params.threatLevel,
        analysis: params.analysis,
        date: params.date,
        tags: params.tags,
      });
  
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify(
              {
                id: event.id,
                uuid: event.uuid,
                info: event.info,
                date: event.date,
                published: event.published,
                tags: (event.Tag || []).map((t) => t.name),
              },
              null,
              2
            ),
          },
        ],
      };
    } catch (err) {
      return {
        content: [
          { type: "text", text: `Error creating event: ${err instanceof Error ? err.message : String(err)}` },
        ],
        isError: true,
      };
    }
  }

• src/tools/events.ts:154-164 (schema)

  Zod schema defining input parameters: info (required string), distribution (0-4), threatLevel (1-4), analysis (0-2), date (optional string YYYY-MM-DD), tags (optional array of strings).

  {
    info: z.string().describe("Event description/title"),
    distribution: z.union([z.literal(0), z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
      .describe("0=Organization only, 1=Community, 2=Connected communities, 3=All communities, 4=Sharing group"),
    threatLevel: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
      .describe("1=High, 2=Medium, 3=Low, 4=Undefined"),
    analysis: z.union([z.literal(0), z.literal(1), z.literal(2)])
      .describe("0=Initial, 1=Ongoing, 2=Complete"),
    date: z.string().optional().describe("Event date (YYYY-MM-DD)"),
    tags: z.array(z.string()).optional().describe("Tags to apply"),
  },

• src/client.ts:179-210 (helper)

  The createEvent method on MispClient that POSTs to /events/add endpoint, then optionally tags the event and re-fetches it to return a complete MispEvent.

  async createEvent(params: {
    info: string;
    distribution: number;
    threat_level_id: number;
    analysis: number;
    date?: string;
    tags?: string[];
  }): Promise<MispEvent> {
    const eventData: Record<string, unknown> = {
      info: params.info,
      distribution: params.distribution,
      threat_level_id: params.threat_level_id,
      analysis: params.analysis,
    };
  
    if (params.date) eventData.date = params.date;
  
    const data = await this.request<EventResponse>("POST", "/events/add", {
      Event: eventData,
    });
  
    // Add tags after creation if specified
    if (params.tags && params.tags.length > 0 && data.Event.id) {
      for (const tag of params.tags) {
        await this.tagEvent(data.Event.id, tag);
      }
      // Re-fetch to include tags
      return this.getEvent(data.Event.id);
    }
  
    return data.Event;
  }

• src/types.ts:2-23 (helper)

  MispEvent interface defining the shape of a MISP event returned from the API, including id, uuid, info, date, published, and Tag[].

  export interface MispEvent {
    id: string;
    orgc_id: string;
    org_id: string;
    info: string;
    date: string;
    threat_level_id: string;
    analysis: string;
    distribution: string;
    published: boolean;
    uuid: string;
    timestamp: string;
    publish_timestamp: string;
    attribute_count: string;
    Orgc?: { id: string; name: string; uuid: string };
    Org?: { id: string; name: string; uuid: string };
    Tag?: MispTag[];
    Attribute?: MispAttribute[];
    Object?: MispObject[];
    Galaxy?: MispGalaxy[];
    RelatedEvent?: Array<{ Event: MispEvent }>;
  }