misp_get_event

Instructions

Implementation Reference

• src/tools/events.ts:80-148 (handler)

  The MCP tool handler for 'misp_get_event'. Calls client.getEvent(eventId) and formats the response into structured JSON with event details, attributes, objects, galaxies, and related events.

  // Get event details
  server.tool(
    "misp_get_event",
    "Get full details of a specific MISP event including all attributes, objects, tags, and related events",
    {
      eventId: z.string().describe("Event ID to retrieve"),
    },
    async ({ eventId }) => {
      try {
        const event = await client.getEvent(eventId);
  
        const result = {
          id: event.id,
          uuid: event.uuid,
          info: event.info,
          date: event.date,
          threat_level: ["", "High", "Medium", "Low", "Undefined"][
            parseInt(event.threat_level_id) || 0
          ],
          analysis: ["Initial", "Ongoing", "Complete"][parseInt(event.analysis) || 0],
          distribution: ["Organization", "Community", "Connected communities", "All communities", "Sharing group"][
            parseInt(event.distribution) || 0
          ],
          published: event.published,
          org: event.Orgc?.name || "Unknown",
          tags: (event.Tag || []).map((t) => t.name),
          attribute_count: event.attribute_count,
          attributes: (event.Attribute || []).map((a) => ({
            id: a.id,
            type: a.type,
            category: a.category,
            value: a.value,
            to_ids: a.to_ids,
            comment: a.comment,
          })),
          objects: (event.Object || []).map((o) => ({
            id: o.id,
            name: o.name,
            meta_category: o.meta_category,
            attributes: (o.Attribute || []).map((a) => ({
              type: a.type,
              value: a.value,
            })),
          })),
          galaxies: (event.Galaxy || []).map((g) => ({
            name: g.name,
            type: g.type,
            clusters: (g.GalaxyCluster || []).map((c) => c.value),
          })),
          related_events: (event.RelatedEvent || []).map((r) => ({
            id: r.Event.id,
            info: r.Event.info,
            date: r.Event.date,
          })),
        };
  
        return {
          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
        };
      } catch (err) {
        return {
          content: [
            { type: "text", text: `Error getting event: ${err instanceof Error ? err.message : String(err)}` },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/events.ts:83-86 (schema)

  Zod schema definition for the 'misp_get_event' tool: accepts a required 'eventId' (string).

  "Get full details of a specific MISP event including all attributes, objects, tags, and related events",
  {
    eventId: z.string().describe("Event ID to retrieve"),
  },

• src/tools/events.ts:1-5 (registration)

  The 'registerEventTools' function registers all event-related tools, including 'misp_get_event', on the MCP server.

  import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  import { z } from "zod";
  import type { MispClient } from "../client.js";
  
  export function registerEventTools(server: McpServer, client: MispClient): void {

• src/index.ts:30-31 (registration)

  Registration call in the main index.ts: registerEventTools(server, client) which wires up the tool on the MCP server.

  // Register all tools
  registerEventTools(server, client);

• src/client.ts:171-177 (helper)

  Client-side helper method 'getEvent' that performs the HTTP GET to /events/view/{eventId} and returns the MispEvent data.

  async getEvent(eventId: string): Promise<MispEvent> {
    const data = await this.request<EventResponse>(
      "GET",
      `/events/view/${encodeId(eventId, "eventId")}`
    );
    return data.Event;
  }