misp_tag_event

Instructions

Implementation Reference

• src/tools/events.ts:281-316 (handler)

  The main handler function for the misp_tag_event tool. Takes eventId, tag, and optional remove parameters. Calls client.tagEvent() or client.untagEvent() depending on the remove flag.

  // Tag event
  server.tool(
    "misp_tag_event",
    "Add or remove a tag from a MISP event (TLP, MITRE ATT&CK, custom tags)",
    {
      eventId: z.string().describe("Event ID to tag"),
      tag: z.string().describe("Tag name (e.g., tlp:white, misp-galaxy:mitre-attack-pattern)"),
      remove: z.boolean().optional().describe("Set to true to remove the tag instead of adding"),
    },
    async ({ eventId, tag, remove }) => {
      try {
        if (remove) {
          await client.untagEvent(eventId, tag);
          return {
            content: [
              { type: "text", text: `Tag "${tag}" removed from event ${eventId}.` },
            ],
          };
        } else {
          await client.tagEvent(eventId, tag);
          return {
            content: [
              { type: "text", text: `Tag "${tag}" added to event ${eventId}.` },
            ],
          };
        }
      } catch (err) {
        return {
          content: [
            { type: "text", text: `Error tagging event: ${err instanceof Error ? err.message : String(err)}` },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/events.ts:285-289 (schema)

  Zod schema for the misp_tag_event tool parameters: eventId (string), tag (string), and optional remove (boolean).

  {
    eventId: z.string().describe("Event ID to tag"),
    tag: z.string().describe("Tag name (e.g., tlp:white, misp-galaxy:mitre-attack-pattern)"),
    remove: z.boolean().optional().describe("Set to true to remove the tag instead of adding"),
  },

• src/tools/events.ts:281-317 (registration)

  Registration of the tool via server.tool() inside registerEventTools().

    // Tag event
    server.tool(
      "misp_tag_event",
      "Add or remove a tag from a MISP event (TLP, MITRE ATT&CK, custom tags)",
      {
        eventId: z.string().describe("Event ID to tag"),
        tag: z.string().describe("Tag name (e.g., tlp:white, misp-galaxy:mitre-attack-pattern)"),
        remove: z.boolean().optional().describe("Set to true to remove the tag instead of adding"),
      },
      async ({ eventId, tag, remove }) => {
        try {
          if (remove) {
            await client.untagEvent(eventId, tag);
            return {
              content: [
                { type: "text", text: `Tag "${tag}" removed from event ${eventId}.` },
              ],
            };
          } else {
            await client.tagEvent(eventId, tag);
            return {
              content: [
                { type: "text", text: `Tag "${tag}" added to event ${eventId}.` },
              ],
            };
          }
        } catch (err) {
          return {
            content: [
              { type: "text", text: `Error tagging event: ${err instanceof Error ? err.message : String(err)}` },
            ],
            isError: true,
          };
        }
      }
    );
  }

• src/client.ts:241-246 (helper)

  The MispClient.tagEvent() helper that sends POST /events/addTag with event ID and tag.

  async tagEvent(eventId: string, tag: string): Promise<unknown> {
    return this.request("POST", "/events/addTag", {
      event: eventId,
      tag,
    });
  }

• src/client.ts:248-253 (helper)

  The MispClient.untagEvent() helper that sends POST /events/removeTag with event ID and tag.

  async untagEvent(eventId: string, tag: string): Promise<unknown> {
    return this.request("POST", "/events/removeTag", {
      event: eventId,
      tag,
    });
  }