{
  "context": "This criteria evaluates the engineer's ability to use PyMISP's search and query functionality, including tag-based filtering with boolean logic, time-based searches, multi-format exports, and attribute-specific queries. The focus is on correctly utilizing PyMISP's search API with appropriate parameters and export methods.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "MISP Connection",
      "description": "Uses PyMISP class constructor (e.g., PyMISP() or ExpandedPyMISP()) with URL and API key to establish connection. Properly handles environment variables for credentials.",
      "max_score": 10
    },
    {
      "name": "Tag-Based Search",
      "description": "Uses search() or search_index() method with 'tags' parameter to filter events by tags. Demonstrates understanding of how to pass tag lists to the search function.",
      "max_score": 15
    },
    {
      "name": "Boolean Tag Logic",
      "description": "Implements AND/OR/NOT tag logic correctly using PyMISP's tag filtering parameters (e.g., 'tags', 'not_tags', or proper tag query syntax with '&&', '||', '!' operators).",
      "max_score": 20
    },
    {
      "name": "Time-Based Filtering",
      "description": "Uses time-related search parameters such as 'publish_timestamp', 'timestamp', 'date_from', 'date_to', or shorthand notation like '7d' or '24h' to filter events by time range.",
      "max_score": 15
    },
    {
      "name": "JSON Export",
      "description": "Exports search results to JSON format, either by using the search method's return_format parameter or by saving results directly to a JSON file.",
      "max_score": 10
    },
    {
      "name": "CSV Export",
      "description": "Uses search() method with return_format='csv' parameter or uses dedicated CSV export functionality to export results in CSV format.",
      "max_score": 10
    },
    {
      "name": "STIX Export",
      "description": "Uses search() method with return_format='stix2' (or 'stix') parameter to export results in STIX format, demonstrating knowledge of MISP's STIX export capability.",
      "max_score": 10
    },
    {
      "name": "Attribute Type Search",
      "description": "Uses search() method with 'type_attribute' or 'types' parameter to filter attributes by specific types (e.g., 'ip-src', 'domain', 'hash').",
      "max_score": 5
    },
    {
      "name": "Attribute Value Extraction",
      "description": "Correctly extracts attribute values from search results by accessing the 'value' field of attribute objects in the returned data structure.",
      "max_score": 5
    }
  ]
}