{
  "context": "This criteria evaluates the engineer's proficiency in using PyMISP's core data structure classes (MISPEvent, MISPAttribute, MISPObject) to build threat intelligence events. The focus is on correct instantiation, property setting, relationship management, and serialization of these foundational PyMISP objects.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "MISPEvent instantiation",
      "description": "Correctly instantiates a MISPEvent object to represent the threat intelligence event. Should use the MISPEvent class constructor.",
      "max_score": 15
    },
    {
      "name": "Event metadata properties",
      "description": "Sets appropriate MISPEvent properties including info (title), distribution, threat_level, and analysis status using the correct property names and value types expected by PyMISP.",
      "max_score": 15
    },
    {
      "name": "MISPAttribute creation",
      "description": "Creates MISPAttribute objects for individual indicators (IP addresses and file hashes) using the MISPAttribute class with appropriate type, category, and value properties.",
      "max_score": 18
    },
    {
      "name": "Attribute type mapping",
      "description": "Uses correct PyMISP attribute types for different indicators (e.g., 'ip-dst' or 'ip-src' for IPs, 'md5', 'sha1', 'sha256' for hashes) as defined in PyMISP's attribute type taxonomy.",
      "max_score": 12
    },
    {
      "name": "Add attributes to event",
      "description": "Properly attaches MISPAttribute objects to the MISPEvent using the add_attribute() method or by directly adding to the Attribute list.",
      "max_score": 8
    },
    {
      "name": "MISPObject usage",
      "description": "Creates a MISPObject using the appropriate object template (e.g., 'file' template) and adds attributes to it using add_attribute() method with proper object attribute names.",
      "max_score": 12
    },
    {
      "name": "Add object to event",
      "description": "Attaches the MISPObject to the MISPEvent using the add_object() method to establish the proper parent-child relationship.",
      "max_score": 10
    },
    {
      "name": "JSON serialization",
      "description": "Uses the to_json() method (inherited from AbstractMISP) to serialize the MISPEvent to JSON format and from_json() or from_dict() to deserialize, properly preserving all event data.",
      "max_score": 10
    }
  ]
}