From d7bc48da9435a3961be7407e3ff87af5dfc6bae9 Mon Sep 17 00:00:00 2001 From: To-om Date: Fri, 29 Jun 2018 10:46:47 +0200 Subject: [PATCH] #65 Add PAP attribute --- app/org/thp/cortex/controllers/AnalyzerCtrl.scala | 5 +++-- app/org/thp/cortex/models/AnalyzerDefinition.scala | 2 +- app/org/thp/cortex/services/AnalyzerConfigSrv.scala | 4 ++++ app/org/thp/cortex/services/AnalyzerSrv.scala | 2 +- app/org/thp/cortex/services/JobSrv.scala | 2 +- test/resources/analyzers/echoAnalyzer/echoAnalyzer.json | 2 +- 6 files changed, 11 insertions(+), 6 deletions(-) diff --git a/app/org/thp/cortex/controllers/AnalyzerCtrl.scala b/app/org/thp/cortex/controllers/AnalyzerCtrl.scala index 795dfdd23..7f326a7f1 100644 --- a/app/org/thp/cortex/controllers/AnalyzerCtrl.scala +++ b/app/org/thp/cortex/controllers/AnalyzerCtrl.scala @@ -1,10 +1,9 @@ package org.thp.cortex.controllers import javax.inject.{ Inject, Singleton } - import scala.concurrent.{ ExecutionContext, Future } -import play.api.libs.json.{ JsObject, Json } +import play.api.libs.json.{ JsNumber, JsObject, Json } import play.api.mvc.{ AbstractController, Action, AnyContent, ControllerComponents } import akka.stream.Materializer @@ -56,6 +55,8 @@ class AnalyzerCtrl @Inject() ( private def analyzerJson(analyzer: Analyzer, analyzerDefinition: Option[AnalyzerDefinition]) = { analyzer.toJson ++ analyzerDefinition.fold(emptyAnalyzerDefinitionJson) { ad ⇒ Json.obj( + "maxTlp" -> (analyzer.config \ "max_tlp").asOpt[JsNumber], + "maxPap" -> (analyzer.config \ "max_pap").asOpt[JsNumber], "version" -> ad.version, "description" -> ad.description, "author" -> ad.author, diff --git a/app/org/thp/cortex/models/AnalyzerDefinition.scala b/app/org/thp/cortex/models/AnalyzerDefinition.scala index ad8aa9030..f9269d54e 100644 --- a/app/org/thp/cortex/models/AnalyzerDefinition.scala +++ b/app/org/thp/cortex/models/AnalyzerDefinition.scala @@ -1,6 +1,6 @@ package org.thp.cortex.models -import java.nio.file.{ Path, Paths } +import java.nio.file.Path import scala.util.{ Failure, Success, Try } diff --git a/app/org/thp/cortex/services/AnalyzerConfigSrv.scala b/app/org/thp/cortex/services/AnalyzerConfigSrv.scala index a73e7050a..22f969a34 100644 --- a/app/org/thp/cortex/services/AnalyzerConfigSrv.scala +++ b/app/org/thp/cortex/services/AnalyzerConfigSrv.scala @@ -38,6 +38,10 @@ object BaseConfig { ConfigurationDefinitionItem("check_tlp", "", AnalyzerConfigItemType.boolean, multi = false, required = false, None), ConfigurationDefinitionItem("max_tlp", "", AnalyzerConfigItemType.number, multi = false, required = false, None)), None) + val pap = BaseConfig("pap", Nil, Seq( + ConfigurationDefinitionItem("check_pap", "", AnalyzerConfigItemType.boolean, multi = false, required = false, None), + ConfigurationDefinitionItem("max_pap", "", AnalyzerConfigItemType.number, multi = false, required = false, None)), + None) } @Singleton diff --git a/app/org/thp/cortex/services/AnalyzerSrv.scala b/app/org/thp/cortex/services/AnalyzerSrv.scala index 1eeb6f573..d023ee1d0 100644 --- a/app/org/thp/cortex/services/AnalyzerSrv.scala +++ b/app/org/thp/cortex/services/AnalyzerSrv.scala @@ -150,7 +150,7 @@ class AnalyzerSrv( def create(organization: Organization, analyzerDefinition: AnalyzerDefinition, analyzerFields: Fields)(implicit authContext: AuthContext): Future[Analyzer] = { val rawConfig = analyzerFields.getValue("configuration").fold(JsObject.empty)(_.as[JsObject]) - val configItems = analyzerDefinition.configurationItems ++ BaseConfig.global.items ++ BaseConfig.tlp.items + val configItems = analyzerDefinition.configurationItems ++ BaseConfig.global.items ++ BaseConfig.tlp.items ++ BaseConfig.pap.items val configOrErrors = configItems .validatedBy(_.read(rawConfig)) .map(JsObject.apply) diff --git a/app/org/thp/cortex/services/JobSrv.scala b/app/org/thp/cortex/services/JobSrv.scala index 9cf43a0e3..3cf49a8f2 100644 --- a/app/org/thp/cortex/services/JobSrv.scala +++ b/app/org/thp/cortex/services/JobSrv.scala @@ -413,7 +413,7 @@ class JobSrv( "data" -> job.data().get) } .map { artifact ⇒ - (BaseConfig.global.items ++ BaseConfig.tlp.items ++ analyzerDefinition.configurationItems) + (BaseConfig.global.items ++ BaseConfig.tlp.items ++ BaseConfig.pap.items ++ analyzerDefinition.configurationItems) .validatedBy(_.read(analyzer.config)) .map(cfg ⇒ Json.obj("config" -> JsObject(cfg).deepMerge(analyzerDefinition.configuration))) .map { cfg ⇒ diff --git a/test/resources/analyzers/echoAnalyzer/echoAnalyzer.json b/test/resources/analyzers/echoAnalyzer/echoAnalyzer.json index 2bf9ec45d..775050f95 100644 --- a/test/resources/analyzers/echoAnalyzer/echoAnalyzer.json +++ b/test/resources/analyzers/echoAnalyzer/echoAnalyzer.json @@ -54,6 +54,6 @@ } ], "description": "Fake analyzer used for functional tests", - "dataTypeList": ["domain"], + "dataTypeList": ["domain", "thehive:case"], "command": "echoAnalyzer/echoAnalyzer.sh" }