#170 change alert status when a case is created

TheHive-Project · Apr 12, 2017 · 1a35403 · 1a35403
1 parent e1be855
commit 1a35403
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 10 deletions.
diff --git a/thehive-backend/app/services/AlertSrv.scala b/thehive-backend/app/services/AlertSrv.scala
@@ -118,7 +118,7 @@ class AlertSrv(
     alert.caze() match {
       case Some(id) ⇒ caseSrv.get(id)
       case None ⇒
-        val caze = connectors.get(alert.tpe()) match {
+        val futureCase = connectors.get(alert.tpe()) match {
           case Some(connector: AlertTransformer) ⇒ connector.createCase(alert)
           case _ ⇒
             getCaseTemplate(alert).flatMap { caseTemplate ⇒
@@ -137,13 +137,17 @@ class AlertSrv(
                 }
             }
         }
-        caze.flatMap { c ⇒
-          updateSrv[AlertModel, Alert](alertModel, alert.id, Fields.empty.set("case", c.id))
-            .map(_ ⇒ c)
-        }
+        for {
+          caze ← futureCase
+          _ ← setCase(alert, caze)
+        } yield caze
     }
   }
 
+  def setCase(alert: Alert, caze: Case)(implicit authContext: AuthContext): Future[Alert] = {
+    updateSrv(alert, Fields(Json.obj("case" → caze.id, "status" → AlertStatus.Imported)))
+  }
+
   def delete(id: String)(implicit Context: AuthContext): Future[Alert] =
     deleteSrv[AlertModel, Alert](alertModel, id)
 
@@ -156,9 +160,4 @@ class AlertSrv(
   def setFollowAlert(alertId: String, follow: Boolean)(implicit authContext: AuthContext): Future[Alert] = {
     updateSrv[AlertModel, Alert](alertModel, alertId, Fields(Json.obj("follow" → follow)))
   }
-
-  def setCaseId(alertId: String, caseId: String)(implicit authContext: AuthContext): Future[Alert] = {
-    updateSrv[AlertModel, Alert](alertModel, alertId,
-      Fields(Json.obj("case" → caseId, "status" → AlertStatus.Imported)))
-  }
 }
diff --git a/thehive-misp/app/connectors/misp/MispSrv.scala b/thehive-misp/app/connectors/misp/MispSrv.scala
@@ -347,6 +347,7 @@ class MispSrv @Inject() (
         for {
           instanceConfig ← getInstanceConfig(alert.source())
           caze ← caseSrv.create(Fields(alert.toCaseJson))
+          _ ← alertSrv.setCase(alert, caze)
           artifacts ← Future.sequence(alert.artifacts().flatMap(attributeToArtifact(instanceConfig, alert, _)))
           _ ← artifactSrv.create(caze, artifacts)
         } yield caze