#1264 alertCase are now merged

TheHive-Project · Mar 2, 2021 · 5ef6cdc · 5ef6cdc
1 parent 127e0d0
commit 5ef6cdc
Show file tree

Hide file tree

Showing 7 changed files with 40 additions and 5 deletions.
diff --git a/thehive/app/org/thp/thehive/services/CaseSrv.scala b/thehive/app/org/thp/thehive/services/CaseSrv.scala
@@ -25,7 +25,7 @@ import play.api.libs.json.{JsNull, JsObject, Json}
 
 import java.lang.{Long => JLong}
 import java.util.{Map => JMap}
-import javax.inject.{Inject, Named, Singleton}
+import javax.inject.{Inject, Named, Provider, Singleton}
 import scala.util.{Failure, Success, Try}
 
 @Singleton
@@ -40,9 +40,11 @@ class CaseSrv @Inject() (
     auditSrv: AuditSrv,
     resolutionStatusSrv: ResolutionStatusSrv,
     impactStatusSrv: ImpactStatusSrv,
+    alertSrvProvider: Provider[AlertSrv],
     @Named("integrity-check-actor") integrityCheckActor: ActorRef
 )(implicit @Named("with-thehive-schema") db: Database)
     extends VertexSrv[Case] {
+  lazy val alertSrv: AlertSrv = alertSrvProvider.get
 
   val caseTagSrv              = new EdgeSrv[CaseTag, Case, Tag]
   val caseImpactStatusSrv     = new EdgeSrv[CaseImpactStatus, Case, ImpactStatus]
@@ -330,6 +332,11 @@ class CaseSrv @Inject() (
               .richObservable
               .toList
               .toTry(shareSrv.shareObservable(_, richCase.`case`, orga))
+          _ <-
+            get(c)
+              .alert
+              .toList
+              .toTry(alertSrv.alertCaseSrv.create(AlertCase(), _, richCase.`case`))
           _ <-
             get(c)
               .procedure

diff --git a/thehive/test/org/thp/thehive/services/CaseSrvTest.scala b/thehive/test/org/thp/thehive/services/CaseSrvTest.scala
@@ -413,6 +413,10 @@ class CaseSrvTest extends PlaySpecification with TestAppBuilder {
         case21.observables.toSeq.size mustEqual 1
         case22.observables.toSeq.size mustEqual 0
         case23.observables.toSeq.size mustEqual 2
+        // Alerts
+        case21.alert.toSeq.size mustEqual 1
+        case22.alert.toSeq.size mustEqual 0
+        case23.alert.toSeq.size mustEqual 0
 
         for {
           c21     <- case21.clone().getOrFail("Case")
@@ -427,6 +431,7 @@ class CaseSrvTest extends PlaySpecification with TestAppBuilder {
           mergedCase.customFields.toSeq.size mustEqual 2
           mergedCase.tasks.toSeq.size mustEqual 3
           mergedCase.observables.toSeq.size mustEqual 3
+          mergedCase.alert.toSeq.size mustEqual 1
 
           app[CaseSrv].get(EntityName("21")).getOrFail("Case") must beAFailedTry
           app[CaseSrv].get(EntityName("22")).getOrFail("Case") must beAFailedTry

diff --git a/thehive/test/resources/data/Alert.json b/thehive/test/resources/data/Alert.json
@@ -78,5 +78,21 @@
     "pap": 2,
     "read": false,
     "follow": true
+  },
+  {
+    "id": "alertMerge1",
+    "type": "testType",
+    "source": "testSource",
+    "sourceRef": "ref6",
+    "title": "alert#6",
+    "description": "description of alert #6",
+    "severity": 2,
+    "date": 1555359572000,
+    "lastSyncDate": 1555359600000,
+    "flag": false,
+    "tlp": 2,
+    "pap": 2,
+    "read": false,
+    "follow": true
   }
 ]
diff --git a/thehive/test/resources/data/AlertCase.json b/thehive/test/resources/data/AlertCase.json
@@ -0,0 +1,3 @@
+[
+  {"from": "alertMerge1", "to": "caseMerge21"}
+]
diff --git a/thehive/test/resources/data/Data.json b/thehive/test/resources/data/Data.json
@@ -10,5 +10,9 @@
   {
     "id": "data-perdu.com",
     "data": "perdu.com"
+  },
+  {
+    "id": "data-merge.fr",
+    "data": "merge.fr"
   }
 ]
diff --git a/thehive/test/resources/data/Observable.json b/thehive/test/resources/data/Observable.json
@@ -50,7 +50,7 @@
   },
   {
     "id": "mergeObs232",
-    "message": "merge Obs 211",
+    "message": "merge Obs 232",
     "tlp": 4,
     "ioc": true,
     "sighted": true

diff --git a/thehive/test/resources/data/ObservableData.json b/thehive/test/resources/data/ObservableData.json
@@ -3,7 +3,7 @@
   {"from": "c.fr", "to": "data-c.fr"},
   {"from": "perdu.com", "to": "data-perdu.com"},
   {"from": "alert-h.fr", "to": "data-h.fr"},
-  {"from": "mergeObs211","to": "data-h.fr"},
-  {"from": "mergeObs231", "to":  "data-c.fr"},
-  {"from": "mergeObs232", "to":  "data-perdu.com"}
+  {"from": "mergeObs211","to": "data-merge.fr"},
+  {"from": "mergeObs231", "to":  "data-merge.fr"},
+  {"from": "mergeObs232", "to":  "data-merge.fr"}
 ]