#1514 Merge similar observables in alert creation

TheHive-Project · Nov 13, 2020 · 84fb44c · 84fb44c
1 parent 3da1211
commit 84fb44c
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 15 deletions.
diff --git a/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala
@@ -64,7 +64,8 @@ class AlertCtrl @Inject() (
           richObservables <- observables.toTry(createObservable).map(_.flatten)
           richAlert       <- alertSrv.create(request.body("alert").toAlert, organisation, inputAlert.tags, customFields, caseTemplate)
           _               <- auditSrv.mergeAudits(richObservables.toTry(o => alertSrv.addObservable(richAlert.alert, o)))(_ => Success(()))
-        } yield Results.Created((richAlert -> richObservables).toJson)
+          createdObservables = alertSrv.get(richAlert.alert).observables.richObservable.toSeq
+        } yield Results.Created((richAlert -> createdObservables).toJson)
       }
 
   def alertSimilarityRenderer(implicit

diff --git a/thehive/app/org/thp/thehive/services/AlertSrv.scala b/thehive/app/org/thp/thehive/services/AlertSrv.scala
@@ -23,7 +23,7 @@ import org.thp.thehive.services.ObservableOps._
 import org.thp.thehive.services.OrganisationOps._
 import play.api.libs.json.{JsObject, Json}
 
-import scala.util.{Failure, Try}
+import scala.util.{Failure, Success, Try}
 
 @Singleton
 class AlertSrv @Inject() (
@@ -148,19 +148,24 @@ class AlertSrv @Inject() (
       graph: Graph,
       authContext: AuthContext
   ): Try[Unit] = {
-    val alreadyExistInThatCase = observableSrv
-      .get(richObservable.observable)
-      .similar
-      .alert
-      .hasId(alert._id)
-      .exists
-    if (alreadyExistInThatCase)
-      Failure(CreateError("Observable already exists"))
-    else
-      for {
-        _ <- alertObservableSrv.create(AlertObservable(), alert, richObservable.observable)
-        _ <- auditSrv.observableInAlert.create(richObservable.observable, alert, richObservable.toJson)
-      } yield ()
+    val maybeExistingObservable = richObservable.dataOrAttachment match {
+      case Left(data)        => get(alert).observables.filterOnData(data.data)
+      case Right(attachment) => get(alert).observables.has("attachmentId", attachment.attachmentId)
+    }
+    maybeExistingObservable
+      .richObservable
+      .headOption
+      .fold {
+        for {
+          _ <- alertObservableSrv.create(AlertObservable(), alert, richObservable.observable)
+          _ <- auditSrv.observableInAlert.create(richObservable.observable, alert, richObservable.toJson)
+        } yield ()
+      } { existingObservable =>
+        val tags = (existingObservable.tags ++ richObservable.tags).toSet
+        if ((tags -- existingObservable.tags).nonEmpty)
+          observableSrv.updateTags(existingObservable.observable, tags)
+        Success(())
+      }
   }
 
   def createCustomField(