#1733 Add alert import date as searchable property

TheHive-Project · Jan 7, 2021 · abfb9c0 · abfb9c0
1 parent 762ead3
commit abfb9c0
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 15 deletions.
diff --git a/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala
@@ -450,5 +450,6 @@ class PublicAlert @Inject() (
         case _ => Failure(BadRequestError("Invalid custom fields format"))
       })
       .property("case", db.idMapping)(_.select(_.`case`._id).readonly)
+      .property("importDate", UMapping.date.optional)(_.select(_.importDate).readonly)
       .build
 }
diff --git a/thehive/app/org/thp/thehive/controllers/v1/Properties.scala b/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
@@ -142,6 +142,7 @@ class Properties @Inject() (
             } yield Json.obj("customFields" -> values)
           case _ => Failure(BadRequestError("Invalid custom fields format"))
         })
+      .property("importDate", UMapping.date.optional)(_.select(_.importDate).readonly)
       .build
 
   lazy val audit: PublicProperties =
@@ -193,10 +194,7 @@ class Properties @Inject() (
       .property("pap", UMapping.int)(_.field.updatable)
       .property("status", UMapping.enum[CaseStatus.type])(_.field.updatable)
       .property("summary", UMapping.string.optional)(_.field.updatable)
-      .property("actionRequired", UMapping.boolean)(_
-        .authSelect((t, auth) => t.isActionRequired(auth))
-        .readonly
-      )
+      .property("actionRequired", UMapping.boolean)(_.authSelect((t, auth) => t.isActionRequired(auth)).readonly)
       .property("assignee", UMapping.string.optional)(_.select(_.user.value(_.login)).custom { (_, login, vertex, _, graph, authContext) =>
         for {
           c    <- caseSrv.get(vertex)(graph).getOrFail("Case")
@@ -433,12 +431,9 @@ class Properties @Inject() (
             }
             .map(_ => Json.obj("assignee" -> value))
       })
-      .property("actionRequired", UMapping.boolean)(_
-        .authSelect((t, authContext) => {
-          t.actionRequired(authContext)
-        })
-        .readonly
-      )
+      .property("actionRequired", UMapping.boolean)(_.authSelect { (t, authContext) =>
+        t.actionRequired(authContext)
+      }.readonly)
       .build
 
   lazy val log: PublicProperties =

diff --git a/thehive/app/org/thp/thehive/services/AlertSrv.scala b/thehive/app/org/thp/thehive/services/AlertSrv.scala
@@ -1,6 +1,5 @@
 package org.thp.thehive.services
 
-import org.apache.tinkerpop.gremlin.process.traversal.P
 import org.apache.tinkerpop.gremlin.structure.Graph
 import org.thp.scalligraph.auth.{AuthContext, Permission}
 import org.thp.scalligraph.models._
@@ -399,10 +398,10 @@ object AlertOps {
       else traversal.limit(0)
 
     def imported: Traversal[Boolean, Boolean, IdentityConverter[Boolean]] =
-      traversal
-        .`case`
-        .count
-        .choose(_.is(P.gt(0)), onTrue = true, onFalse = false)
+      traversal.choose(_.outE[AlertCase], onTrue = true, onFalse = false)
+
+    def importDate: Traversal[Date, Date, Converter[Date, Date]] =
+      traversal.outE[AlertCase].value(_._createdAt)
 
     def similarCases(maybeCaseFilter: Option[Traversal.V[Case] => Traversal.V[Case]])(implicit
         authContext: AuthContext