Merge branch 'release/3.1.1'

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Change Log
 
+## [3.1.1](https://github.com/TheHive-Project/TheHive/tree/3.1.1) (2018-10-09)
+
+[Full Changelog](https://github.com/TheHive-Project/TheHive/compare/3.1.0...3.1.1)
+
+**Implemented enhancements:**
+
+- Publish stable versions in beta package channels [\#733](https://github.com/TheHive-Project/TheHive/issues/733)
+- url category to MISP: poll for default [\#732](https://github.com/TheHive-Project/TheHive/issues/732)
+- Change Debian dependencies [\#751](https://github.com/TheHive-Project/TheHive/issues/751)
+
+**Fixed bugs:**
+
+- Console output should not be logged in syslog [\#749](https://github.com/TheHive-Project/TheHive/issues/749)
+- Update breaks RHEL [\#743](https://github.com/TheHive-Project/TheHive/issues/743)
+- Observable Result Icons Not Displaying [\#738](https://github.com/TheHive-Project/TheHive/issues/738)
+- UPN attribute is not correctly lowercased [\#736](https://github.com/TheHive-Project/TheHive/issues/736)
+
+**Closed issues:**
+
+- Artifact tags are overwritten by alert sourceRef during import to case [\#734](https://github.com/TheHive-Project/TheHive/issues/734)
+
 ## [3.1.0](https://github.com/TheHive-Project/TheHive/tree/3.1.0) (2018-09-25)
 [Full Changelog](https://github.com/TheHive-Project/TheHive/compare/3.1.0-RC3...3.1.0)
 
@@ -11,19 +32,20 @@
 
 **Fixed bugs:**
 
+- RPM Updates not available \(404\) [\#719](https://github.com/TheHive-Project/TheHive/issues/719)
+- Observables not being displayed [\#655](https://github.com/TheHive-Project/TheHive/issues/655)
 - TheHive Hyperlinking  [\#723](https://github.com/TheHive-Project/TheHive/issues/723)
 - Multiple responder actions does not seem to be handled [\#722](https://github.com/TheHive-Project/TheHive/issues/722)
 - API allows alert creation with duplicate artifacts [\#720](https://github.com/TheHive-Project/TheHive/issues/720)
 - 3.0.1RC3: certificate based authentication failes as attributes are not correctly lowercased [\#714](https://github.com/TheHive-Project/TheHive/issues/714)
 - Fix PAP labels [\#711](https://github.com/TheHive-Project/TheHive/issues/711)
-- Observables not being displayed [\#655](https://github.com/TheHive-Project/TheHive/issues/655)
 
 **Closed issues:**
 
-- TheHive:Alerts don't send observables to Responders [\#725](https://github.com/TheHive-Project/TheHive/issues/725)
 - Cortex Connector [\#721](https://github.com/TheHive-Project/TheHive/issues/721)
 - Markdown syntex not rendered correctly [\#718](https://github.com/TheHive-Project/TheHive/issues/718)
 - 3.1.0RC3: Search produces errors on screen [\#712](https://github.com/TheHive-Project/TheHive/issues/712)
+- TheHive:Alerts don't send observables to Responders [\#725](https://github.com/TheHive-Project/TheHive/issues/725)
 
 **Merged pull requests:**
 

conf/application.sample

@@ -128,8 +128,9 @@ play.http.parser.maxDiskBuffer=1G
 # Cortex instance a name and specify the associated URL.
 #
 # In order to use Cortex, first you need to enable the Cortex module by uncomment the next line
+
 #play.modules.enabled += connectors.cortex.CortexConnector
-#
+
 cortex {
   #"CORTEX-SERVER-ID" {
   #  url = ""
@@ -149,6 +150,7 @@ cortex {
 # Prior to configuring the integration with a MISP  instance,  you  must
 # enable the MISP connector. This will allow you  to  import  events  to
 # and/or export cases to the MISP instance(s).
+
 #play.modules.enabled += connectors.misp.MispConnector
 
 misp {

debian.sbt

@@ -3,7 +3,7 @@ import Common._
 linuxPackageMappings in Debian += packageMapping(file("LICENSE") -> "/usr/share/doc/thehive/copyright").withPerms("644")
 version in Debian := getVersion(version.value) + '-' + getRelease(version.value)
 debianPackageRecommends := Seq("elasticsearch")
-debianPackageDependencies += "openjdk-8-jre-headless"
+debianPackageDependencies += "java8-runtime | java8-runtime-headless"
 maintainerScripts in Debian := maintainerScriptsFromDirectory(
   baseDirectory.value / "package" / "debian",
   Seq(DebianConstants.Postinst, DebianConstants.Prerm, DebianConstants.Postrm)

package/thehive.service

@@ -15,8 +15,8 @@ ExecStart=/opt/thehive/bin/thehive \
 	-Dlogger.file=/etc/thehive/logback.xml \
 	-Dpidfile.path=/dev/null
 
-StandardOutput=journal
-StandardError=inherit
+StandardOutput=null
+StandardError=null
 
 # Specifies the maximum file descriptor number that can be opened by this process
 LimitNOFILE=65536

project/Bintray.scala

@@ -70,34 +70,56 @@ object Bintray extends AutoPlugin {
 
     publishDebian in ThisBuild := {
       if ((version in ThisBuild).value.endsWith("-SNAPSHOT")) sys.error("Snapshot version can't be released")
-      val repositoryName = if (version.value.contains('-')) "debian-beta" else "debian-stable"
       val file = (debianSign in Debian).value
+      val bintrayCredentials = bintrayEnsureCredentials.value
       btPublish(file.getName,
         file,
-        bintrayEnsureCredentials.value,
+        bintrayCredentials,
         bintrayOrganization.value,
-        repositoryName,
+        "debian-beta",
         bintrayPackage.value,
         version.value,
         sLog.value,
         "deb_distribution" → "any",
         "deb_component" → "main",
         "deb_architecture" → "all"
       )
+      if (!version.value.contains('-'))
+        btPublish(file.getName,
+          file,
+          bintrayCredentials,
+          bintrayOrganization.value,
+          "debian-stable",
+          bintrayPackage.value,
+          version.value,
+          sLog.value,
+          "deb_distribution" → "any",
+          "deb_component" → "main",
+          "deb_architecture" → "all"
+        )
     },
 
     publishRpm in ThisBuild := {
       if ((version in ThisBuild).value.endsWith("-SNAPSHOT")) sys.error("Snapshot version can't be released")
-      val repositoryName = if (version.value.contains('-')) "rpm-beta" else "rpm-stable"
       val file = (packageBin in Rpm).value
+      val bintrayCredentials = bintrayEnsureCredentials.value
       btPublish(file.getName,
         file,
-        bintrayEnsureCredentials.value,
+        bintrayCredentials,
         bintrayOrganization.value,
-        repositoryName,
+        "rpm-beta",
         bintrayPackage.value,
         (version in Rpm).value + '-' + (rpmRelease in Rpm).value,
         sLog.value)
+      if (!version.value.contains('-'))
+        btPublish(file.getName,
+          file,
+          bintrayCredentials,
+          bintrayOrganization.value,
+          "rpm-stable",
+          bintrayPackage.value,
+          (version in Rpm).value + '-' + (rpmRelease in Rpm).value,
+          sLog.value)
     },
 
     publishRpmRelease in ThisBuild := {

project/Dependencies.scala

@@ -20,7 +20,7 @@ object Dependencies {
 
     val reflections = "org.reflections" % "reflections" % "0.9.11"
     val zip4j = "net.lingala.zip4j" % "zip4j" % "1.3.2"
-    val elastic4play = "org.thehive-project" %% "elastic4play" % "1.6.2"
+    val elastic4play = "org.thehive-project" %% "elastic4play" % "1.6.3"
     val akkaCluster = "com.typesafe.akka" %% "akka-cluster" % "2.5.11"
     val akkaClusterTools = "com.typesafe.akka" %% "akka-cluster-tools" % "2.5.11"
   }

rpm.sbt

@@ -16,6 +16,8 @@ linuxPackageSymlinks in Rpm := Nil
 rpmPrefix := Some(defaultLinuxInstallLocation.value)
 linuxEtcDefaultTemplate in Rpm := (baseDirectory.value / "package" / "etc_default_thehive").asURL
 
+linuxPackageMappings in Rpm := configWithNoReplace((linuxPackageMappings in Rpm).value)
+
 packageBin in Rpm := {
   import scala.sys.process._
   val rpmFile = (packageBin in Rpm).value

thehive-backend/app/controllers/Home.scala

@@ -0,0 +1,13 @@
+package controllers
+
+import play.api.Configuration
+import play.api.mvc.{ AbstractController, Action, AnyContent, ControllerComponents }
+
+import javax.inject.{ Inject, Singleton }
+
+@Singleton
+class Home @Inject() (configuration: Configuration, components: ControllerComponents) extends AbstractController(components) {
+  def redirect: Action[AnyContent] = Action {
+    Redirect(configuration.get[String]("play.http.context").stripSuffix("/") + "/index.html")
+  }
+}

thehive-backend/conf/routes

@@ -2,7 +2,7 @@
 # This file defines all application routes (Higher priority routes first)
 # ~~~~
 
-GET      /                                        controllers.Default.redirect(to = "/index.html")
+GET      /                                        controllers.Home.redirect
 GET      /api/status                              controllers.StatusCtrl.get
 GET      /api/health                              controllers.StatusCtrl.health
 GET      /api/logout                              controllers.AuthenticationCtrl.logout()

thehive-misp/app/connectors/misp/MispConverter.scala

@@ -51,7 +51,7 @@ trait MispConverter {
     dataType match {
       case "filename"     ⇒ "Payload delivery" → "filename"
       case "fqdn"         ⇒ "Network activity" → "hostname"
-      case "url"          ⇒ "External analysis" → "url"
+      case "url"          ⇒ "Network activity" → "url"
       case "user-agent"   ⇒ "Network activity" → "user-agent"
       case "domain"       ⇒ "Network activity" → "domain"
       case "ip"           ⇒ "Network activity" → "ip-src"

ui/.gitignore

@@ -4,3 +4,4 @@ bower_components/
 .idea/
 .tmp/
 dist/
+package-lock.json

ui/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "thehive",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "license": "AGPL-3.0",
   "dependencies": {
     "angular": "1.5.8",