-
Notifications
You must be signed in to change notification settings - Fork 640
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
#1410 Add extra data for cases and observables
- Loading branch information
Showing
11 changed files
with
198 additions
and
83 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87 changes: 87 additions & 0 deletions
87
thehive/app/org/thp/thehive/controllers/v1/CaseRenderer.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package org.thp.thehive.controllers.v1 | ||
|
|
||
| import java.util.{Map => JMap} | ||
|
|
||
| import gremlin.scala.{__, By, Graph, GremlinScala, Key, Vertex} | ||
| import org.thp.scalligraph.auth.AuthContext | ||
| import org.thp.scalligraph.models.Database | ||
| import org.thp.scalligraph.steps.StepsOps._ | ||
| import org.thp.scalligraph.steps.Traversal | ||
| import org.thp.thehive.models.AlertCase | ||
| import org.thp.thehive.services.CaseSteps | ||
| import play.api.libs.json._ | ||
|
|
||
| import scala.collection.JavaConverters._ | ||
|
|
||
| trait CaseRenderer { | ||
|
|
||
| def observableStats( | ||
| caseSteps: CaseSteps | ||
| )(implicit authContext: AuthContext): Traversal[JsValue, JsValue] = | ||
| caseSteps | ||
| .share | ||
| .observables | ||
| .count | ||
| .map(count => Json.obj("count" -> count)) | ||
|
|
||
| def taskStats(caseSteps: CaseSteps)(implicit authContext: AuthContext): Traversal[JsValue, JsValue] = | ||
| caseSteps | ||
| .share | ||
| .tasks | ||
| .active | ||
| .groupCount(By(Key[String]("status"))) | ||
| .map { statusAgg => | ||
| val (total, result) = statusAgg.asScala.foldLeft(0L -> JsObject.empty) { | ||
| case ((t, r), (k, v)) => (t + v) -> (r + (k -> JsNumber(v.toInt))) | ||
| } | ||
| result + ("total" -> JsNumber(total)) | ||
| } | ||
|
|
||
| def alertStats(caseSteps: CaseSteps): Traversal[JsValue, JsValue] = | ||
| caseSteps | ||
| .inTo[AlertCase] | ||
| .group(By(Key[String]("type")), By(Key[String]("source"))) | ||
| .map { alertAgg => | ||
| JsArray( | ||
| alertAgg | ||
| .asScala | ||
| .flatMap { | ||
| case (tpe, listOfSource) => | ||
| listOfSource.asScala.map(s => Json.obj("type" -> tpe, "source" -> s)) | ||
| } | ||
| .toSeq | ||
| ) | ||
| } | ||
|
|
||
| def isOwnerStats( | ||
| caseSteps: CaseSteps | ||
| )(implicit authContext: AuthContext): Traversal[JsValue, JsValue] = | ||
| caseSteps.origin.name.map(org => JsBoolean(org == authContext.organisation)) | ||
|
|
||
| def shareCountStats(caseSteps: CaseSteps): Traversal[JsValue, JsValue] = | ||
| caseSteps.organisations.count.map(JsNumber.apply(_)) | ||
|
|
||
| def caseStatsRenderer(extraData: Set[String])( | ||
| implicit authContext: AuthContext, | ||
| db: Database, | ||
| graph: Graph | ||
| ): CaseSteps => Traversal[JsObject, JsObject] = { | ||
| def addData(f: CaseSteps => Traversal[JsValue, JsValue]): GremlinScala[JMap[String, JsValue]] => GremlinScala[JMap[String, JsValue]] = | ||
| _.by(f(new CaseSteps(__[Vertex])).raw.traversal) | ||
|
|
||
| if (extraData.isEmpty) _.constant(JsObject.empty) | ||
| else { | ||
| val dataName = extraData.toSeq | ||
| dataName | ||
| .foldLeft[CaseSteps => GremlinScala[JMap[String, JsValue]]](_.raw.project(dataName.head, dataName.tail: _*)) { | ||
| case (f, "observableStats") => f.andThen(addData(observableStats)) | ||
| case (f, "taskStats") => f.andThen(addData(taskStats)) | ||
| case (f, "alerts") => f.andThen(addData(alertStats)) | ||
| case (f, "isOwner") => f.andThen(addData(isOwnerStats)) | ||
| case (f, "shareCount") => f.andThen(addData(shareCountStats)) | ||
| case (f, _) => f.andThen(_.by(__.constant(JsNull).traversal)) | ||
| } | ||
| .andThen(f => Traversal(f.map(m => JsObject(m.asScala)))) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 40 additions & 27 deletions
67
thehive/app/org/thp/thehive/controllers/v1/ObservableRenderer.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,50 +1,63 @@ | ||
| package org.thp.thehive.controllers.v1 | ||
|
|
||
| import gremlin.scala.{__, By, Graph, Key, Vertex} | ||
| import javax.inject.Named | ||
| import java.util.{Map => JMap} | ||
|
|
||
| import gremlin.scala.{__, By, Graph, GremlinScala, Key, Vertex} | ||
| import org.thp.scalligraph.auth.AuthContext | ||
| import org.thp.scalligraph.models.Database | ||
| import org.thp.scalligraph.steps.StepsOps._ | ||
| import org.thp.scalligraph.steps.Traversal | ||
| import org.thp.thehive.controllers.v0.Conversion._ | ||
| import org.thp.thehive.services.ObservableSteps | ||
| import play.api.libs.json.{JsObject, Json} | ||
| import play.api.libs.json._ | ||
|
|
||
| import scala.collection.JavaConverters._ | ||
|
|
||
| trait ObservableRenderer { | ||
|
|
||
| def observableStatsRenderer( | ||
| implicit authContext: AuthContext, | ||
| @Named("with-thehive-schema") db: Database, | ||
| graph: Graph | ||
| ): ObservableSteps => Traversal[JsObject, JsObject] = | ||
| _.project( | ||
| _.apply(By(new ObservableSteps(__[Vertex]).shares.organisation.name.fold.raw)) | ||
| .and( | ||
| By( | ||
| new ObservableSteps(__[Vertex]) | ||
| .similar | ||
| .visible | ||
| .groupCount(By(Key[Boolean]("ioc"))) | ||
| .raw | ||
| ) | ||
| ) | ||
| ).map { | ||
| case (organisationNames, stats) => | ||
| def seenStats(observableSteps: ObservableSteps)(implicit authContext: AuthContext): Traversal[JsValue, JsValue] = | ||
| observableSteps | ||
| .similar | ||
| .visible | ||
| .groupCount(By(Key[Boolean]("ioc"))) | ||
| .map { stats => | ||
| val m = stats.asScala | ||
| val nTrue = m.get(true).fold(0L)(_.toLong) | ||
| val nFalse = m.get(false).fold(0L)(_.toLong) | ||
| Json.obj( | ||
| "shares" -> organisationNames.asScala, | ||
| "seen" -> (nTrue + nFalse), | ||
| "ioc" -> (nTrue > 0) | ||
| "seen" -> (nTrue + nFalse), | ||
| "ioc" -> (nTrue > 0) | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| def sharesStats(observableSteps: ObservableSteps): Traversal[JsValue, JsValue] = | ||
| observableSteps.shares.organisation.name.fold.map(orgs => Json.toJson(orgs.asScala)) | ||
|
|
||
| def observableLinkRenderer: ObservableSteps => Traversal[JsObject, JsObject] = | ||
| _.coalesce( | ||
| def observableLinks(observableSteps: ObservableSteps): Traversal[JsValue, JsValue] = | ||
| observableSteps.coalesce( | ||
| _.alert.richAlert.map(a => Json.obj("alert" -> a.toJson)), | ||
| _.`case`.richCaseWithoutPerms.map(c => Json.obj("case" -> c.toJson)) | ||
| ) | ||
|
|
||
| def observableStatsRenderer(extraData: Set[String])( | ||
| implicit authContext: AuthContext, | ||
| db: Database, | ||
| graph: Graph | ||
| ): ObservableSteps => Traversal[JsObject, JsObject] = { | ||
| def addData(f: ObservableSteps => Traversal[JsValue, JsValue]): GremlinScala[JMap[String, JsValue]] => GremlinScala[JMap[String, JsValue]] = | ||
| _.by(f(new ObservableSteps(__[Vertex])).raw.traversal) | ||
|
|
||
| if (extraData.isEmpty) _.constant(JsObject.empty) | ||
| else { | ||
| val dataName = extraData.toSeq | ||
| dataName | ||
| .foldLeft[ObservableSteps => GremlinScala[JMap[String, JsValue]]](_.raw.project(dataName.head, dataName.tail: _*)) { | ||
| case (f, "seen") => f.andThen(addData(seenStats)) | ||
| case (f, "shares") => f.andThen(addData(sharesStats)) | ||
| case (f, "links") => f.andThen(addData(observableLinks)) | ||
| case (f, _) => f.andThen(_.by(__.constant(JsNull).traversal)) | ||
| } | ||
| .andThen(f => Traversal(f.map(m => JsObject(m.asScala)))) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.