Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddArtifactToCase for cortex #923

Closed
wants to merge 10 commits into from
Closed

AddArtifactToCase for cortex #923

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
dde22c5
Merge pull request #2 from TheHive-Project/develop
zpriddy Feb 21, 2019
8af9700
Merge pull request #3 from TheHive-Project/develop
zpriddy Feb 25, 2019
26c8582
Merge pull request #4 from TheHive-Project/develop
zpriddy Mar 14, 2019
1c2d171
Add AddArtifactToCase
zpriddy Mar 14, 2019
54cd0fc
Fix
zpriddy Mar 14, 2019
758c739
Fix again
zpriddy Mar 14, 2019
1477e37
Learning Scala
zpriddy Mar 14, 2019
e043ab2
Learning Scala
zpriddy Mar 14, 2019
21fa980
Merge remote-tracking branch 'origin/develop' into develop
zpriddy Mar 14, 2019
4ce0223
More Fixes
zpriddy Mar 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions thehive-cortex/app/connectors/cortex/services/ActionOperation.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,10 @@ case class AddTagToAlert(tag: String, status: ActionOperationStatus.Type = Actio
override def updateStatus(newStatus: ActionOperationStatus.Type, newMessage: String): AddTagToAlert = copy(status = newStatus, message = newMessage)
}

case class AddArtifactToCase(data: String, dataType: String, dataMessage: String, status: ActionOperationStatus.Type = ActionOperationStatus.Waiting, message: String = "") extends ActionOperation {
override def updateStatus(newStatus: ActionOperationStatus.Type, newMessage: String): AddArtifactToCase = copy(status = newStatus, message = newMessage)
}

object ActionOperation {
val addTagToCaseWrites = Json.writes[AddTagToCase]
val addTagToArtifactWrites = Json.writes[AddTagToArtifact]
Expand All @@ -74,6 +78,7 @@ object ActionOperation {
val markAlertAsReadWrites = Json.writes[MarkAlertAsRead]
val addLogToTaskWrites = Json.writes[AddLogToTask]
val addTagToAlertWrites = Json.writes[AddTagToAlert]
val addArtifactToCaseWrites = Json.writes[AddArtifactToCase]
implicit val actionOperationReads: Reads[ActionOperation] = Reads[ActionOperation](json ⇒
(json \ "type").asOpt[String].fold[JsResult[ActionOperation]](JsError("type is missing in action operation")) {
case "AddTagToCase" ⇒ (json \ "tag").validate[String].map(tag ⇒ AddTagToCase(tag))
Expand All @@ -91,6 +96,11 @@ object ActionOperation {
owner ← (json \ "owner").validateOpt[String]
} yield AddLogToTask(content, owner)
case "AddTagToAlert" => (json \ "tag").validate[String].map(tag ⇒ AddTagToAlert(tag))
case "AddArtifactToCase" ⇒ for {
data ← (json \ "data").validate[String]
dataType ← (json \ "dataType").validate[String]
dataMessage ← (json \ "message").validate[String]
} yield AddArtifactToCase(data, dataType, dataMessage)
case other ⇒ JsError(s"Unknown operation $other")
})
implicit val actionOperationWrites: Writes[ActionOperation] = Writes[ActionOperation] {
Expand All @@ -102,6 +112,7 @@ object ActionOperation {
case a: MarkAlertAsRead ⇒ markAlertAsReadWrites.writes(a)
case a: AddLogToTask ⇒ addLogToTaskWrites.writes(a)
case a: AddTagToAlert ⇒ addTagToAlertWrites.writes(a)
case a: AddArtifactToCase ⇒ addArtifactToCaseWrites.writes(a)
case a ⇒ Json.obj("unsupported operation" → a.toString)
}
}
Expand Down Expand Up @@ -205,6 +216,11 @@ class ActionOperationSrv @Inject() (
task ← findTaskEntity(entity)
_ ← logSrv.create(task, Fields.empty.set("message", content).set("owner", owner.map(JsString)))
} yield operation.updateStatus(ActionOperationStatus.Success, "")
case AddArtifactToCase(data, dataType, dataMessage, _, _) ⇒
for {
initialCase ← findCaseEntity(entity)
artifact ← artifactSrv.create(initialCase.id, Fields.empty.set("data", data).set("dataType", dataType).set("message", dataMessage))
} yield operation.updateStatus(ActionOperationStatus.Success, "")
case AddTagToAlert(tag, _, _) =>
entity match {
case initialAlert: Alert ⇒
Expand Down