Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Cortex AssignCase #924

Merged
merged 15 commits into from
Jun 3, 2019
Merged

Add Cortex AssignCase #924

Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
dde22c5
Merge pull request #2 from TheHive-Project/develop
zpriddy Feb 21, 2019
8af9700
Merge pull request #3 from TheHive-Project/develop
zpriddy Feb 25, 2019
26c8582
Merge pull request #4 from TheHive-Project/develop
zpriddy Mar 14, 2019
1c2d171
Add AddArtifactToCase
zpriddy Mar 14, 2019
54cd0fc
Fix
zpriddy Mar 14, 2019
758c739
Fix again
zpriddy Mar 14, 2019
1477e37
Learning Scala
zpriddy Mar 14, 2019
e043ab2
Learning Scala
zpriddy Mar 14, 2019
21fa980
Merge remote-tracking branch 'origin/develop' into develop
zpriddy Mar 14, 2019
4ce0223
More Fixes
zpriddy Mar 14, 2019
e31c453
Add assign case
zpriddy Mar 14, 2019
2fd9eb0
fix
zpriddy Mar 14, 2019
692f6d3
Fixes
zpriddy Mar 14, 2019
65332b1
Typo Fix
zpriddy Mar 14, 2019
1a48677
Merge branch 'develop' into cortex_assign_case
zpriddy Mar 28, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 40 additions & 9 deletions thehive-cortex/app/connectors/cortex/services/ActionOperation.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,14 @@ case class AddTagToAlert(tag: String, status: ActionOperationStatus.Type = Actio
override def updateStatus(newStatus: ActionOperationStatus.Type, newMessage: String): AddTagToAlert = copy(status = newStatus, message = newMessage)
}

case class AddArtifactToCase(data: String, dataType: String, dataMessage: String, status: ActionOperationStatus.Type = ActionOperationStatus.Waiting, message: String = "") extends ActionOperation {
override def updateStatus(newStatus: ActionOperationStatus.Type, newMessage: String): AddArtifactToCase = copy(status = newStatus, message = newMessage)
}

case class AssignCase(owner: String, status: ActionOperationStatus.Type = ActionOperationStatus.Waiting, message: String = "") extends ActionOperation {
override def updateStatus(newStatus: ActionOperationStatus.Type, newMessage: String): AssignCase = copy(status = newStatus, message = newMessage)
}

object ActionOperation {
val addTagToCaseWrites = Json.writes[AddTagToCase]
val addTagToArtifactWrites = Json.writes[AddTagToArtifact]
Expand All @@ -74,6 +82,8 @@ object ActionOperation {
val markAlertAsReadWrites = Json.writes[MarkAlertAsRead]
val addLogToTaskWrites = Json.writes[AddLogToTask]
val addTagToAlertWrites = Json.writes[AddTagToAlert]
val addArtifactToCaseWrites = Json.writes[AddArtifactToCase]
val assignCaseWrites = Json.writes[AssignCase]
implicit val actionOperationReads: Reads[ActionOperation] = Reads[ActionOperation](json ⇒
(json \ "type").asOpt[String].fold[JsResult[ActionOperation]](JsError("type is missing in action operation")) {
case "AddTagToCase" ⇒ (json \ "tag").validate[String].map(tag ⇒ AddTagToCase(tag))
Expand All @@ -90,19 +100,29 @@ object ActionOperation {
content ← (json \ "content").validate[String]
owner ← (json \ "owner").validateOpt[String]
} yield AddLogToTask(content, owner)
case "AddArtifactToCase" ⇒ for {
data ← (json \ "data").validate[String]
dataType ← (json \ "dataType").validate[String]
dataMessage ← (json \ "message").validate[String]
} yield AddArtifactToCase(data, dataType, dataMessage)
case "AssignCase" ⇒ for {
owner ← (json \ "owner").validate[String]
} yield AssignCase(owner)
case "AddTagToAlert" ⇒ (json \ "tag").validate[String].map(tag ⇒ AddTagToAlert(tag))
case other ⇒ JsError(s"Unknown operation $other")
})
implicit val actionOperationWrites: Writes[ActionOperation] = Writes[ActionOperation] {
case a: AddTagToCase ⇒ addTagToCaseWrites.writes(a)
case a: AddTagToArtifact ⇒ addTagToArtifactWrites.writes(a)
case a: CreateTask ⇒ createTaskWrites.writes(a)
case a: AddCustomFields ⇒ addCustomFieldsWrites.writes(a)
case a: CloseTask ⇒ closeTaskWrites.writes(a)
case a: MarkAlertAsRead ⇒ markAlertAsReadWrites.writes(a)
case a: AddLogToTask ⇒ addLogToTaskWrites.writes(a)
case a: AddTagToAlert ⇒ addTagToAlertWrites.writes(a)
case a ⇒ Json.obj("unsupported operation" → a.toString)
case a: AddTagToCase ⇒ addTagToCaseWrites.writes(a)
case a: AddTagToArtifact ⇒ addTagToArtifactWrites.writes(a)
case a: CreateTask ⇒ createTaskWrites.writes(a)
case a: AddCustomFields ⇒ addCustomFieldsWrites.writes(a)
case a: CloseTask ⇒ closeTaskWrites.writes(a)
case a: MarkAlertAsRead ⇒ markAlertAsReadWrites.writes(a)
case a: AddLogToTask ⇒ addLogToTaskWrites.writes(a)
case a: AddTagToAlert ⇒ addTagToAlertWrites.writes(a)
case a: AddArtifactToCase ⇒ addArtifactToCaseWrites.writes(a)
case a: AssignCase ⇒ assignCaseWrites.writes(a)
case a ⇒ Json.obj("unsupported operation" → a.toString)
}
}

Expand Down Expand Up @@ -205,6 +225,17 @@ class ActionOperationSrv @Inject() (
task ← findTaskEntity(entity)
_ ← logSrv.create(task, Fields.empty.set("message", content).set("owner", owner.map(JsString)))
} yield operation.updateStatus(ActionOperationStatus.Success, "")
case AddArtifactToCase(data, dataType, dataMessage, _, _) ⇒
for {
initialCase ← findCaseEntity(entity)
artifact ← artifactSrv.create(initialCase.id, Fields.empty.set("data", data).set("dataType", dataType).set("message", dataMessage))
} yield operation.updateStatus(ActionOperationStatus.Success, "")
case AssignCase(owner, _, _) ⇒
for {
initialCase ← findCaseEntity(entity)
caze ← caseSrv.get(initialCase.id)
_ ← caseSrv.update(caze, Fields.empty.set("owner", owner), ModifyConfig(retryOnConflict = 0, version = Some(caze.version)))
} yield operation.updateStatus(ActionOperationStatus.Success, "")
case AddTagToAlert(tag, _, _) ⇒
entity match {
case initialAlert: Alert ⇒
Expand Down