-
Notifications
You must be signed in to change notification settings - Fork 634
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
#2384 Add support of operations in analyzer reports
- Loading branch information
Showing
8 changed files
with
122 additions
and
58 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,9 +7,10 @@ import org.thp.scalligraph.models.{Database, DummyUserSrv, Schema} | |
| import org.thp.scalligraph.traversal.TraversalOps._ | ||
| import org.thp.scalligraph.{AppBuilder, EntityName} | ||
| import org.thp.thehive.TestAppBuilder | ||
| import org.thp.thehive.connector.cortex.models.{Job, JobStatus, TheHiveCortexSchemaProvider} | ||
| import org.thp.thehive.connector.cortex.models.{ActionOperationStatus, Job, JobStatus, TheHiveCortexSchemaProvider} | ||
| import org.thp.thehive.connector.cortex.services.JobOps._ | ||
| import org.thp.thehive.models.Permissions | ||
| import org.thp.thehive.services.CaseOps._ | ||
| import org.thp.thehive.services.ObservableOps._ | ||
| import org.thp.thehive.services.UserOps._ | ||
| import org.thp.thehive.services._ | ||
|
|
@@ -23,7 +24,8 @@ import scala.concurrent.duration.DurationInt | |
| import scala.io.Source | ||
|
|
||
| class JobSrvTest extends PlaySpecification with TestAppBuilder { | ||
| implicit val authContext: AuthContext = DummyUserSrv(userId = "[email protected]", permissions = Permissions.all).authContext | ||
| implicit val authContext: AuthContext = | ||
| DummyUserSrv(userId = "[email protected]", organisation = "cert", permissions = Permissions.all).authContext | ||
| override def appConfigure: AppBuilder = | ||
| super | ||
| .appConfigure | ||
|
|
@@ -33,53 +35,76 @@ class JobSrvTest extends PlaySpecification with TestAppBuilder { | |
| .`override`(_.bindToProvider[Schema, TheHiveCortexSchemaProvider]) | ||
|
|
||
| "job service" should { | ||
| val cortexOutputJob = { | ||
| val dataSource = Source.fromResource("cortex-jobs.json") | ||
| val data = dataSource.mkString | ||
| dataSource.close() | ||
| Json.parse(data).as[List[OutputJob]].find(_.id == "ZWu85Q1OCVNx03hXK4df").get | ||
| } | ||
|
|
||
| "handle creation and then finished job" in testApp { app => | ||
| // val job = Job( | ||
| // workerId = "anaTest2", | ||
| // workerName = "anaTest2", | ||
| // workerDefinition = "test2", | ||
| // status = JobStatus.Waiting, | ||
| // startDate = new Date(1561625908856L), | ||
| // endDate = new Date(1561625908856L), | ||
| // report = None, | ||
| // cortexId = "test", | ||
| // cortexJobId = "LVyYKFstq3Rtrdc9DFmL" | ||
| // ) | ||
| // | ||
| // val cortexOutputJob = { | ||
| // val dataSource = Source.fromResource("cortex-jobs.json") | ||
| // val data = dataSource.mkString | ||
| // dataSource.close() | ||
| // Json.parse(data).as[List[OutputJob]].find(_.id == "ZWu85Q1OCVNx03hXK4df").get | ||
| // } | ||
| // | ||
| // val createdJobTry = app[Database].tryTransaction { implicit graph => | ||
| // for { | ||
| // observable <- app[ObservableSrv].startTraversal.has(_.message, "hello world").getOrFail("Observable") | ||
| // createdJob <- app[JobSrv].create(job, observable) | ||
| // } yield createdJob | ||
| // } | ||
| // createdJobTry.map { createdJob => | ||
| // Await.result(app[JobSrv].finished(app[CortexClient].name, createdJob._id, cortexOutputJob), 20.seconds) | ||
| // } must beASuccessfulTry.which { updatedJob => | ||
| // updatedJob.status shouldEqual JobStatus.Success | ||
| // updatedJob.report must beSome | ||
| // (updatedJob.report.get \ "data").as[String] shouldEqual "imageedit_2_3904987689.jpg" | ||
| // | ||
| // app[Database].roTransaction { implicit graph => | ||
| // app[JobSrv].get(updatedJob).observable.has(_.message, "hello world").exists must beTrue | ||
| // app[JobSrv].get(updatedJob).reportObservables.toList.length must equalTo(2).updateMessage { s => | ||
| // s"$s\nreport observables are : ${app[JobSrv].get(updatedJob).reportObservables.richObservable.toList.mkString("\n")}" | ||
| // } | ||
| // | ||
| // for { | ||
| // audit <- app[AuditSrv].startTraversal.has(_.objectId, updatedJob._id.toString).getOrFail("Audit") | ||
| // organisation <- app[OrganisationSrv].getByName("cert").getOrFail("Organisation") | ||
| // user <- app[UserSrv].startTraversal.getByName("[email protected]").getOrFail("User") | ||
| // } yield new JobFinished().filter(audit, Some(updatedJob), organisation, Some(user)) | ||
| // } must beASuccessfulTry(true) | ||
| // } | ||
| pending("flaky test") | ||
| val job = Job( | ||
| workerId = "anaTest2", | ||
| workerName = "anaTest2", | ||
| workerDefinition = "test2", | ||
| status = JobStatus.Waiting, | ||
| startDate = new Date(1561625908856L), | ||
| endDate = new Date(1561625908856L), | ||
| report = None, | ||
| cortexId = "test", | ||
| cortexJobId = "LVyYKFstq3Rtrdc9DFmL", | ||
| operations = Nil | ||
| ) | ||
|
|
||
| val createdJobTry = app[Database].tryTransaction { implicit graph => | ||
| for { | ||
| observable <- app[ObservableSrv].startTraversal.has(_.message, "hello world").getOrFail("Observable") | ||
| createdJob <- app[JobSrv].create(job, observable) | ||
| } yield createdJob | ||
| } | ||
| val finishedJobTry = createdJobTry.map { createdJob => | ||
| Await.result(app[JobSrv].finished(app[CortexClient].name, createdJob._id, cortexOutputJob), 20.seconds) | ||
| } | ||
| finishedJobTry must beASuccessfulTry | ||
| val updatedJob = finishedJobTry.get | ||
| updatedJob.status shouldEqual JobStatus.Success | ||
| updatedJob.report must beSome | ||
| (updatedJob.report.get \ "data").as[String] shouldEqual "imageedit_2_3904987689.jpg" | ||
| updatedJob.operations must haveSize(1) | ||
| updatedJob.operations.map(o => (o \ "status").as[String]) must contain(beEqualTo("Success")) | ||
| .forall | ||
| .updateMessage(s => s"$s\nOperation has failed: ${updatedJob.operations.map("\n -" + _).mkString}") | ||
|
|
||
| app[Database].roTransaction { implicit graph => | ||
| app[JobSrv].get(updatedJob).observable.has(_.message, "hello world").exists must beTrue | ||
| val reportObservables = app[JobSrv].get(updatedJob).reportObservables.toSeq | ||
| reportObservables.length must equalTo(2).updateMessage { s => | ||
| s"$s\nreport observables are : ${app[JobSrv].get(updatedJob).reportObservables.richObservable.toList.mkString("\n")}" | ||
| } | ||
| val ipObservable = reportObservables.find(_.dataType == "ip").get | ||
| ipObservable.data must beSome("192.168.1.1") | ||
| ipObservable.message must beSome("myIp") | ||
| ipObservable.tags must contain(exactly("tag-test")) | ||
| ipObservable.tlp must beEqualTo(2) | ||
|
|
||
| val operationObservableMaybe = app[JobSrv] | ||
| .get(updatedJob) | ||
| .observable | ||
| .`case` | ||
| .observables | ||
| .has(_.message, "test-operation") | ||
| .headOption | ||
| operationObservableMaybe must beSome.which { operationObservable => | ||
| operationObservable.data must beSome("myData") | ||
| operationObservable.tlp must beEqualTo(3) | ||
| operationObservable.tags must contain(exactly("tag1", "tag2")) | ||
| } | ||
| for { | ||
| audit <- app[AuditSrv].startTraversal.has(_.objectId, updatedJob._id.toString).getOrFail("Audit") | ||
| organisation <- app[OrganisationSrv].getByName("cert").getOrFail("Organisation") | ||
| user <- app[UserSrv].startTraversal.getByName("[email protected]").getOrFail("User") | ||
| } yield JobFinished.filter(audit, Some(updatedJob), organisation, Some(user)) | ||
| } must beASuccessfulTry(true).setMessage("The audit doesn't match the expected criteria") | ||
| } | ||
|
|
||
| "submit a job" in testApp { app => | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -479,7 +479,8 @@ trait Conversion { | |
| endDate, | ||
| report, | ||
| cortexId, | ||
| cortexJobId | ||
| cortexJobId, | ||
| Nil | ||
| ) | ||
| ) | ||
| } | ||
|
|
||