#2385 Add query filters on observables

TheHive-Project · May 12, 2022 · b8b0073 · b8b0073
1 parent 5ad9b05
commit b8b0073
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
@@ -428,7 +428,13 @@ class PublicObservable @Inject() (
       (observableSteps, authContext) => observableSteps.filteredSimilar.visible(organisationSrv)(authContext)
     ),
     Query[Traversal.V[Observable], Traversal.V[Case]]("case", (observableSteps, _) => observableSteps.`case`),
-    Query[Traversal.V[Observable], Traversal.V[Alert]]("alert", (observableSteps, _) => observableSteps.alert)
+    Query[Traversal.V[Observable], Traversal.V[Alert]]("alert", (observableSteps, _) => observableSteps.alert),
+    Query[Traversal.V[Observable], Traversal.V[Observable]]("fromCase", (observableSteps, _) => observableSteps.filter(_.shares)),
+    Query[Traversal.V[Observable], Traversal.V[Observable]]("fromAlert", (observableSteps, _) => observableSteps.filter(_.alert)),
+    Query[Traversal.V[Observable], Traversal.V[Observable]](
+      "fromJobReport",
+      (observableSteps, _) => observableSteps.filter(_.inE("ReportObservable"))
+    )
   )
   override val publicProperties: PublicProperties = PublicPropertyListBuilder[Observable]
     .property("status", UMapping.string)(_.select(_.constant("Ok")).readonly)

diff --git a/thehive/app/org/thp/thehive/controllers/v1/ObservableCtrl.scala b/thehive/app/org/thp/thehive/controllers/v1/ObservableCtrl.scala
@@ -105,7 +105,13 @@ class ObservableCtrl @Inject() (
     ),
     Query[Traversal.V[Observable], Traversal.V[Case]]("case", (observableSteps, _) => observableSteps.`case`),
     Query[Traversal.V[Observable], Traversal.V[Alert]]("alert", (observableSteps, _) => observableSteps.alert),
-    Query[Traversal.V[Observable], Traversal.V[Share]]("shares", (observableSteps, authContext) => observableSteps.shares.visible(authContext))
+    Query[Traversal.V[Observable], Traversal.V[Share]]("shares", (observableSteps, authContext) => observableSteps.shares.visible(authContext)),
+    Query[Traversal.V[Observable], Traversal.V[Observable]]("fromCase", (observableSteps, _) => observableSteps.filter(_.shares)),
+    Query[Traversal.V[Observable], Traversal.V[Observable]]("fromAlert", (observableSteps, _) => observableSteps.filter(_.alert)),
+    Query[Traversal.V[Observable], Traversal.V[Observable]](
+      "fromJobReport",
+      (observableSteps, _) => observableSteps.filter(_.inE("ReportObservable"))
+    )
   )
 
   def createInCase(caseId: String): Action[AnyContent] =