MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

new: [workflow-modules:add-eventblocklist-entry] Added new action module

feature/workflow-trigger-before-save
Sami Mokaddem 2023-10-19 13:46:14 +02:00
parent 005609ecd4
commit 2a23c1d234
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
2 changed files with 91 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
app/Model/EventBlocklist.php
View File

@ -79,4 +79,14 @@ class EventBlocklist extends AppModel
{
return $this->hasAny(['event_uuid' => $eventUuid]);
}
/**
* @param string $eventUuid
* @return bool
*/
public function addEntry($entry=[])
{
$this->create();
return $this->save($entry);
}
}

81
app/Model/WorkflowModules/action/Module_add_eventblocklist_entry.php Normal file
View File

@ -0,0 +1,81 @@
<?php
include_once APP . 'Model/WorkflowModules/WorkflowBaseModule.php';
class Module_add_eventblocklist_entry extends WorkflowBaseActionModule
{
public $version = '0.1';
public $blocking = false;
public $id = 'add_eventblocklist_entry';
public $name = 'Add Event Blocklist entry';
public $description = 'Create a new entry in the Event blocklist table';
public $icon = 'ban';
public $inputs = 1;
public $outputs = 1;
public $support_filters = false;
public $expect_misp_core_format = true;
public $params = [];
private $EventBlocklist;
private $Organisation;
public function __construct()
{
parent::__construct();
$this->params = [
[
'id' => 'uuid_hash_path',
'label' => 'Event UUID Hash path',
'type' => 'hashpath',
'placeholder' => 'Event.uuid',
'default' => 'Event.uuid',
'hashpath' => [
'is_sub_selector' => true
]
],
[
'id' => 'eventinfo_hash_path',
'label' => 'Event Info Hash path',
'type' => 'hashpath',
'placeholder' => 'Event.info',
'default' => 'Event.info',
'hashpath' => [
'is_sub_selector' => true
]
],
[
'id' => 'block_comment',
'label' => 'Blocklist Comment',
'type' => 'input',
'placeholder' => 'Blocked from workflow',
'default' => 'Blocked from workflow',
],
];
$this->EventBlocklist = ClassRegistry::init('EventBlocklist');
$this->Organisation = ClassRegistry::init('Organisation');
}
public function exec(array $node, WorkflowRoamingData $roamingData, array &$errors = []): bool
{
$params = $this->getParamsWithValues($node);
$rData = $roamingData->getData();
$eventUUIDExtractionPath = $params['uuid_hash_path']['value'];
$eventUUID = Hash::get($rData, $eventUUIDExtractionPath);
$eventInfoExtractionPath = $params['eventinfo_hash_path']['value'];
$eventInfo = Hash::get($rData, $eventInfoExtractionPath);
$comment = $params['block_comment']['value'];
$org = $this->Organisation->find('first', ['conditions' => array('Organisation.id' => $rData['Event']['orgc_id']), 'recursive' => -1, 'fields' => ['Organisation.name']]);
$entry = [
'event_uuid' => $eventUUID,
'event_info' => $eventInfo,
'event_orgc' => !empty($org['Organisation']['name']) ? $org['Organisation']['name'] : 'unkwown',
'comment' => $comment,
];
$r = $this->EventBlocklist->addEntry($entry);
return true;
}
}