mirror of https://github.com/MISP/MISP
new: [workflow-modules:add-eventblocklist-entry] Added new action module
parent
005609ecd4
commit
2a23c1d234
|
@ -79,4 +79,14 @@ class EventBlocklist extends AppModel
|
|||
{
|
||||
return $this->hasAny(['event_uuid' => $eventUuid]);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $eventUuid
|
||||
* @return bool
|
||||
*/
|
||||
public function addEntry($entry=[])
|
||||
{
|
||||
$this->create();
|
||||
return $this->save($entry);
|
||||
}
|
||||
}
|
||||
|
|
|
@ -0,0 +1,81 @@
|
|||
<?php
|
||||
include_once APP . 'Model/WorkflowModules/WorkflowBaseModule.php';
|
||||
|
||||
class Module_add_eventblocklist_entry extends WorkflowBaseActionModule
|
||||
{
|
||||
public $version = '0.1';
|
||||
public $blocking = false;
|
||||
public $id = 'add_eventblocklist_entry';
|
||||
public $name = 'Add Event Blocklist entry';
|
||||
public $description = 'Create a new entry in the Event blocklist table';
|
||||
public $icon = 'ban';
|
||||
public $inputs = 1;
|
||||
public $outputs = 1;
|
||||
public $support_filters = false;
|
||||
public $expect_misp_core_format = true;
|
||||
public $params = [];
|
||||
|
||||
private $EventBlocklist;
|
||||
private $Organisation;
|
||||
|
||||
|
||||
public function __construct()
|
||||
{
|
||||
parent::__construct();
|
||||
$this->params = [
|
||||
[
|
||||
'id' => 'uuid_hash_path',
|
||||
'label' => 'Event UUID Hash path',
|
||||
'type' => 'hashpath',
|
||||
'placeholder' => 'Event.uuid',
|
||||
'default' => 'Event.uuid',
|
||||
'hashpath' => [
|
||||
'is_sub_selector' => true
|
||||
]
|
||||
],
|
||||
[
|
||||
'id' => 'eventinfo_hash_path',
|
||||
'label' => 'Event Info Hash path',
|
||||
'type' => 'hashpath',
|
||||
'placeholder' => 'Event.info',
|
||||
'default' => 'Event.info',
|
||||
'hashpath' => [
|
||||
'is_sub_selector' => true
|
||||
]
|
||||
],
|
||||
[
|
||||
'id' => 'block_comment',
|
||||
'label' => 'Blocklist Comment',
|
||||
'type' => 'input',
|
||||
'placeholder' => 'Blocked from workflow',
|
||||
'default' => 'Blocked from workflow',
|
||||
],
|
||||
];
|
||||
|
||||
$this->EventBlocklist = ClassRegistry::init('EventBlocklist');
|
||||
$this->Organisation = ClassRegistry::init('Organisation');
|
||||
}
|
||||
|
||||
public function exec(array $node, WorkflowRoamingData $roamingData, array &$errors = []): bool
|
||||
{
|
||||
$params = $this->getParamsWithValues($node);
|
||||
|
||||
$rData = $roamingData->getData();
|
||||
|
||||
$eventUUIDExtractionPath = $params['uuid_hash_path']['value'];
|
||||
$eventUUID = Hash::get($rData, $eventUUIDExtractionPath);
|
||||
$eventInfoExtractionPath = $params['eventinfo_hash_path']['value'];
|
||||
$eventInfo = Hash::get($rData, $eventInfoExtractionPath);
|
||||
$comment = $params['block_comment']['value'];
|
||||
|
||||
$org = $this->Organisation->find('first', ['conditions' => array('Organisation.id' => $rData['Event']['orgc_id']), 'recursive' => -1, 'fields' => ['Organisation.name']]);
|
||||
$entry = [
|
||||
'event_uuid' => $eventUUID,
|
||||
'event_info' => $eventInfo,
|
||||
'event_orgc' => !empty($org['Organisation']['name']) ? $org['Organisation']['name'] : 'unkwown',
|
||||
'comment' => $comment,
|
||||
];
|
||||
$r = $this->EventBlocklist->addEntry($entry);
|
||||
return true;
|
||||
}
|
||||
}
|
Loading…
Reference in New Issue