MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

count & GFI Sandbox 

count # attributes in events index.
plus various fixes for distribution in correlation of a GFI Sandbox
upload.
pull/63/head
noud 2012-11-14 16:14:04 +01:00
parent ec2b20334f
commit 6b06ba7ff6
6 changed files with 43 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/Controller/AppController.php
View File

@ -420,6 +420,17 @@ class AppController extends Controller {
}
}
public function generateCount() {
if (!self::_isAdmin()) throw new NotFoundException();
$this->loadModel('Attribute');
$attributes = $this->Attribute->find('all', array('recursive' => 0));
// for all attributes..
foreach ($attributes as $attribute) {
$this->Attribute->save($attribute);
}
}
// CakePHP returns false if filesize is 0 at lib/cake/Utility/File.php:384
public function checkEmpty($fileP = '/var/www/cydefsig/app/files/test') {
// Check if there were problems with the file upload

5
app/Controller/AttributesController.php
View File

@ -742,4 +742,9 @@ class AttributesController extends AppController {
$this->set('categories', $this->Attribute->validate['category']['rule'][1]);
}
public function checkComposites() {
if (!self::_isAdmin()) throw new NotFoundException();
$this->set('fails', $this->Attribute->checkComposites());
}
}

1
app/MYSQL.event.sql Normal file
View File

@ -0,0 +1 @@
alter table events add column attribute_count int(11) UNSIGNED DEFAULT NULL;

1
app/MYSQL.txt
View File

@ -88,6 +88,7 @@ CREATE TABLE `events` (
`revision` int(10) NOT NULL DEFAULT '0',
`private` tinyint(1) NOT NULL,
`cluster` tinyint(1) NOT NULL,
`attribute_count` int(11) UNSIGNED DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin AUTO_INCREMENT=1 ;

30
app/Model/Attribute.php
View File

@ -329,7 +329,8 @@ class Attribute extends AppModel {
'foreignKey' => 'event_id',
'conditions' => '',
'fields' => '',
'order' => ''
'order' => '',
'counterCache' => true
)
);
@ -774,9 +775,10 @@ class Attribute extends AppModel {
$this->create();
$this->data['Attribute']['event_id'] = $eventId;
if ($malware) {
$md5 = !$tmpfile->size() ? md5_file($fileP) : $tmpfile->md5() ;
$this->data['Attribute']['category'] = $category ? $category : "Payload delivery";
$this->data['Attribute']['type'] = "malware-sample";
$this->data['Attribute']['value'] = $fullFileName ? $fullFileName . '|' . $tmpfile->md5() : $filename . '|' . $tmpfile->md5(); // TODO gives problems with bigger files
$this->data['Attribute']['value'] = $fullFileName ? $fullFileName . '|' . $md5 : $filename . '|' . $md5; // TODO gives problems with bigger files
$this->data['Attribute']['to_ids'] = 1; // LATER let user choose to send this to IDS
} else {
$this->data['Attribute']['category'] = $category ? $category : "Artifacts dropped";
@ -879,8 +881,8 @@ class Attribute extends AppModel {
foreach ($attributes as $attributeFound) {
$this->Correlation->read(null, $attributeFound['Correlation']['id']);
$this->Correlation->set(array(
'private' => $attribute['private'],
'cluster' => $attribute['cluster']
'private' => isset($attribute['private']) ? $attribute['private'] : false,
'cluster' => isset($attribute['cluster']) ? $attribute['cluster'] : false,
));
$this->Correlation->save();
}
@ -889,7 +891,7 @@ class Attribute extends AppModel {
foreach ($attributes as $attributeFound) {
$this->Correlation->read(null, $attributeFound['Correlation']['id']);
$this->Correlation->set(array(
'1_private' => $attribute['private'],
'1_private' => isset($attribute['private']) ? $attribute['private'] : false,
));
$this->Correlation->save();
}
@ -914,7 +916,7 @@ class Attribute extends AppModel {
$this->Correlation->create();
$this->Correlation->save(array(
'Correlation' => array(
'1_event_id' => $attribute['event_id'], '1_attribute_id' => $attribute['id'], '1_private' => $attribute['private'],
'1_event_id' => $attribute['event_id'], '1_attribute_id' => $attribute['id'], '1_private' => isset($attribute['private']) ? $attribute['private'] : false,
'event_id' => $relatedAttribute['Attribute']['event_id'], 'attribute_id' => $relatedAttribute['Attribute']['id'],
'org' => $eventDate['Event']['org'],
'private' => $relatedAttribute['Attribute']['private'],
@ -936,8 +938,8 @@ class Attribute extends AppModel {
'1_event_id' => $relatedAttribute['Attribute']['event_id'], '1_attribute_id' => $relatedAttribute['Attribute']['id'], '1_private' => $relatedAttribute['Attribute']['private'],
'event_id' => $attribute['event_id'], 'attribute_id' => $attribute['id'],
'org' => $eventDate['Event']['org'],
'private' => $attribute['private'],
'cluster' => $attribute['cluster'],
'private' => isset($attribute['private']) ? $attribute['private'] : false,
'cluster' => isset($attribute['cluster']) ? $attribute['cluster'] : false,
'date' => $eventDate['Event']['date']))
);
}
@ -982,4 +984,16 @@ class Attribute extends AppModel {
}
}
public function checkComposites() {
$compositeTypes = $this->getCompositeTypes();
$fails = array();
$attributes = $this->find('all',array('recursive' => 0));
foreach ($attributes as $attribute) {
if ((in_array($attribute['Attribute']['type'], $compositeTypes)) && (!strlen($attribute['Attribute']['value1']) || !strlen($attribute['Attribute']['value2']))) {
$fails[] = $attribute['Attribute']['event_id'] . ':' . $attribute['Attribute']['id'];
}
}
return $fails;
}
}

4
app/View/Events/index.ctp
View File

@ -6,6 +6,7 @@
<th><?php echo $this->Paginator->sort('org');?></th>
<?php endif; ?>
<th><?php echo $this->Paginator->sort('id');?></th>
<th><?php echo $this->Paginator->sort('attribute_count', '#');?></th>
<?php if ('true' == Configure::read('CyDefSIG.showowner') || $isAdmin): ?>
<th><?php echo $this->Paginator->sort('user_id', 'Email');?></th>
<?php endif; ?>
@ -38,7 +39,8 @@
<td class="short">
<?php echo $this->Html->link($event['Event']['id'], array('controller' => 'events', 'action' => 'view', $event['Event']['id'])); ?>
&nbsp;</td>
<td class="short" onclick="document.location ='<?php echo $this->Html->url(array('action' => 'view', $event['Event']['id']), true);?>';">
<?php echo $event['Event']['attribute_count']; ?>&nbsp;</td>
<?php if ('true' == Configure::read('CyDefSIG.showowner') || $isAdmin): ?>
<td class="short" onclick="document.location ='<?php echo $this->Html->url(array('action' => 'view', $event['Event']['id']), true);?>';">
<?php echo h($event['User']['email']); ?>&nbsp;</td>