MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

Added event ID/UUID to the event filters and attribute search 

- enter a UUID in the event ID field of the attribute search to find attributes belonging to a certain event
- use event IDs / UUIDs to filter events on the event index
pull/542/merge
Iglocska 2015-08-18 15:37:49 +02:00
parent 9b38ab0a6c
commit 76b8aacc4c
3 changed files with 42 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
app/Controller/AttributesController.php
View File

@ -1177,9 +1177,17 @@ class AttributesController extends AppController {
$saveWord = trim($keywordArrayElement);
if (empty($saveWord)) continue;
if ($saveWord[0] == '!') {
$temp[] = array('Attribute.event_id !=' => substr($saveWord, 1));
if (strlen(substr($saveWord, 1)) == 36) {
$temp[] = array('Event.uuid !=' => substr($saveWord, 1));
} else {
$temp[] = array('Attribute.event_id !=' => substr($saveWord, 1));
}
} else {
$temp['OR'][] = array('Attribute.event_id =' => $saveWord);
if (strlen($saveWord) == 36) {
$temp['OR'][] = array('Event.uuid =' => $saveWord);
} else {
$temp['OR'][] = array('Attribute.event_id =' => $saveWord);
}
}
if ($i == 1 && $saveWord != '') $keyWordText2 = $saveWord;
else if (($i > 1 && $i < 10) && $saveWord != '') $keyWordText2 = $keyWordText2 . ', ' . $saveWord;

26
app/Controller/EventsController.php
View File

@ -301,6 +301,28 @@ class EventsController extends AppController {
if ($v == 2) continue 2;
$this->paginate['conditions']['AND'][] = array('Event.' . substr($k, 6) . ' =' => $v);
break;
case 'eventid':
if ($v == "") continue 2;
$pieces = explode('|', $v);
$temp = array();
foreach ($pieces as $piece) {
$piece = trim($piece);
if ($piece[0] == '!') {
if (strlen($piece) == 37) {
$this->paginate['conditions']['AND'][] = array('Event.uuid !=' => substr($piece, 1));
} else {
$this->paginate['conditions']['AND'][] = array('Event.id !=' => substr($piece, 1));
}
} else {
if (strlen($piece) == 36) {
$temp['OR'][] = array('Event.uuid' => $piece);
} else {
$temp['OR'][] = array('Event.id' => $piece);
}
}
}
$this->paginate['conditions']['AND'][] = $temp;
break;
case 'Datefrom' :
if ($v == "") continue 2;
$this->paginate['conditions']['AND'][] = array('Event.date >=' => $v);
@ -484,6 +506,7 @@ class EventsController extends AppController {
'published' => 2,
'org' => array('OR' => array(), 'NOT' => array()),
'tag' => array('OR' => array(), 'NOT' => array()),
'eventid' => array('OR' => array(), 'NOT' => array()),
'date' => array('from' => "", 'until' => ""),
'eventinfo' => array('OR' => array(), 'NOT' => array()),
'threatlevel' => array('OR' => array(), 'NOT' => array()),
@ -506,6 +529,7 @@ class EventsController extends AppController {
$filtering['date']['until'] = $v;
break;
case 'org' :
case 'eventid' :
case 'tag' :
case 'eventinfo' :
case 'attribute' :
@ -545,7 +569,7 @@ class EventsController extends AppController {
'conditions' => $conditions,
'group' => 'orgc'
));
$rules = array('published', 'tag', 'date', 'eventinfo', 'threatlevel', 'distribution', 'analysis', 'attribute');
$rules = array('published', 'eventid', 'tag', 'date', 'eventinfo', 'threatlevel', 'distribution', 'analysis', 'attribute');
if (Configure::read('MISP.showorg')){
$orgs = array();
foreach ($events as $e) {

8
app/View/Events/filter_event_index.ctp
View File

@ -87,6 +87,12 @@
'style' => 'display:none;width:424px;',
'div' => false
));
echo $this->Form->input('searcheventid', array(
'label' => false,
'class' => 'input-large',
'style' => 'display:none;width:424px;',
'div' => false
));
echo $this->Form->input('searchattribute', array(
'label' => false,
'class' => 'input-large',
@ -179,7 +185,7 @@ var operators = ["OR", "NOT"];
var allFields = ["published", "tag", "date", "eventinfo", "threatlevel", "distribution", "analysis", "attribute"];
var simpleFilters = ["tag", "eventinfo", "threatlevel", "distribution", "analysis", "attribute"];
var simpleFilters = ["tag", "eventinfo", "threatlevel", "distribution", "analysis", "attribute", "eventid"];
var differentFilters = ["published", "date"];