MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

wip: [enrichment] Handling the potential uuids differences 

- We want to be sure the references we add to an
  event are pointing to the right target, so
  when an attribute/object is already in the event
  and is a reference target, we want to point to
  this already existing attribute/object, and not
  to the one we get from the module results, which
  will afterall be skipped.
- Also to to that, attributes already in the event
  are simply not saved, but we need to find in the
  event if an event already exists or not, using
  its attributes
- More care to the references themselves to come
pull/4584/head
chrisr3d 2019-04-19 16:02:23 +02:00
parent 16aefd3756
commit 8c23307808
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 53 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
app/Model/Event.php
View File

@ -5825,6 +5825,7 @@ class Event extends AppModel
$saved_attributes = $saved_objects = $saved_object_attributes = 0;
$items_count = 0;
$failed = array();
$recovered_uuids = array();
foreach (array('Attribute', 'Object') as $feature) {
if (isset($resolved_data[$feature])) {
$items_count += count($resolved_data[$feature]);
@ -5844,6 +5845,15 @@ class Event extends AppModel
$failed_attributes++;
$lastAttributeError = $this->Attribute->validationErrors;
$failed[$attribute['uuid']] = array('Attribute' => $attribute);
$original_uuid = $this->Object->Attribute->find('first', array(
'conditions' => array('Attribute.event_id' => $id, 'Attribute.object_id' => 0, 'Attribute.deleted' => 0,
'Attribute.type' => $attribute['type'], 'Attribute.value' => $attribute['value']),
'recursive' => -1,
'fields' => array('Attribute.uuid')
));
if (!empty($original_uuid)) {
$recovered_uuids[$attribute['uuid']] = $original_uuid['Attribute']['uuid'];
}
}
if ($jobId) {
$current = ($a + 1);
@ -5859,6 +5869,21 @@ class Event extends AppModel
$total_objects = count($resolved_data['Object']);
$references = array();
foreach ($resolved_data['Object'] as $o => $object) {
if (!empty($object['Attribute'])) {
$current_object_id = $this->__findCurrentObjectId($id, $object['Attribute']);
if ($current_object_id) {
$original_uuid = $this->Object->find('first', array(
'conditions' => array('Object.id' => $current_object_id, 'Object.event_id' => $id,
'Object.name' => $object['name'], 'Object.deleted' => 0),
'recursive' => -1,
'fields' => array('Object.uuid')
));
if (!empty($original_uuid)) {
$recovered_uuids[$object['uuid']] = $original_uuid['Object']['uuid'];
}
continue;
}
}
$this->Object->create();
$object['event_id'] = $id;
$object['meta-category'] = $object['meta_category'];
@ -6042,6 +6067,34 @@ class Event extends AppModel
return ($count == 1 ? Inflector::singuralize($scope) : Inflector::pluralize($scope));
}
private function __findCurrentObjectId($event_id, $attributes)
{
$conditions = array();
foreach($attributes as $attribute) {
$conditions[] = array('AND' => array('Attribute.object_relation' => $attribute['object_relation'],
'Attribute.value' => $attribute['value']));
}
$ids = array();
foreach ($this->Object->Attribute->find('all', array(
'conditions' => array(
'Attribute.event_id' => $event_id,
'Attribute.object_id !=' => 0,
'Attribute.deleted' => 0,
'OR' => $conditions
),
'recursive' => -1,
'fields' => array('Attribute.object_id'))) as $found_id) {
$ids[] = $found_id['Attribute']['object_id'];
}
$attributes_count = sizeof($attributes);
foreach (array_count_values($ids) as $id => $count) {
if ($count >= $attributes_count) {
return $id;
}
}
return 0;
}
private function __saveObjectAttribute($attribute, $default_comment, $event_id, $object_id)
{
$attribute['object_id'] = $object_id;