'This is a note', 'note_type' => 0, 'authors' => ['adulau', 'iglocska'], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'Organisation' => ['id' => 23, 'uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'name' => 'ORG_1'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 2, 'id' => 1, 'uuid' => '91bc1aa1-2322-43b9-9aad-c0262e6248b3', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a' ], [ 'analyst_note' => 'This is another note', 'note_type' => 0, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 2, 'uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'name' => 'CIRCL'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 2, 'uuid' => '5a019778-6f0f-4e80-94c5-2e9ec33c9a92', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'notes' => [ [ 'opinion' => 10, 'comment' => 'This is analysis is really bad!', 'note_type' => 1, 'authors' => ['chrisr3d',], 'org_uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'orgc_uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'Organisation' => ['id' => 23, 'uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'name' => 'ORG_1'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 2, 'id' => 6, 'uuid' => 'a3aca875-e5d8-4b74-8a2f-63100f17afe0', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'notes' => [ [ 'opinion' => 100, 'comment' => 'No! It\'s really good!', 'note_type' => 1, 'authors' => ['chrisr3d',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 2, 'uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'name' => 'CIRCL'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 2, 'id' => 7, 'uuid' => '4d8585ea-bf5a-42c2-876b-02b6c9f470e0', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a' ], ] ], [ 'opinion' => 70, 'comment' => 'After further analysis, it\'s OK.', 'note_type' => 1, 'authors' => ['chrisr3d',], 'org_uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'orgc_uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'Organisation' => ['id' => 23, 'uuid' => '27e68e2e-c7a9-4aba-9949-ca3383facb24', 'name' => 'ORG_1'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 0, 'id' => 8, 'uuid' => 'a3aca875-e5d8-4b74-8a2f-63100f17afe0', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', ], ] ], [ 'opinion' => 80, 'comment' => 'This is a second opinion', 'note_type' => 1, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 4, 'uuid' => '41c2ad07-4529-4014-ab8c-0a3f0d6fccc1', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a' ], [ 'opinion' => 50, 'comment' => 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.', 'note_type' => 1, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 5, 'uuid' => '24957461-344c-4b7e-81fe-1321f3e9949a', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a' ], [ 'note_type' => 2, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 6, 'uuid' => 'ecce0325-c7a3-458f-bd88-e8337a15d391', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'related_object_uuid' => 'f80a0db2-24bd-4148-929e-7c803ade7ca1', 'related_object_type' => 'Event', 'relationship_type' => 'related-to', 'comment' => 'Linked to the same campaign', ], [ 'note_type' => 2, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 7, 'uuid' => '7bf1f87c-fdfc-4748-a365-32b5ff39d73e', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'related_object_uuid' => '3d9ed33f-b340-4764-bb97-c30b7d970ceb', 'related_object_type' => 'Attribute', 'relationship_type' => 'included-in', 'comment' => 'Manual correlation based on the context', ], [ 'note_type' => 2, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 2, 'uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'name' => 'CIRCL'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 8, 'uuid' => '72b4127f-1ce9-4ced-86a7-34580f56d834', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'related_object_uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'related_object_type' => 'Organisation', 'relationship_type' => 'spammer', 'comment' => 'This organisation created spam proposals', ], [ 'note_type' => 2, 'authors' => ['mokaddem',], 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 2, 'uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'name' => 'CIRCL'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'id' => 9, 'uuid' => '75cb83a2-4638-47bc-9d36-35fce51b85d9', 'object_uuid' => 'bf74e1a4-99c2-4fcb-8a5d-a71118effd1a', 'related_object_uuid' => '8950f9d6-4ff6-46d7-b3ed-07c3a3e4b1ba', 'related_object_type' => 'Attribute', 'relationship_type' => 'contained-withtin', 'comment' => '', ], ]; $related_objects2 = [ 'Event' => [ 'f80a0db2-24bd-4148-929e-7c803ade7ca1' => [ 'uuid' => 'f80a0db2-24bd-4148-929e-7c803ade7ca1', 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 2, 'uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'name' => 'CIRCL'], 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 2, 'info' => 'Spearphishing incident' ], ], 'Attribute' => [ '3d9ed33f-b340-4764-bb97-c30b7d970ceb' => [ 'uuid' => '3d9ed33f-b340-4764-bb97-c30b7d970ceb', 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'event_id' => 12, 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'value' => '8.8.8.8', 'type' => 'ip-src', 'category' => 'Payload Delivery', ], '8950f9d6-4ff6-46d7-b3ed-07c3a3e4b1ba' => [ 'uuid' => '3d9ed33f-b340-4764-bb97-c30b7d970ceb', 'org_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'orgc_uuid' => '1646fb8f-6f23-4b51-ae80-c84d1ff8fbe0', 'Organisation' => ['id' => 3, 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'name' => 'Training'], 'event_id' => 12, 'created' => new DateTime(), 'modified' => new DateTime(), 'distribution' => 3, 'value' => 'https://circl.lu', 'object_relation' => 'url', 'object_name' => 'url', 'type' => 'url', 'category' => 'Network Activity', ], ], 'Organisation' => [ '5d6d3b30-9db0-44b9-8869-7f56a5e38e14' => [ 'uuid' => '5d6d3b30-9db0-44b9-8869-7f56a5e38e14', 'created' => new DateTime(), 'modified' => new DateTime(), 'name' => ' Training', ], ], ]; $notes = $analyst_data['notes'] ?? []; $opinions = $analyst_data['opinions'] ?? []; $relationships = $analyst_data['relationships'] ?? []; $related_objects = [ 'Attribute' => [], 'Event' => [], 'Object' => [], 'Organisation' => [], 'GalaxyCluster' => [], 'Galaxy' => [], 'Note' => [], 'Opinion' => [], 'SharingGroup' => [], ]; foreach ($relationships as $relationship) { if (!empty($relationship['related_object'][$relationship['related_object_type']])) { $related_objects[$relationship['related_object_type']][$relationship['related_object_uuid']] = $relationship['related_object'][$relationship['related_object_type']]; } } $notesOpinions = array_merge($notes, $opinions); if(!function_exists("countNotes")) { function countNotes($notesOpinions) { $notesTotalCount = count($notesOpinions); $notesCount = 0; $relationsCount = 0; foreach ($notesOpinions as $notesOpinion) { if ($notesOpinion['note_type'] == 2) { // relationship $relationsCount += 1; } else { $notesCount += 1; } if (!empty($notesOpinion['Note'])) { $nestedCounts = countNotes($notesOpinion['Note']); $notesTotalCount += $nestedCounts['total']; $notesCount += $nestedCounts['notesOpinions']; $relationsCount += $nestedCounts['relations']; } if (!empty($notesOpinion['Opinion'])) { $nestedCounts = countNotes($notesOpinion['Opinion']); $notesTotalCount += $nestedCounts['total']; $notesCount += $nestedCounts['notesOpinions']; $relationsCount += $nestedCounts['relations']; } } return ['total' => $notesTotalCount, 'notesOpinions' => $notesCount, 'relations' => $relationsCount]; } } $counts = countNotes($notesOpinions); $notesOpinionCount = $counts['notesOpinions']; $relationshipsCount = count($relationships); ?>