Skip to content

Commit fc4e58b

Browse files
righelrighel
committed
add: analyst data event level
1 parent 2d11b29 commit fc4e58b

5 files changed

+374
-3
lines changed

‎src/mispguard.py

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -492,13 +492,16 @@ def check_event_level_rules(self, rules: dict, event: dict) -> None:
492492
self.check_event_sharing_groups_rules(rules, event)
493493

494494
if "Note" in event["Event"]:
495-
self.check_analyst_data_rules(rules, event["Event"]["Note"])
495+
for note in event["Event"]["Note"]:
496+
self.check_analyst_data_rules(rules, note)
496497

497498
if "Opinion" in event["Event"]:
498-
self.check_analyst_data_rules(rules, event["Event"]["Opinion"])
499+
for opinion in event["Event"]["Opinion"]:
500+
self.check_analyst_data_rules(rules, opinion)
499501

500502
if "Relationship" in event["Event"]:
501-
self.check_analyst_relationship_rules(rules, event["Event"]["Relationship"])
503+
for relationship in event["Event"]["Relationship"]:
504+
self.check_analyst_relationship_rules(rules, relationship)
502505

503506
def check_attribute_level_rules(self, rules: dict, attributes: dict) -> None:
504507
logger.debug("checking attribute level rules")

‎src/test/fixtures/test_event_note_blocked_distribution.json

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"Event": {
3+
"id": "1",
4+
"orgc_id": "1",
5+
"org_id": "1",
6+
"date": "2022-08-31",
7+
"threat_level_id": "1",
8+
"info": "non-blocked",
9+
"published": false,
10+
"uuid": "385283a1-b5e0-4e10-a532-dce11c365a56",
11+
"attribute_count": "4",
12+
"analysis": "0",
13+
"timestamp": "1661956788",
14+
"distribution": "2",
15+
"proposal_email_lock": false,
16+
"locked": false,
17+
"publish_timestamp": "1661956380",
18+
"sharing_group_id": "0",
19+
"disable_correlation": false,
20+
"extends_uuid": "",
21+
"protected": null,
22+
"event_creator_email": "[email protected]",
23+
"Org": {
24+
"id": "1",
25+
"name": "HOST",
26+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
27+
"local": true
28+
},
29+
"Orgc": {
30+
"id": "1",
31+
"name": "HOST",
32+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
33+
"local": true
34+
},
35+
"Attribute": [
36+
{
37+
"id": "1",
38+
"type": "ip-src",
39+
"category": "Network activity",
40+
"to_ids": false,
41+
"uuid": "e37a6c99-c7dc-4e41-8c79-25e35c39df0a",
42+
"event_id": "1",
43+
"distribution": "5",
44+
"timestamp": "1661956302",
45+
"comment": "",
46+
"sharing_group_id": "0",
47+
"deleted": false,
48+
"disable_correlation": false,
49+
"object_id": "0",
50+
"object_relation": null,
51+
"first_seen": null,
52+
"last_seen": null,
53+
"value": "8.8.8.8",
54+
"Galaxy": [],
55+
"ShadowAttribute": []
56+
}
57+
],
58+
"ShadowAttribute": [],
59+
"RelatedEvent": [],
60+
"Galaxy": [],
61+
"Object": [],
62+
"EventReport": [],
63+
"CryptographicKey": [],
64+
"Note": [
65+
{
66+
"id": "1",
67+
"uuid": "9c0e3e20-b1ea-4473-81d2-845c4399c36d",
68+
"object_uuid": "b3eedfc4-8ffa-41a2-875b-6c3d0e4602b8",
69+
"object_type": "Attribute",
70+
"authors": "[email protected]",
71+
"org_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
72+
"orgc_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
73+
"created": "2024-10-04 08:09:39",
74+
"modified": "2024-10-04 08:09:39",
75+
"distribution": "0",
76+
"sharing_group_id": null,
77+
"locked": false,
78+
"note": "Ceci est une note",
79+
"language": "fr-BE",
80+
"note_type": 0,
81+
"note_type_name": "Note",
82+
"Org": {
83+
"id": "1",
84+
"name": "HOST",
85+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
86+
"local": true
87+
},
88+
"Orgc": {
89+
"id": "1",
90+
"name": "HOST",
91+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
92+
"local": true
93+
},
94+
"_canEdit": true
95+
}
96+
]
97+
}
98+
}

‎src/test/fixtures/test_event_opinion_blocked_distribution.json

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"Event": {
3+
"id": "1",
4+
"orgc_id": "1",
5+
"org_id": "1",
6+
"date": "2022-08-31",
7+
"threat_level_id": "1",
8+
"info": "non-blocked",
9+
"published": false,
10+
"uuid": "385283a1-b5e0-4e10-a532-dce11c365a56",
11+
"attribute_count": "4",
12+
"analysis": "0",
13+
"timestamp": "1661956788",
14+
"distribution": "2",
15+
"proposal_email_lock": false,
16+
"locked": false,
17+
"publish_timestamp": "1661956380",
18+
"sharing_group_id": "0",
19+
"disable_correlation": false,
20+
"extends_uuid": "",
21+
"protected": null,
22+
"event_creator_email": "[email protected]",
23+
"Org": {
24+
"id": "1",
25+
"name": "HOST",
26+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
27+
"local": true
28+
},
29+
"Orgc": {
30+
"id": "1",
31+
"name": "HOST",
32+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
33+
"local": true
34+
},
35+
"Attribute": [
36+
{
37+
"id": "1",
38+
"type": "ip-src",
39+
"category": "Network activity",
40+
"to_ids": false,
41+
"uuid": "e37a6c99-c7dc-4e41-8c79-25e35c39df0a",
42+
"event_id": "1",
43+
"distribution": "5",
44+
"timestamp": "1661956302",
45+
"comment": "",
46+
"sharing_group_id": "0",
47+
"deleted": false,
48+
"disable_correlation": false,
49+
"object_id": "0",
50+
"object_relation": null,
51+
"first_seen": null,
52+
"last_seen": null,
53+
"value": "8.8.8.8",
54+
"Galaxy": [],
55+
"ShadowAttribute": []
56+
}
57+
],
58+
"ShadowAttribute": [],
59+
"RelatedEvent": [],
60+
"Galaxy": [],
61+
"Object": [],
62+
"EventReport": [],
63+
"CryptographicKey": [],
64+
"Opinion": [
65+
{
66+
"id": "1",
67+
"uuid": "f43b2e9c-93c3-4d1e-a99a-e0996ced962c",
68+
"object_uuid": "b3eedfc4-8ffa-41a2-875b-6c3d0e4602b8",
69+
"object_type": "Event",
70+
"authors": "[email protected]",
71+
"org_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
72+
"orgc_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
73+
"created": "2024-10-04 08:09:47",
74+
"modified": "2024-10-04 08:09:47",
75+
"distribution": "0",
76+
"sharing_group_id": null,
77+
"locked": false,
78+
"opinion": "75",
79+
"comment": "This is an opinion",
80+
"note_type": 1,
81+
"note_type_name": "Opinion",
82+
"Org": {
83+
"id": "1",
84+
"name": "HOST",
85+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
86+
"local": true
87+
},
88+
"Orgc": {
89+
"id": "1",
90+
"name": "HOST",
91+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
92+
"local": true
93+
},
94+
"_canEdit": true
95+
}
96+
]
97+
}
98+
}

‎src/test/fixtures/test_event_relationship_blocked_distribution.json

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{
2+
"Event": {
3+
"id": "1",
4+
"orgc_id": "1",
5+
"org_id": "1",
6+
"date": "2022-08-31",
7+
"threat_level_id": "1",
8+
"info": "non-blocked",
9+
"published": false,
10+
"uuid": "385283a1-b5e0-4e10-a532-dce11c365a56",
11+
"attribute_count": "4",
12+
"analysis": "0",
13+
"timestamp": "1661956788",
14+
"distribution": "2",
15+
"proposal_email_lock": false,
16+
"locked": false,
17+
"publish_timestamp": "1661956380",
18+
"sharing_group_id": "0",
19+
"disable_correlation": false,
20+
"extends_uuid": "",
21+
"protected": null,
22+
"event_creator_email": "[email protected]",
23+
"Org": {
24+
"id": "1",
25+
"name": "HOST",
26+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
27+
"local": true
28+
},
29+
"Orgc": {
30+
"id": "1",
31+
"name": "HOST",
32+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
33+
"local": true
34+
},
35+
"Attribute": [
36+
{
37+
"id": "1",
38+
"type": "ip-src",
39+
"category": "Network activity",
40+
"to_ids": false,
41+
"uuid": "e37a6c99-c7dc-4e41-8c79-25e35c39df0a",
42+
"event_id": "1",
43+
"distribution": "5",
44+
"timestamp": "1661956302",
45+
"comment": "",
46+
"sharing_group_id": "0",
47+
"deleted": false,
48+
"disable_correlation": false,
49+
"object_id": "0",
50+
"object_relation": null,
51+
"first_seen": null,
52+
"last_seen": null,
53+
"value": "8.8.8.8",
54+
"Galaxy": [],
55+
"ShadowAttribute": []
56+
}
57+
],
58+
"ShadowAttribute": [],
59+
"RelatedEvent": [],
60+
"Galaxy": [],
61+
"Object": [],
62+
"EventReport": [],
63+
"CryptographicKey": [],
64+
"Relationship": [
65+
{
66+
"id": "1",
67+
"uuid": "41146bcb-2869-4cf0-8abb-015e8d1350c9",
68+
"object_uuid": "a81a9424-a62d-4a3d-b402-917d48b124bd",
69+
"object_type": "Attribute",
70+
"authors": "[email protected]",
71+
"org_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
72+
"orgc_uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
73+
"created": "2024-10-30 11:09:13",
74+
"modified": "2024-10-30 11:09:13",
75+
"distribution": "0",
76+
"sharing_group_id": null,
77+
"locked": false,
78+
"relationship_type": "Acquaintance",
79+
"related_object_uuid": "bba62eca-8f51-45c9-ad90-5abaca45d6cd",
80+
"related_object_type": "Event",
81+
"note_type": 2,
82+
"note_type_name": "Relationship",
83+
"Org": {
84+
"id": "1",
85+
"name": "HOST",
86+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
87+
"local": true
88+
},
89+
"Orgc": {
90+
"id": "1",
91+
"name": "HOST",
92+
"uuid": "10c8f445-888b-4a2d-bac8-4e1e8861d595",
93+
"local": true
94+
},
95+
"_canEdit": true,
96+
"related_object": {
97+
"Event": {
98+
"id": "37",
99+
"org_id": "6",
100+
"date": "2022-03-24",
101+
"info": "Test Event",
102+
"user_id": "138",
103+
"uuid": "bba62eca-8f51-45c9-ad90-5abaca45d6cd",
104+
"published": true,
105+
"analysis": "1",
106+
"attribute_count": "11",
107+
"orgc_id": "2",
108+
"timestamp": "1730278463",
109+
"distribution": "3",
110+
"sharing_group_id": "0",
111+
"proposal_email_lock": false,
112+
"locked": true,
113+
"threat_level_id": "2",
114+
"publish_timestamp": "1730278489",
115+
"sighting_timestamp": "0",
116+
"disable_correlation": false,
117+
"extends_uuid": "",
118+
"protected": null
119+
}
120+
}
121+
}
122+
]
123+
}
124+
}

0 commit comments

Comments
 (0)