6520 Renamed Correlation Engine to Central Repository

This commit is contained in:
Ethan Roseman 2020-06-18 11:14:57 -04:00
parent 06a5804d34
commit 0746c6dfd6
18 changed files with 54 additions and 48 deletions

View File

@ -1,9 +1,9 @@
OpenIDE-Module-Name=Central Repository OpenIDE-Module-Name=Central Repository
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Short-Description=Correlation Engine Ingest Module OpenIDE-Module-Short-Description=Central Repository Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Correlation Engine ingest module and central database. \n\n\ Central Repository ingest module and central database. \n\n\
The Correlation Engine ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\ The Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest. Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest.
CentralRepoCommentDialog.commentLabel.text=Comment: CentralRepoCommentDialog.commentLabel.text=Comment:
CentralRepoCommentDialog.okButton.text=&OK CentralRepoCommentDialog.okButton.text=&OK

View File

@ -4,10 +4,10 @@ AddEditCentralRepoCommentAction.menuItemText.addEditCentralRepoCommentNoMD5=Add/
CentralRepoCommentDialog.title.addEditCentralRepoComment=Add/Edit Central Repository Comment CentralRepoCommentDialog.title.addEditCentralRepoComment=Add/Edit Central Repository Comment
OpenIDE-Module-Name=Central Repository OpenIDE-Module-Name=Central Repository
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Short-Description=Correlation Engine Ingest Module OpenIDE-Module-Short-Description=Central Repository Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Correlation Engine ingest module and central database. \n\n\ Central Repository ingest module and central database. \n\n\
The Correlation Engine ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\ The Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest. Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest.
CentralRepoCommentDialog.commentLabel.text=Comment: CentralRepoCommentDialog.commentLabel.text=Comment:
CentralRepoCommentDialog.okButton.text=&OK CentralRepoCommentDialog.okButton.text=&OK

View File

@ -28,7 +28,7 @@ import org.sleuthkit.datamodel.TskDataException;
/** /**
* *
* Stores information about a Data Source in the correlation engine * Stores information about a Data Source in the Central Repository
* *
*/ */
public class CorrelationDataSource implements Serializable { public class CorrelationDataSource implements Serializable {

View File

@ -1679,7 +1679,7 @@ abstract class RdbmsCentralRepo implements CentralRepository {
bulkArtifacts.get(tableName).clear(); bulkArtifacts.get(tableName).clear();
} }
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Correlation Engine: Bulk insert"); TimingMetric timingMetric = HealthMonitor.getTimingMetric("Central Repository: Bulk insert");
HealthMonitor.submitTimingMetric(timingMetric); HealthMonitor.submitTimingMetric(timingMetric);
// Reset state // Reset state

View File

@ -1,5 +1,5 @@
caseeventlistener.evidencetag=Evidence caseeventlistener.evidencetag=Evidence
IngestEventsListener.ingestmodule.name=Correlation Engine IngestEventsListener.ingestmodule.name=Central Repository
IngestEventsListener.prevCaseComment.text=Previous Case: IngestEventsListener.prevCaseComment.text=Previous Case:
# {0} - typeName # {0} - typeName
# {1} - count # {1} - count

View File

@ -73,7 +73,7 @@ import org.sleuthkit.datamodel.CommunicationsUtils;
* Listen for ingest events and update entries in the Central Repository * Listen for ingest events and update entries in the Central Repository
* database accordingly * database accordingly
*/ */
@NbBundle.Messages({"IngestEventsListener.ingestmodule.name=Correlation Engine"}) @NbBundle.Messages({"IngestEventsListener.ingestmodule.name=Central Repository"})
public class IngestEventsListener { public class IngestEventsListener {
private static final Logger LOGGER = Logger.getLogger(CorrelationAttributeInstance.class.getName()); private static final Logger LOGGER = Logger.getLogger(CorrelationAttributeInstance.class.getName());
@ -116,24 +116,24 @@ public class IngestEventsListener {
/** /**
* Increase the number of IngestEventsListeners adding contents to the * Increase the number of IngestEventsListeners adding contents to the
* Correlation Engine. * Central Repository.
*/ */
public synchronized static void incrementCorrelationEngineModuleCount() { public synchronized static void incrementCorrelationEngineModuleCount() {
correlationModuleInstanceCount++; //Should be called once in the Correlation Engine module's startup method. correlationModuleInstanceCount++; //Should be called once in the Central Repository module's startup method.
} }
/** /**
* Decrease the number of IngestEventsListeners adding contents to the * Decrease the number of IngestEventsListeners adding contents to the
* Correlation Engine. * Central Repository.
*/ */
public synchronized static void decrementCorrelationEngineModuleCount() { public synchronized static void decrementCorrelationEngineModuleCount() {
if (getCeModuleInstanceCount() > 0) { //prevent it ingestJobCounter from going negative if (getCeModuleInstanceCount() > 0) { //prevent it ingestJobCounter from going negative
correlationModuleInstanceCount--; //Should be called once in the Correlation Engine module's shutdown method. correlationModuleInstanceCount--; //Should be called once in the Central Repository module's shutdown method.
} }
} }
/** /**
* Reset the counter which keeps track of if the Correlation Engine Module * Reset the counter which keeps track of if the Central Repository Module
* is being run during injest to 0. * is being run during injest to 0.
*/ */
synchronized static void resetCeModuleInstanceCount() { synchronized static void resetCeModuleInstanceCount() {
@ -141,10 +141,10 @@ public class IngestEventsListener {
} }
/** /**
* Whether or not the Correlation Engine Module is enabled for any of the * Whether or not the Central Repository Module is enabled for any of the
* currently running ingest jobs. * currently running ingest jobs.
* *
* @return boolean True for Correlation Engine enabled, False for disabled * @return boolean True for Central Repository enabled, False for disabled
*/ */
public synchronized static int getCeModuleInstanceCount() { public synchronized static int getCeModuleInstanceCount() {
return correlationModuleInstanceCount; return correlationModuleInstanceCount;
@ -282,7 +282,7 @@ public class IngestEventsListener {
@Override @Override
public void propertyChange(PropertyChangeEvent evt) { public void propertyChange(PropertyChangeEvent evt) {
//if ingest is running we want there to check if there is a Correlation Engine module running //if ingest is running we want there to check if there is a Central Repository module running
//sometimes artifacts are generated by DSPs or other sources while ingest is not running //sometimes artifacts are generated by DSPs or other sources while ingest is not running
//in these cases we still want to create correlation attributesForNewArtifact for those artifacts when appropriate //in these cases we still want to create correlation attributesForNewArtifact for those artifacts when appropriate
if (!IngestManager.getInstance().isIngestRunning() || getCeModuleInstanceCount() > 0) { if (!IngestManager.getInstance().isIngestRunning() || getCeModuleInstanceCount() > 0) {
@ -349,7 +349,7 @@ public class IngestEventsListener {
if (getCeModuleInstanceCount() == 0) { if (getCeModuleInstanceCount() == 0) {
recentlyAddedCeArtifacts.clear(); recentlyAddedCeArtifacts.clear();
} }
//else another instance of the Correlation Engine Module is still being run. //else another instance of the Central Repository Module is still being run.
/* /*
* Ensure the data source in the Central Repository has hash values * Ensure the data source in the Central Repository has hash values

View File

@ -1,6 +1,6 @@
CentralRepoIngestModel_name_header=Name:<br> CentralRepoIngestModel_name_header=Name:<br>
CentralRepoIngestModel_previous_case_header=<br>Previous Cases:<br> CentralRepoIngestModel_previous_case_header=<br>Previous Cases:<br>
CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module. CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Central Repository ingest module.
CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized
CentralRepoIngestModule.prevCaseComment.text=Previous Case: CentralRepoIngestModule.prevCaseComment.text=Previous Case:
CentralRepoIngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository) CentralRepoIngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)
@ -8,7 +8,7 @@ CentralRepoIngestModule_notable_message_header=<html>A file in this data source
# {0} - Name of file that is Notable # {0} - Name of file that is Notable
CentralRepoIngestModule_postToBB_knownBadMsg=Notable: {0} CentralRepoIngestModule_postToBB_knownBadMsg=Notable: {0}
CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation
CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine CentralRepoIngestModuleFactory.ingestmodule.name=Central Repository
IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings
IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases

View File

@ -85,7 +85,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
private final boolean createCorrelationProperties; private final boolean createCorrelationProperties;
/** /**
* Instantiate the Correlation Engine ingest module. * Instantiate the Central Repository ingest module.
* *
* @param settings The ingest settings for the module instance. * @param settings The ingest settings for the module instance.
*/ */
@ -147,7 +147,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
*/ */
if (abstractFile.getKnown() != TskData.FileKnown.KNOWN && flagTaggedNotableItems) { if (abstractFile.getKnown() != TskData.FileKnown.KNOWN && flagTaggedNotableItems) {
try { try {
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Correlation Engine: Notable artifact query"); TimingMetric timingMetric = HealthMonitor.getTimingMetric("Central Repository: Notable artifact query");
List<String> caseDisplayNamesList = dbManager.getListCasesHavingArtifactInstancesKnownBad(filesType, md5); List<String> caseDisplayNamesList = dbManager.getListCasesHavingArtifactInstancesKnownBad(filesType, md5);
HealthMonitor.submitTimingMetric(timingMetric); HealthMonitor.submitTimingMetric(timingMetric);
if (!caseDisplayNamesList.isEmpty()) { if (!caseDisplayNamesList.isEmpty()) {
@ -220,7 +220,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
// see ArtifactManagerTimeTester for details // see ArtifactManagerTimeTester for details
@Messages({ @Messages({
"CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized", "CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized",
"CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module." "CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Central Repository ingest module."
}) })
@Override @Override
public void startUp(IngestJobContext context) throws IngestModuleException { public void startUp(IngestJobContext context) throws IngestModuleException {
@ -235,7 +235,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
* posited. * posited.
* *
* Note: Flagging cannot be disabled if any other instances of the * Note: Flagging cannot be disabled if any other instances of the
* Correlation Engine module are running. This restriction is to prevent * Central Repository module are running. This restriction is to prevent
* missing results in the case where the first module is flagging * missing results in the case where the first module is flagging
* notable items, and the proceeding module (with flagging disabled) * notable items, and the proceeding module (with flagging disabled)
* causes the first to stop flagging. * causes the first to stop flagging.
@ -276,7 +276,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
// Don't allow sqlite central repo databases to be used for multi user cases // Don't allow sqlite central repo databases to be used for multi user cases
if ((autopsyCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) if ((autopsyCase.getCaseType() == Case.CaseType.MULTI_USER_CASE)
&& (CentralRepoDbManager.getSavedDbChoice().getDbPlatform() == CentralRepoPlatforms.SQLITE)) { && (CentralRepoDbManager.getSavedDbChoice().getDbPlatform() == CentralRepoPlatforms.SQLITE)) {
logger.log(Level.SEVERE, "Cannot run correlation engine on a multi-user case with a SQLite central repository."); logger.log(Level.SEVERE, "Cannot run Central Repository ingest module on a multi-user case with a SQLite central repository.");
throw new IngestModuleException("Cannot run on a multi-user case with a SQLite central repository."); // NON-NLS throw new IngestModuleException("Cannot run on a multi-user case with a SQLite central repository."); // NON-NLS
} }
jobId = context.getJobId(); jobId = context.getJobId();

View File

@ -33,7 +33,7 @@ import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings;
* Factory for Central Repository ingest modules * Factory for Central Repository ingest modules
*/ */
@ServiceProvider(service = org.sleuthkit.autopsy.ingest.IngestModuleFactory.class) @ServiceProvider(service = org.sleuthkit.autopsy.ingest.IngestModuleFactory.class)
@NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine", @NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Central Repository",
"CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation"}) "CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation"})
public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter { public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter {

View File

@ -21,7 +21,7 @@ package org.sleuthkit.autopsy.centralrepository.ingestmodule;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
/** /**
* Ingest job settings for the Correlation Engine module. * Ingest job settings for the Central Repository module.
*/ */
final class IngestSettings implements IngestModuleIngestJobSettings { final class IngestSettings implements IngestModuleIngestJobSettings {

View File

@ -22,7 +22,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
/** /**
* Ingest job settings panel for the Correlation Engine module. * Ingest job settings panel for the Central Repository module.
*/ */
@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives @SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
final class IngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { final class IngestSettingsPanel extends IngestModuleIngestJobSettingsPanel {

View File

@ -862,7 +862,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
/** /**
* If the settings reflect that a inter-case search is being performed, * If the settings reflect that a inter-case search is being performed,
* checks that the data sources in the current case have been processed with * checks that the data sources in the current case have been processed with
* Correlation Engine enabled and exist in the central repository. Prompting * Central Repository enabled and exist in the central repository. Prompting
* the user as to whether they still want to perform the search in the case * the user as to whether they still want to perform the search in the case
* any data sources are unprocessed. If the settings reflect that a * any data sources are unprocessed. If the settings reflect that a
* intra-case search is being performed, it just performs the search. * intra-case search is being performed, it just performs the search.
@ -870,7 +870,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
* Notes: - Does not check that the data sources were processed into the * Notes: - Does not check that the data sources were processed into the
* current central repository instead of another. - Does not check that the * current central repository instead of another. - Does not check that the
* appropriate modules to make all correlation types available were run. - * appropriate modules to make all correlation types available were run. -
* Does not check if the correlation engine was run with any of the * Does not check if the Central Repository was run with any of the
* correlation properties properties disabled. * correlation properties properties disabled.
*/ */
@Messages({"CommonAttributePanel.incompleteResults.introText=Results may be incomplete. Not all data sources in the current case were ingested into the current Central Repository. The following data sources have not been processed:", @Messages({"CommonAttributePanel.incompleteResults.introText=Results may be incomplete. Not all data sources in the current case were ingested into the current Central Repository. The following data sources have not been processed:",
@ -902,14 +902,14 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
//if the datasource was previously processed we do not need to perform this check //if the datasource was previously processed we do not need to perform this check
for (CorrelationDataSource correlatedDataSource : correlatedDataSources) { for (CorrelationDataSource correlatedDataSource : correlatedDataSources) {
if (deviceID.equals(correlatedDataSource.getDeviceID())) { if (deviceID.equals(correlatedDataSource.getDeviceID())) {
//if the datasource exists in the central repository it may of been processed with the correlation engine //if the datasource exists in the central repository it may of been processed with the Central Repository
dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.IN_CENTRAL_REPO); dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.IN_CENTRAL_REPO);
break; break;
} }
} }
} }
if (dataSourceCorrelationMap.get(dataSource) == CorrelatedStatus.IN_CENTRAL_REPO) { if (dataSourceCorrelationMap.get(dataSource) == CorrelatedStatus.IN_CENTRAL_REPO) {
//if the data source was in the central repository check if any of the modules run on it were the correlation engine //if the data source was in the central repository check if any of the modules run on it were the Central Repository
for (IngestModuleInfo ingestModuleInfo : jobInfo.getIngestModuleInfo()) { for (IngestModuleInfo ingestModuleInfo : jobInfo.getIngestModuleInfo()) {
if (correlationEngineModuleName.equals(ingestModuleInfo.getDisplayName())) { if (correlationEngineModuleName.equals(ingestModuleInfo.getDisplayName())) {
dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.CORRELATED); dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.CORRELATED);

View File

@ -35,6 +35,8 @@ AnnotationsContentViewer.title=Annotations
AnnotationsContentViewer.toolTip=Displays tags and comments associated with the selected content. AnnotationsContentViewer.toolTip=Displays tags and comments associated with the selected content.
ApplicationContentViewer.title=Application ApplicationContentViewer.title=Application
ApplicationContentViewer.toolTip=Displays file contents. ApplicationContentViewer.toolTip=Displays file contents.
CallLogArtifactViewer_crdisbaled_persona_button_text=Create
CallLogArtifactViewer_crdisbaled_persona_label=Unknown
CallLogArtifactViewer_number_from=From CallLogArtifactViewer_number_from=From
CallLogArtifactViewer_number_to=To CallLogArtifactViewer_number_to=To
CallLogArtifactViewer_persona_button_new=Create CallLogArtifactViewer_persona_button_new=Create
@ -49,6 +51,7 @@ ContactArtifactViewer_persona_button_view=View
ContactArtifactViewer_persona_label=Persona ContactArtifactViewer_persona_label=Persona
ContactArtifactViewer_persona_searching=\ Searching... ContactArtifactViewer_persona_searching=\ Searching...
ContactArtifactViewer_persona_text_none=None found ContactArtifactViewer_persona_text_none=None found
ContactArtifactViewer_persona_unknown=Unknown
DataContentViewerArtifact.failedToGetAttributes.message=Failed to get some or all attributes from case database DataContentViewerArtifact.failedToGetAttributes.message=Failed to get some or all attributes from case database
DataContentViewerArtifact.failedToGetSourcePath.message=Failed to get source file path from case database DataContentViewerArtifact.failedToGetSourcePath.message=Failed to get source file path from case database
DefaultArtifactContentViewer.attrsTableHeader.sources=Source(s) DefaultArtifactContentViewer.attrsTableHeader.sources=Source(s)
@ -1084,7 +1087,7 @@ MessageArtifactViewer.rtfbodyScrollPane.TabConstraints.tabTitle=RTF
MessageArtifactViewer.toText.text=to list goes here MessageArtifactViewer.toText.text=to list goes here
MessageArtifactViewer.toLabel.text=To: MessageArtifactViewer.toLabel.text=To:
MessageArtifactViewer.htmlPane.TabConstraints.tabTitle=HTML MessageArtifactViewer.htmlPane.TabConstraints.tabTitle=HTML
CallLogArtifactViewer.localAccountPersonaLabel.text=Persona: CallLogArtifactViewer.localAccountPersonaLabel.text=Persona
CallLogArtifactViewer.localAccountPersonaNameLabel.text=jLabel1 CallLogArtifactViewer.localAccountPersonaNameLabel.text=jLabel1
CallLogArtifactViewer.localAccountPersonaButton.text=jButton1 CallLogArtifactViewer.localAccountPersonaButton.text=jButton1
ContactArtifactViewer.personasLabel.text=Personas ContactArtifactViewer.personasLabel.text=Personas

View File

@ -993,7 +993,7 @@ public final class HealthMonitor implements PropertyChangeListener {
} }
String[] metricNames = {"Disk Reads: Hash calculation", "Database: getImages query", "Solr: Index chunk", "Solr: Connectivity check", String[] metricNames = {"Disk Reads: Hash calculation", "Database: getImages query", "Solr: Index chunk", "Solr: Connectivity check",
"Correlation Engine: Notable artifact query", "Correlation Engine: Bulk insert"}; // NON-NLS "Central Repository: Notable artifact query", "Central Repository: Bulk insert"}; // NON-NLS
Random rand = new Random(); Random rand = new Random();

View File

@ -471,6 +471,9 @@ public final class IngestJobSettings {
case "Archive Extractor": //NON-NLS case "Archive Extractor": //NON-NLS
moduleNames.add("Embedded File Extractor"); //NON-NLS moduleNames.add("Embedded File Extractor"); //NON-NLS
break; break;
case "Correlation Engine": //NON-NLS
moduleNames.add("Central Repository"); //NON-NLS
break;
default: default:
moduleNames.add(name); moduleNames.add(name);
} }

View File

@ -22,7 +22,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
/** /**
* Ingest job settings panel for the Correlation Engine module. * Ingest job settings panel for the Central Repository module.
*/ */
@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives @SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJobSettingsPanel {

View File

@ -17,9 +17,9 @@ The following are some use cases for the central repository:
\section cr_terms Terms and Concepts \section cr_terms Terms and Concepts
- <b>Central Repository</b> - The Autopsy feature containing the central repository database and Correlation Engine Ingest Module. Also responsible for displaying correlated properties to the user - <b>Central Repository</b> - The Autopsy feature containing the central repository database and Central Repository Ingest Module. Also responsible for displaying correlated properties to the user
- <b>Central Repository Database</b> - the SQLite or PostgreSQL database that holds all the data - <b>Central Repository Database</b> - the SQLite or PostgreSQL database that holds all the data
- <b>Correlation Engine Ingest Module</b> - The ingest module responsible for adding new properties to the database and comparing these properties against existing notable properties - <b>Central Repository Ingest Module</b> - The ingest module responsible for adding new properties to the database and comparing these properties against existing notable properties
- <b>Property</b> - The data being stored/correlated. These can be file paths/MD5 hashes, email addresses, phone numbers, etc. - <b>Property</b> - The data being stored/correlated. These can be file paths/MD5 hashes, email addresses, phone numbers, etc.
\section cr_setup Setup \section cr_setup Setup
@ -80,7 +80,7 @@ Enter or browse to a folder for the database. If the database file does not exis
\subsection cr_manage_properties Manage Correlation Properties \subsection cr_manage_properties Manage Correlation Properties
The Correlation Engine ingest module can save different types of properties to the database. By default all properties are recorded, but The Central Repository ingest module can save different types of properties to the database. By default all properties are recorded, but
this setting can be changed on the options panel through the Manage Correlation Properties button. Note that these settings this setting can be changed on the options panel through the Manage Correlation Properties button. Note that these settings
are saved to the database, so in a multi-user setting any changes will affect all users. are saved to the database, so in a multi-user setting any changes will affect all users.
@ -130,18 +130,18 @@ Displays a list of all cases that are in the central repository database and det
\section cr_using_repo Using the Central Repository \section cr_using_repo Using the Central Repository
\subsection cr_ingest_module Correlation Engine Module \subsection cr_ingest_module Central Repository Module
The Correlation Engine ingest module is responsible for adding properties to the database and comparing each property The Central Repository ingest module is responsible for adding properties to the database and comparing each property
against the list of notable properties. It is best to run all ingest modules to get the most out of the Correlation against the list of notable properties. It is best to run all ingest modules to get the most out of the Correlation
Engine. For example, if Hash Lookup is not run then the Correlation Engine module will not put any files into the Engine. For example, if Hash Lookup is not run then the Central Repository module will not put any files into the
database. If the Correlation Engine module is not run on a particular case but a central repository is enabled, database. If the Central Repository module is not run on a particular case but a central repository is enabled,
there will still be some limited functionality. The Content Viewer will still display matching properties from there will still be some limited functionality. The Content Viewer will still display matching properties from
other cases/data sources where the Correlation Engine was run. other cases/data sources where the Central Repository was run.
\image html central_repo_ingest_settings.png \image html central_repo_ingest_settings.png
There are three settings for the Correlation Engine ingest module: There are three settings for the Central Repository ingest module:
<ul> <ul>
<li><b>Save items to the Central Repository</b> - This should only be unselected in the rare case that you don't want to add any properties from the current data source to the central repository, but still want to flag past occurrences. <li><b>Save items to the Central Repository</b> - This should only be unselected in the rare case that you don't want to add any properties from the current data source to the central repository, but still want to flag past occurrences.
<li><b>Flag items previously tagged as notable</b> - Enabling this causes Interesting Item/File artifacts to be created when properties matching those previously flagged are found. See the next section \ref cr_tagging for details. <li><b>Flag items previously tagged as notable</b> - Enabling this causes Interesting Item/File artifacts to be created when properties matching those previously flagged are found. See the next section \ref cr_tagging for details.
@ -169,7 +169,7 @@ are still added to the central repository.
\section cr_viewing_results Viewing Results \section cr_viewing_results Viewing Results
Results from enabling a central repository and running the Correlation Engine Ingest Module can be seen in two places: Results from enabling a central repository and running the Central Repository Ingest Module can be seen in two places:
- The Content Viewer for each file or artifact will display all matching properties from other cases/data sources - The Content Viewer for each file or artifact will display all matching properties from other cases/data sources
- The Interesting Files node of the result tree will contain any files or results that matched properties previously marked as notable - The Interesting Files node of the result tree will contain any files or results that matched properties previously marked as notable
@ -178,7 +178,7 @@ Results from enabling a central repository and running the Correlation Engine In
The \ref content_viewer_page panel is where previous instances of properties are displayed. Without a central repository enabled, The \ref content_viewer_page panel is where previous instances of properties are displayed. Without a central repository enabled,
this "Other Occurrences" panel will show files with hashes matching the selected file within the current case. Enabling a central this "Other Occurrences" panel will show files with hashes matching the selected file within the current case. Enabling a central
repository allows this panel to also display matching properties stored in the database, and adds some functionality to the row. repository allows this panel to also display matching properties stored in the database, and adds some functionality to the row.
Note that the Correlation Engine Ingest Module does not have to have been run on the current data source to see correlated Note that the Central Repository Ingest Module does not have to have been run on the current data source to see correlated
properties from the central repository. If the selected file or artifact is associated by one of the supported Correlation Types, properties from the central repository. If the selected file or artifact is associated by one of the supported Correlation Types,
to one or more properties in the database, the associated properties will be displayed. Note: the Content to one or more properties in the database, the associated properties will be displayed. Note: the Content
Viewer will display ALL associated properties available in the database. It ignores the user's enabled/disabled Correlation Properties. Viewer will display ALL associated properties available in the database. It ignores the user's enabled/disabled Correlation Properties.

View File

@ -32,7 +32,7 @@ Finally, if you have the Central Repository enabled you can choose to hide match
\subsection common_properties_central_repo Scope - between current case and cases in the Central Repository \subsection common_properties_central_repo Scope - between current case and cases in the Central Repository
This type of search looks for files that contain common properties between the current case and other cases in the Central Repository. You must run the Correlation Engine ingest module on each case with the property you want to search for enabled, along with the ingest modules that produce that property type (see \ref cr_manage_properties). This type of search looks for files that contain common properties between the current case and other cases in the Central Repository. You must run the Central Repository ingest module on each case with the property you want to search for enabled, along with the ingest modules that produce that property type (see \ref cr_manage_properties).
\image html common_properties_cr.png \image html common_properties_cr.png