mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
6520 Renamed Correlation Engine to Central Repository
This commit is contained in:
Ethan Roseman
parent
06a5804d34
commit
0746c6dfd6
@ -1,9 +1,9 @@
|
||||
OpenIDE-Module-Name=Central Repository
|
||||
OpenIDE-Module-Display-Category=Ingest Module
|
||||
OpenIDE-Module-Short-Description=Correlation Engine Ingest Module
|
||||
OpenIDE-Module-Short-Description=Central Repository Ingest Module
|
||||
OpenIDE-Module-Long-Description=\
|
||||
Correlation Engine ingest module and central database. \n\n\
|
||||
The Correlation Engine ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
|
||||
Central Repository ingest module and central database. \n\n\
|
||||
The Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
|
||||
Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest.
|
||||
CentralRepoCommentDialog.commentLabel.text=Comment:
|
||||
CentralRepoCommentDialog.okButton.text=&OK
|
||||
|
||||
@ -4,10 +4,10 @@ AddEditCentralRepoCommentAction.menuItemText.addEditCentralRepoCommentNoMD5=Add/
|
||||
CentralRepoCommentDialog.title.addEditCentralRepoComment=Add/Edit Central Repository Comment
|
||||
OpenIDE-Module-Name=Central Repository
|
||||
OpenIDE-Module-Display-Category=Ingest Module
|
||||
OpenIDE-Module-Short-Description=Correlation Engine Ingest Module
|
||||
OpenIDE-Module-Short-Description=Central Repository Ingest Module
|
||||
OpenIDE-Module-Long-Description=\
|
||||
Correlation Engine ingest module and central database. \n\n\
|
||||
The Correlation Engine ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
|
||||
Central Repository ingest module and central database. \n\n\
|
||||
The Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\
|
||||
Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest.
|
||||
CentralRepoCommentDialog.commentLabel.text=Comment:
|
||||
CentralRepoCommentDialog.okButton.text=&OK
|
||||
|
||||
@ -28,7 +28,7 @@ import org.sleuthkit.datamodel.TskDataException;
|
||||
|
||||
/**
|
||||
*
|
||||
* Stores information about a Data Source in the correlation engine
|
||||
* Stores information about a Data Source in the Central Repository
|
||||
*
|
||||
*/
|
||||
public class CorrelationDataSource implements Serializable {
|
||||
|
||||
@ -1679,7 +1679,7 @@ abstract class RdbmsCentralRepo implements CentralRepository {
|
||||
bulkArtifacts.get(tableName).clear();
|
||||
}
|
||||
|
||||
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Correlation Engine: Bulk insert");
|
||||
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Central Repository: Bulk insert");
|
||||
HealthMonitor.submitTimingMetric(timingMetric);
|
||||
|
||||
// Reset state
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
caseeventlistener.evidencetag=Evidence
|
||||
IngestEventsListener.ingestmodule.name=Correlation Engine
|
||||
IngestEventsListener.ingestmodule.name=Central Repository
|
||||
IngestEventsListener.prevCaseComment.text=Previous Case:
|
||||
# {0} - typeName
|
||||
# {1} - count
|
||||
|
||||
@ -73,7 +73,7 @@ import org.sleuthkit.datamodel.CommunicationsUtils;
|
||||
* Listen for ingest events and update entries in the Central Repository
|
||||
* database accordingly
|
||||
*/
|
||||
@NbBundle.Messages({"IngestEventsListener.ingestmodule.name=Correlation Engine"})
|
||||
@NbBundle.Messages({"IngestEventsListener.ingestmodule.name=Central Repository"})
|
||||
public class IngestEventsListener {
|
||||
|
||||
private static final Logger LOGGER = Logger.getLogger(CorrelationAttributeInstance.class.getName());
|
||||
@ -116,24 +116,24 @@ public class IngestEventsListener {
|
||||
|
||||
/**
|
||||
* Increase the number of IngestEventsListeners adding contents to the
|
||||
* Correlation Engine.
|
||||
* Central Repository.
|
||||
*/
|
||||
public synchronized static void incrementCorrelationEngineModuleCount() {
|
||||
correlationModuleInstanceCount++; //Should be called once in the Correlation Engine module's startup method.
|
||||
correlationModuleInstanceCount++; //Should be called once in the Central Repository module's startup method.
|
||||
}
|
||||
|
||||
/**
|
||||
* Decrease the number of IngestEventsListeners adding contents to the
|
||||
* Correlation Engine.
|
||||
* Central Repository.
|
||||
*/
|
||||
public synchronized static void decrementCorrelationEngineModuleCount() {
|
||||
if (getCeModuleInstanceCount() > 0) { //prevent it ingestJobCounter from going negative
|
||||
correlationModuleInstanceCount--; //Should be called once in the Correlation Engine module's shutdown method.
|
||||
correlationModuleInstanceCount--; //Should be called once in the Central Repository module's shutdown method.
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset the counter which keeps track of if the Correlation Engine Module
|
||||
* Reset the counter which keeps track of if the Central Repository Module
|
||||
* is being run during injest to 0.
|
||||
*/
|
||||
synchronized static void resetCeModuleInstanceCount() {
|
||||
@ -141,10 +141,10 @@ public class IngestEventsListener {
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether or not the Correlation Engine Module is enabled for any of the
|
||||
* Whether or not the Central Repository Module is enabled for any of the
|
||||
* currently running ingest jobs.
|
||||
*
|
||||
* @return boolean True for Correlation Engine enabled, False for disabled
|
||||
* @return boolean True for Central Repository enabled, False for disabled
|
||||
*/
|
||||
public synchronized static int getCeModuleInstanceCount() {
|
||||
return correlationModuleInstanceCount;
|
||||
@ -282,7 +282,7 @@ public class IngestEventsListener {
|
||||
|
||||
@Override
|
||||
public void propertyChange(PropertyChangeEvent evt) {
|
||||
//if ingest is running we want there to check if there is a Correlation Engine module running
|
||||
//if ingest is running we want there to check if there is a Central Repository module running
|
||||
//sometimes artifacts are generated by DSPs or other sources while ingest is not running
|
||||
//in these cases we still want to create correlation attributesForNewArtifact for those artifacts when appropriate
|
||||
if (!IngestManager.getInstance().isIngestRunning() || getCeModuleInstanceCount() > 0) {
|
||||
@ -349,7 +349,7 @@ public class IngestEventsListener {
|
||||
if (getCeModuleInstanceCount() == 0) {
|
||||
recentlyAddedCeArtifacts.clear();
|
||||
}
|
||||
//else another instance of the Correlation Engine Module is still being run.
|
||||
//else another instance of the Central Repository Module is still being run.
|
||||
|
||||
/*
|
||||
* Ensure the data source in the Central Repository has hash values
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
CentralRepoIngestModel_name_header=Name:<br>
|
||||
CentralRepoIngestModel_previous_case_header=<br>Previous Cases:<br>
|
||||
CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module.
|
||||
CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Central Repository ingest module.
|
||||
CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized
|
||||
CentralRepoIngestModule.prevCaseComment.text=Previous Case:
|
||||
CentralRepoIngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)
|
||||
@ -8,7 +8,7 @@ CentralRepoIngestModule_notable_message_header=<html>A file in this data source
|
||||
# {0} - Name of file that is Notable
|
||||
CentralRepoIngestModule_postToBB_knownBadMsg=Notable: {0}
|
||||
CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation
|
||||
CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine
|
||||
CentralRepoIngestModuleFactory.ingestmodule.name=Central Repository
|
||||
IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings
|
||||
IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable
|
||||
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases
|
||||
|
||||
@ -85,7 +85,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
|
||||
private final boolean createCorrelationProperties;
|
||||
|
||||
/**
|
||||
* Instantiate the Correlation Engine ingest module.
|
||||
* Instantiate the Central Repository ingest module.
|
||||
*
|
||||
* @param settings The ingest settings for the module instance.
|
||||
*/
|
||||
@ -147,7 +147,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
|
||||
*/
|
||||
if (abstractFile.getKnown() != TskData.FileKnown.KNOWN && flagTaggedNotableItems) {
|
||||
try {
|
||||
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Correlation Engine: Notable artifact query");
|
||||
TimingMetric timingMetric = HealthMonitor.getTimingMetric("Central Repository: Notable artifact query");
|
||||
List<String> caseDisplayNamesList = dbManager.getListCasesHavingArtifactInstancesKnownBad(filesType, md5);
|
||||
HealthMonitor.submitTimingMetric(timingMetric);
|
||||
if (!caseDisplayNamesList.isEmpty()) {
|
||||
@ -220,7 +220,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
|
||||
// see ArtifactManagerTimeTester for details
|
||||
@Messages({
|
||||
"CentralRepoIngestModule.notfyBubble.title=Central Repository Not Initialized",
|
||||
"CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module."
|
||||
"CentralRepoIngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Central Repository ingest module."
|
||||
})
|
||||
@Override
|
||||
public void startUp(IngestJobContext context) throws IngestModuleException {
|
||||
@ -235,7 +235,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
|
||||
* posited.
|
||||
*
|
||||
* Note: Flagging cannot be disabled if any other instances of the
|
||||
* Correlation Engine module are running. This restriction is to prevent
|
||||
* Central Repository module are running. This restriction is to prevent
|
||||
* missing results in the case where the first module is flagging
|
||||
* notable items, and the proceeding module (with flagging disabled)
|
||||
* causes the first to stop flagging.
|
||||
@ -276,7 +276,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
|
||||
// Don't allow sqlite central repo databases to be used for multi user cases
|
||||
if ((autopsyCase.getCaseType() == Case.CaseType.MULTI_USER_CASE)
|
||||
&& (CentralRepoDbManager.getSavedDbChoice().getDbPlatform() == CentralRepoPlatforms.SQLITE)) {
|
||||
logger.log(Level.SEVERE, "Cannot run correlation engine on a multi-user case with a SQLite central repository.");
|
||||
logger.log(Level.SEVERE, "Cannot run Central Repository ingest module on a multi-user case with a SQLite central repository.");
|
||||
throw new IngestModuleException("Cannot run on a multi-user case with a SQLite central repository."); // NON-NLS
|
||||
}
|
||||
jobId = context.getJobId();
|
||||
|
||||
@ -33,7 +33,7 @@ import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings;
|
||||
* Factory for Central Repository ingest modules
|
||||
*/
|
||||
@ServiceProvider(service = org.sleuthkit.autopsy.ingest.IngestModuleFactory.class)
|
||||
@NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine",
|
||||
@NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Central Repository",
|
||||
"CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation"})
|
||||
public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter {
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ package org.sleuthkit.autopsy.centralrepository.ingestmodule;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
|
||||
/**
|
||||
* Ingest job settings for the Correlation Engine module.
|
||||
* Ingest job settings for the Central Repository module.
|
||||
*/
|
||||
final class IngestSettings implements IngestModuleIngestJobSettings {
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
|
||||
|
||||
/**
|
||||
* Ingest job settings panel for the Correlation Engine module.
|
||||
* Ingest job settings panel for the Central Repository module.
|
||||
*/
|
||||
@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
|
||||
final class IngestSettingsPanel extends IngestModuleIngestJobSettingsPanel {
|
||||
|
||||
@ -862,7 +862,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
|
||||
/**
|
||||
* If the settings reflect that a inter-case search is being performed,
|
||||
* checks that the data sources in the current case have been processed with
|
||||
* Correlation Engine enabled and exist in the central repository. Prompting
|
||||
* Central Repository enabled and exist in the central repository. Prompting
|
||||
* the user as to whether they still want to perform the search in the case
|
||||
* any data sources are unprocessed. If the settings reflect that a
|
||||
* intra-case search is being performed, it just performs the search.
|
||||
@ -870,7 +870,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
|
||||
* Notes: - Does not check that the data sources were processed into the
|
||||
* current central repository instead of another. - Does not check that the
|
||||
* appropriate modules to make all correlation types available were run. -
|
||||
* Does not check if the correlation engine was run with any of the
|
||||
* Does not check if the Central Repository was run with any of the
|
||||
* correlation properties properties disabled.
|
||||
*/
|
||||
@Messages({"CommonAttributePanel.incompleteResults.introText=Results may be incomplete. Not all data sources in the current case were ingested into the current Central Repository. The following data sources have not been processed:",
|
||||
@ -902,14 +902,14 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer
|
||||
//if the datasource was previously processed we do not need to perform this check
|
||||
for (CorrelationDataSource correlatedDataSource : correlatedDataSources) {
|
||||
if (deviceID.equals(correlatedDataSource.getDeviceID())) {
|
||||
//if the datasource exists in the central repository it may of been processed with the correlation engine
|
||||
//if the datasource exists in the central repository it may of been processed with the Central Repository
|
||||
dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.IN_CENTRAL_REPO);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (dataSourceCorrelationMap.get(dataSource) == CorrelatedStatus.IN_CENTRAL_REPO) {
|
||||
//if the data source was in the central repository check if any of the modules run on it were the correlation engine
|
||||
//if the data source was in the central repository check if any of the modules run on it were the Central Repository
|
||||
for (IngestModuleInfo ingestModuleInfo : jobInfo.getIngestModuleInfo()) {
|
||||
if (correlationEngineModuleName.equals(ingestModuleInfo.getDisplayName())) {
|
||||
dataSourceCorrelationMap.put(dataSource, CorrelatedStatus.CORRELATED);
|
||||
|
||||
@ -35,6 +35,8 @@ AnnotationsContentViewer.title=Annotations
|
||||
AnnotationsContentViewer.toolTip=Displays tags and comments associated with the selected content.
|
||||
ApplicationContentViewer.title=Application
|
||||
ApplicationContentViewer.toolTip=Displays file contents.
|
||||
CallLogArtifactViewer_crdisbaled_persona_button_text=Create
|
||||
CallLogArtifactViewer_crdisbaled_persona_label=Unknown
|
||||
CallLogArtifactViewer_number_from=From
|
||||
CallLogArtifactViewer_number_to=To
|
||||
CallLogArtifactViewer_persona_button_new=Create
|
||||
@ -49,6 +51,7 @@ ContactArtifactViewer_persona_button_view=View
|
||||
ContactArtifactViewer_persona_label=Persona
|
||||
ContactArtifactViewer_persona_searching=\ Searching...
|
||||
ContactArtifactViewer_persona_text_none=None found
|
||||
ContactArtifactViewer_persona_unknown=Unknown
|
||||
DataContentViewerArtifact.failedToGetAttributes.message=Failed to get some or all attributes from case database
|
||||
DataContentViewerArtifact.failedToGetSourcePath.message=Failed to get source file path from case database
|
||||
DefaultArtifactContentViewer.attrsTableHeader.sources=Source(s)
|
||||
@ -1084,7 +1087,7 @@ MessageArtifactViewer.rtfbodyScrollPane.TabConstraints.tabTitle=RTF
|
||||
MessageArtifactViewer.toText.text=to list goes here
|
||||
MessageArtifactViewer.toLabel.text=To:
|
||||
MessageArtifactViewer.htmlPane.TabConstraints.tabTitle=HTML
|
||||
CallLogArtifactViewer.localAccountPersonaLabel.text=Persona:
|
||||
CallLogArtifactViewer.localAccountPersonaLabel.text=Persona
|
||||
CallLogArtifactViewer.localAccountPersonaNameLabel.text=jLabel1
|
||||
CallLogArtifactViewer.localAccountPersonaButton.text=jButton1
|
||||
ContactArtifactViewer.personasLabel.text=Personas
|
||||
|
||||
@ -993,7 +993,7 @@ public final class HealthMonitor implements PropertyChangeListener {
|
||||
}
|
||||
|
||||
String[] metricNames = {"Disk Reads: Hash calculation", "Database: getImages query", "Solr: Index chunk", "Solr: Connectivity check",
|
||||
"Correlation Engine: Notable artifact query", "Correlation Engine: Bulk insert"}; // NON-NLS
|
||||
"Central Repository: Notable artifact query", "Central Repository: Bulk insert"}; // NON-NLS
|
||||
|
||||
Random rand = new Random();
|
||||
|
||||
|
||||
@ -471,6 +471,9 @@ public final class IngestJobSettings {
|
||||
case "Archive Extractor": //NON-NLS
|
||||
moduleNames.add("Embedded File Extractor"); //NON-NLS
|
||||
break;
|
||||
case "Correlation Engine": //NON-NLS
|
||||
moduleNames.add("Central Repository"); //NON-NLS
|
||||
break;
|
||||
default:
|
||||
moduleNames.add(name);
|
||||
}
|
||||
|
||||
@ -22,7 +22,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
|
||||
|
||||
/**
|
||||
* Ingest job settings panel for the Correlation Engine module.
|
||||
* Ingest job settings panel for the Central Repository module.
|
||||
*/
|
||||
@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
|
||||
final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJobSettingsPanel {
|
||||
|
||||
@ -17,9 +17,9 @@ The following are some use cases for the central repository:
|
||||
|
||||
\section cr_terms Terms and Concepts
|
||||
|
||||
- <b>Central Repository</b> - The Autopsy feature containing the central repository database and Correlation Engine Ingest Module. Also responsible for displaying correlated properties to the user
|
||||
- <b>Central Repository</b> - The Autopsy feature containing the central repository database and Central Repository Ingest Module. Also responsible for displaying correlated properties to the user
|
||||
- <b>Central Repository Database</b> - the SQLite or PostgreSQL database that holds all the data
|
||||
- <b>Correlation Engine Ingest Module</b> - The ingest module responsible for adding new properties to the database and comparing these properties against existing notable properties
|
||||
- <b>Central Repository Ingest Module</b> - The ingest module responsible for adding new properties to the database and comparing these properties against existing notable properties
|
||||
- <b>Property</b> - The data being stored/correlated. These can be file paths/MD5 hashes, email addresses, phone numbers, etc.
|
||||
|
||||
\section cr_setup Setup
|
||||
@ -80,7 +80,7 @@ Enter or browse to a folder for the database. If the database file does not exis
|
||||
|
||||
\subsection cr_manage_properties Manage Correlation Properties
|
||||
|
||||
The Correlation Engine ingest module can save different types of properties to the database. By default all properties are recorded, but
|
||||
The Central Repository ingest module can save different types of properties to the database. By default all properties are recorded, but
|
||||
this setting can be changed on the options panel through the Manage Correlation Properties button. Note that these settings
|
||||
are saved to the database, so in a multi-user setting any changes will affect all users.
|
||||
|
||||
@ -130,18 +130,18 @@ Displays a list of all cases that are in the central repository database and det
|
||||
|
||||
\section cr_using_repo Using the Central Repository
|
||||
|
||||
\subsection cr_ingest_module Correlation Engine Module
|
||||
\subsection cr_ingest_module Central Repository Module
|
||||
|
||||
The Correlation Engine ingest module is responsible for adding properties to the database and comparing each property
|
||||
The Central Repository ingest module is responsible for adding properties to the database and comparing each property
|
||||
against the list of notable properties. It is best to run all ingest modules to get the most out of the Correlation
|
||||
Engine. For example, if Hash Lookup is not run then the Correlation Engine module will not put any files into the
|
||||
database. If the Correlation Engine module is not run on a particular case but a central repository is enabled,
|
||||
Engine. For example, if Hash Lookup is not run then the Central Repository module will not put any files into the
|
||||
database. If the Central Repository module is not run on a particular case but a central repository is enabled,
|
||||
there will still be some limited functionality. The Content Viewer will still display matching properties from
|
||||
other cases/data sources where the Correlation Engine was run.
|
||||
other cases/data sources where the Central Repository was run.
|
||||
|
||||
\image html central_repo_ingest_settings.png
|
||||
|
||||
There are three settings for the Correlation Engine ingest module:
|
||||
There are three settings for the Central Repository ingest module:
|
||||
<ul>
|
||||
<li><b>Save items to the Central Repository</b> - This should only be unselected in the rare case that you don't want to add any properties from the current data source to the central repository, but still want to flag past occurrences.
|
||||
<li><b>Flag items previously tagged as notable</b> - Enabling this causes Interesting Item/File artifacts to be created when properties matching those previously flagged are found. See the next section \ref cr_tagging for details.
|
||||
@ -169,7 +169,7 @@ are still added to the central repository.
|
||||
|
||||
\section cr_viewing_results Viewing Results
|
||||
|
||||
Results from enabling a central repository and running the Correlation Engine Ingest Module can be seen in two places:
|
||||
Results from enabling a central repository and running the Central Repository Ingest Module can be seen in two places:
|
||||
- The Content Viewer for each file or artifact will display all matching properties from other cases/data sources
|
||||
- The Interesting Files node of the result tree will contain any files or results that matched properties previously marked as notable
|
||||
|
||||
@ -178,7 +178,7 @@ Results from enabling a central repository and running the Correlation Engine In
|
||||
The \ref content_viewer_page panel is where previous instances of properties are displayed. Without a central repository enabled,
|
||||
this "Other Occurrences" panel will show files with hashes matching the selected file within the current case. Enabling a central
|
||||
repository allows this panel to also display matching properties stored in the database, and adds some functionality to the row.
|
||||
Note that the Correlation Engine Ingest Module does not have to have been run on the current data source to see correlated
|
||||
Note that the Central Repository Ingest Module does not have to have been run on the current data source to see correlated
|
||||
properties from the central repository. If the selected file or artifact is associated by one of the supported Correlation Types,
|
||||
to one or more properties in the database, the associated properties will be displayed. Note: the Content
|
||||
Viewer will display ALL associated properties available in the database. It ignores the user's enabled/disabled Correlation Properties.
|
||||
|
||||
@ -32,7 +32,7 @@ Finally, if you have the Central Repository enabled you can choose to hide match
|
||||
|
||||
\subsection common_properties_central_repo Scope - between current case and cases in the Central Repository
|
||||
|
||||
This type of search looks for files that contain common properties between the current case and other cases in the Central Repository. You must run the Correlation Engine ingest module on each case with the property you want to search for enabled, along with the ingest modules that produce that property type (see \ref cr_manage_properties).
|
||||
This type of search looks for files that contain common properties between the current case and other cases in the Central Repository. You must run the Central Repository ingest module on each case with the property you want to search for enabled, along with the ingest modules that produce that property type (see \ref cr_manage_properties).
|
||||
|
||||
\image html common_properties_cr.png
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user