From b2a9675a2c1e04276c20ae372a35027bde3528d9 Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Thu, 18 Feb 2021 15:43:41 -0500
Subject: [PATCH 1/7] 7178 Get account types and display them in discovery
 domain results

---
 .../discovery/search/Bundle.properties-MERGED |  1 +
 .../search/DomainSearchCacheLoader.java       | 55 +++++++++++++------
 .../discovery/search/ResultDomain.java        | 38 +++++++++----
 .../discovery/ui/Bundle.properties-MERGED     |  3 +-
 .../discovery/ui/DomainSummaryPanel.form      | 30 ++++++----
 .../discovery/ui/DomainSummaryPanel.java      | 34 +++++++-----
 6 files changed, 108 insertions(+), 53 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/discovery/search/Bundle.properties-MERGED
index cd823d353b..1f7710d2d4 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/Bundle.properties-MERGED
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/Bundle.properties-MERGED
@@ -57,6 +57,7 @@ FileSorter.SortingMethod.fullPath.displayName=Full Path
 FileSorter.SortingMethod.keywordlist.displayName=Keyword List Names
 FileSorter.SortingMethod.pageViews.displayName=Page Views
 ResultDomain_getDefaultCategory=Uncategorized
+ResultDomain_noAccountTypes=Unknown
 ResultFile.score.interestingResult.description=At least one instance of the file has an interesting result associated with it.
 ResultFile.score.notableFile.description=At least one instance of the file was recognized as notable.
 ResultFile.score.notableTaggedFile.description=At least one instance of the file is tagged with a notable tag.
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
index 31006d7e93..6ad2ca7011 100755
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
@@ -43,12 +43,15 @@ import org.sleuthkit.autopsy.discovery.search.SearchFiltering.DataSourceFilter;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE;
+import org.sleuthkit.datamodel.BlackboardAttribute;
 import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN;
+import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT;
 import org.sleuthkit.datamodel.CaseDbAccessManager;
 import org.sleuthkit.datamodel.CaseDbAccessManager.CaseDbAccessQueryCallback;
 import org.sleuthkit.datamodel.Content;
 import org.sleuthkit.datamodel.SleuthkitCase;
 import org.sleuthkit.datamodel.TskCoreException;
+import org.sleuthkit.datamodel.TskData;
 
 /**
  * Loads domain search results for cache misses. This loader is a Guava cache
@@ -103,11 +106,9 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
 
         // Filters chosen in the UI are aggregated into SQL statements to be used in 
         // the queries that follow.
-        final Pair<String, String> filterClauses = createWhereAndHavingClause(key.getFilters());
-        final String whereClause = filterClauses.getLeft();
-        final String havingClause = filterClauses.getRight();
-
-        // You may think of each row of this result as a TSK_DOMAIN attribute, where the parent
+        final Pair<String, String> domainsFilterClauses = createWhereAndHavingClause(key.getFilters());
+        final String domainsWhereClause = domainsFilterClauses.getLeft();
+        final String domainsHavingClause = domainsFilterClauses.getRight();
         // artifact type is within the (optional) filter and the parent artifact
         // had a date time attribute that was within the (optional) filter. With this
         // table in hand, we can simply group by domain and apply aggregate functions
@@ -118,9 +119,29 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
                 + "       artifact_id AS parent_artifact_id,"
                 + "       MAX(artifact_type_id) AS parent_artifact_type_id "
                 + "FROM   blackboard_attributes "
-                + "WHERE  " + whereClause + " "
+                + "WHERE  " + domainsWhereClause + " "
                 + "GROUP BY artifact_id "
-                + "HAVING " + havingClause;
+                + "HAVING " + domainsHavingClause;
+        final SleuthkitCase caseDb = key.getSleuthkitCase();
+        String sqlSpecificAccountAggregator;
+        if (caseDb.getDatabaseType() == TskData.DbType.POSTGRESQL) {
+            sqlSpecificAccountAggregator = "STRING_AGG(DISTINCT(value_text), ',')"; //postgres string aggregator (requires specified separator 
+        } else {
+            sqlSpecificAccountAggregator = "GROUP_CONCAT(DISTINCT(value_text))"; //sqlite string aggregator (uses comma separation by default)
+        }
+        final String accountsWhereClause = "(attribute_type_id = " + TSK_TEXT.getTypeID() + " AND value_text <> '' AND (artifact_type_id = " + TSK_WEB_ACCOUNT_TYPE.getTypeID() + "))"; 
+        /*
+         * As part of getting the known account types for a domain additional
+         * attribute values are necessary from the blackboard_attributes table
+         * This sub-query aggregates them and associates them with the artifact
+         * they correspond to.
+         */
+        final String accountsTable
+                = "SELECT " + sqlSpecificAccountAggregator + " as value_text," //naming field value_text the same as the field it is aggregating to re-use aggregator
+                + "artifact_id AS account_artifact_id "
+                + "FROM blackboard_attributes "
+                + "WHERE " + accountsWhereClause + " "
+                + "GROUP BY artifact_id ";
 
         // Needed to populate the visitsInLast60 data.
         final Instant currentTime = Instant.now();
@@ -166,17 +187,18 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
                 + "                 WHEN artifact_type_id = " + TSK_WEB_ACCOUNT_TYPE.getTypeID() + " THEN 1 "
                 + "                 ELSE 0 "
                 + "               END) AS countOfKnownAccountTypes,"
-                + "           MAX(data_source_obj_id) AS dataSource "
-                + "FROM blackboard_artifacts"
+                + "           MAX(data_source_obj_id) AS dataSource, "
+                +             sqlSpecificAccountAggregator +  " as accountTypes "
+                + "FROM blackboard_artifacts as barts"
                 + "     JOIN (" + domainsTable + ") AS domains_table"
-                + "       ON artifact_id = parent_artifact_id "
+                + "       ON barts.artifact_id = parent_artifact_id "
+                + "     LEFT JOIN (" + accountsTable + ") AS accounts_table"
+                + "       ON barts.artifact_id = account_artifact_id "
                 + // Add the data source where clause here if present.
                 ((dataSourceWhereClause != null) ? "WHERE " + dataSourceWhereClause + " " : "")
                 + "GROUP BY " + groupByClause;
-
-        final SleuthkitCase caseDb = key.getSleuthkitCase();
+        System.out.println("Query: " + domainsQuery);
         final CaseDbAccessManager dbManager = caseDb.getCaseDbAccessManager();
-
         final DomainCallback domainCallback = new DomainCallback(caseDb);
         dbManager.select(domainsQuery, domainCallback);
 
@@ -209,8 +231,8 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
      *         to stress that these clauses are tightly coupled.
      */
     Pair<String, String> createWhereAndHavingClause(List<AbstractFilter> filters) {
-        final StringJoiner whereClause = new StringJoiner(" OR ");
-        final StringJoiner havingClause = new StringJoiner(" AND ");
+        final StringJoiner whereClause = new StringJoiner(" OR ", "(", ")");
+        final StringJoiner havingClause = new StringJoiner(" AND ", "(", ")");
 
         // Capture all types by default.
         ArtifactTypeFilter artifactTypeFilter = new ArtifactTypeFilter(SearchData.Type.DOMAIN.getArtifactTypes());
@@ -301,11 +323,12 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
                     long pageViewsInLast60 = resultSet.getLong("pageViewsInLast60");
                     long countOfKnownAccountTypes = resultSet.getLong("countOfKnownAccountTypes");
                     long dataSourceID = resultSet.getLong("dataSource");
+                    String accountTypes = resultSet.getString("accountTypes");
                     Content dataSource = skc.getContentById(dataSourceID);
 
                     resultDomains.add(new ResultDomain(domain, activityStart,
                             activityEnd, totalPageViews, pageViewsInLast60, filesDownloaded,
-                            countOfKnownAccountTypes, dataSource));
+                            countOfKnownAccountTypes, accountTypes, dataSource));
                 }
             } catch (SQLException ex) {
                 this.sqlCause = ex;
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java b/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
index 94f0da9d0a..19fec1b865 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.discovery.search;
 
+import org.apache.commons.lang3.StringUtils;
 import org.openide.util.NbBundle;
 import org.sleuthkit.datamodel.Content;
 import org.sleuthkit.datamodel.TskData;
@@ -34,6 +35,7 @@ public class ResultDomain extends Result {
     private final Long pageViewsInLast60;
     private final Long filesDownloaded;
     private final Long countOfKnownAccountTypes;
+    private final String accountTypes;
     private String webCategory;
 
     private final Content dataSource;
@@ -45,7 +47,7 @@ public class ResultDomain extends Result {
      * @param domain The domain the result is being created from.
      */
     ResultDomain(String domain, Long activityStart, Long activityEnd, Long totalPageViews,
-            Long pageViewsInLast60, Long filesDownloaded, Long countOfKnownAccountTypes, Content dataSource) {
+            Long pageViewsInLast60, Long filesDownloaded, Long countOfKnownAccountTypes, String accountTypes, Content dataSource) {
         this.domain = domain;
         this.dataSource = dataSource;
         this.dataSourceId = dataSource.getId();
@@ -55,6 +57,7 @@ public class ResultDomain extends Result {
         this.pageViewsInLast60 = pageViewsInLast60;
         this.filesDownloaded = filesDownloaded;
         this.countOfKnownAccountTypes = countOfKnownAccountTypes;
+        this.accountTypes = accountTypes;
     }
 
     /**
@@ -85,8 +88,8 @@ public class ResultDomain extends Result {
     }
 
     /**
-     * Get the total number of page views that this domain has had.
-     * Pages views is defined as the count of TSK_WEB_HISTORY artifacts.
+     * Get the total number of page views that this domain has had. Pages views
+     * is defined as the count of TSK_WEB_HISTORY artifacts.
      *
      * @return The total number of page views that this domain has had.
      */
@@ -95,8 +98,8 @@ public class ResultDomain extends Result {
     }
 
     /**
-     * Get the number of page views that this domain has had in the last 60 days.
-     * Page views is defined as the count of TSK_WEB_HISTORY artifacts.
+     * Get the number of page views that this domain has had in the last 60
+     * days. Page views is defined as the count of TSK_WEB_HISTORY artifacts.
      *
      * @return The number of page views that this domain has had in the last 60
      *         days.
@@ -113,7 +116,7 @@ public class ResultDomain extends Result {
     public Long getFilesDownloaded() {
         return filesDownloaded;
     }
-    
+
     /**
      * Get the web category (TSK_WEB_CATEGORY) type for this domain.
      */
@@ -127,23 +130,38 @@ public class ResultDomain extends Result {
             return webCategory;
         }
     }
-    
+
     /**
-     * Set the web category for this domain (derived from TSK_WEB_CATEGORY) artifacts.
+     * Set the web category for this domain (derived from TSK_WEB_CATEGORY)
+     * artifacts.
      */
     public void setWebCategory(String webCategory) {
         this.webCategory = webCategory;
     }
-    
+
     /**
      * Determines if the domain has been associated with a known account type
      * (TSK_WEB_ACCOUNT_TYPE).
      */
     public boolean hasKnownAccountType() {
-        return countOfKnownAccountTypes != null 
+        return countOfKnownAccountTypes != null
                 && countOfKnownAccountTypes > 0;
     }
 
+    /** 
+     * Get the account types in 
+     * @return 
+     */
+    @NbBundle.Messages({
+        "ResultDomain_noAccountTypes=Unknown"
+    })
+    public String getAccountTypes() {
+        if (StringUtils.isBlank(accountTypes)) {
+            return Bundle.ResultDomain_noAccountTypes();
+        }
+        return accountTypes;
+    }
+
     @Override
     public long getDataSourceObjectId() {
         return this.dataSourceId;
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
index 98deeee12f..2907bfa112 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
@@ -59,13 +59,12 @@ DomainDetailsPanel.miniTimelineTitle.text=Timeline
 DomainSummaryPanel.activity.text=Activity: {0} to {1}
 DomainSummaryPanel.category.text=Category: 
 DomainSummaryPanel.downloads.text=Files downloaded: 
-DomainSummaryPanel.known.text=User role: Known account type(s)
 DomainSummaryPanel.loadingImages.text=Loading thumbnail...
 DomainSummaryPanel.no.text=No
 DomainSummaryPanel.notability.text=Previously tagged as notable: 
 DomainSummaryPanel.pages.text=Page views in past 60 days: 
 DomainSummaryPanel.totalPages.text=Total page views: 
-DomainSummaryPanel.unknown.text=User role: Unknown
+DomainSummaryPanel.userRole.text=User role: 
 DomainSummaryPanel.yes.text=Yes
 GroupsListPanel.noDomainResults.message.text=No domains were found for the selected filters.\n\nReminder:\n  -The Recent Activity module must be run on each data source you want to find results in.\n  -The Central Repository module must be run on each data source if you want to filter or sort by past occurrences.\n  -The iOS Analyzer (iLEAPP) module must be run on each data source which contains data from an iOS device.\n
 GroupsListPanel.noFileResults.message.text=No files were found for the selected filters.\n\nReminder:\n  -The File Type Identification module must be run on each data source you want to find results in.\n  -The Hash Lookup module must be run on each data source if you want to filter by past occurrence.\n  -The Picture Analyzer module must be run on each data source if you are filtering by User Created content.
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.form b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.form
index 9e7fd5fd3c..68f72f9a78 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.form
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.form
@@ -27,20 +27,23 @@
               <EmptySpace min="-2" max="-2" attributes="0"/>
               <Group type="103" groupAlignment="0" attributes="0">
                   <Component id="domainNameLabel" alignment="0" max="32767" attributes="0"/>
-                  <Group type="102" attributes="0">
+                  <Component id="pagesLabel" alignment="0" max="32767" attributes="0"/>
+                  <Group type="102" alignment="0" attributes="0">
                       <Group type="103" groupAlignment="1" max="-2" attributes="0">
-                          <Component id="filesDownloadedLabel" linkSize="3" alignment="0" pref="300" max="32767" attributes="0"/>
-                          <Component id="activityLabel" linkSize="3" alignment="0" max="32767" attributes="0"/>
+                          <Component id="totalVisitsLabel" alignment="0" max="32767" attributes="0"/>
+                          <Group type="103" groupAlignment="1" max="-2" attributes="0">
+                              <Component id="filesDownloadedLabel" linkSize="3" alignment="0" pref="300" max="32767" attributes="0"/>
+                              <Component id="activityLabel" linkSize="3" alignment="0" max="32767" attributes="0"/>
+                          </Group>
                       </Group>
-                      <EmptySpace min="-2" max="-2" attributes="0"/>
+                      <EmptySpace type="unrelated" max="-2" attributes="0"/>
                       <Group type="103" groupAlignment="0" attributes="0">
-                          <Component id="domainNotabilityLabel" pref="300" max="32767" attributes="0"/>
+                          <Component id="domainNotabilityLabel" pref="295" max="32767" attributes="0"/>
                           <Component id="categoryLabel" max="32767" attributes="0"/>
+                          <Component id="knownAccountTypesLabel" max="32767" attributes="0"/>
                       </Group>
                       <EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
                   </Group>
-                  <Component id="pagesLabel" alignment="0" max="32767" attributes="0"/>
-                  <Component id="totalVisitsLabel" alignment="0" max="32767" attributes="0"/>
               </Group>
               <EmptySpace min="-2" max="-2" attributes="0"/>
               <Group type="103" groupAlignment="0" max="-2" attributes="0">
@@ -58,12 +61,12 @@
               <Group type="103" groupAlignment="0" attributes="0">
                   <Group type="102" attributes="0">
                       <Component id="numberOfImagesLabel" min="-2" pref="17" max="-2" attributes="0"/>
-                      <EmptySpace pref="8" max="32767" attributes="0"/>
+                      <EmptySpace max="32767" attributes="0"/>
                       <Component id="sampleImageLabel" min="-2" max="-2" attributes="0"/>
                   </Group>
                   <Group type="102" attributes="0">
                       <Component id="domainNameLabel" min="-2" pref="35" max="-2" attributes="0"/>
-                      <EmptySpace type="unrelated" max="32767" attributes="0"/>
+                      <EmptySpace type="unrelated" pref="15" max="32767" attributes="0"/>
                       <Group type="103" groupAlignment="0" attributes="0">
                           <Component id="activityLabel" linkSize="4" alignment="1" min="-2" pref="15" max="-2" attributes="0"/>
                           <Component id="domainNotabilityLabel" linkSize="2" alignment="1" min="-2" max="-2" attributes="0"/>
@@ -73,8 +76,11 @@
                           <Component id="filesDownloadedLabel" linkSize="4" pref="14" max="32767" attributes="0"/>
                           <Component id="categoryLabel" max="32767" attributes="0"/>
                       </Group>
-                      <EmptySpace max="-2" attributes="0"/>
-                      <Component id="totalVisitsLabel" linkSize="2" pref="14" max="32767" attributes="0"/>
+                      <EmptySpace min="-2" pref="9" max="-2" attributes="0"/>
+                      <Group type="103" groupAlignment="0" max="-2" attributes="0">
+                          <Component id="totalVisitsLabel" linkSize="2" pref="14" max="32767" attributes="0"/>
+                          <Component id="knownAccountTypesLabel" max="32767" attributes="0"/>
+                      </Group>
                       <EmptySpace max="-2" attributes="0"/>
                       <Component id="pagesLabel" min="-2" pref="15" max="-2" attributes="0"/>
                       <EmptySpace min="-2" pref="1" max="-2" attributes="0"/>
@@ -131,5 +137,7 @@
     </Component>
     <Component class="javax.swing.JLabel" name="categoryLabel">
     </Component>
+    <Component class="javax.swing.JLabel" name="knownAccountTypesLabel">
+    </Component>
   </SubComponents>
 </Form>
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
index bcf004b89b..87c02c6419 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
@@ -69,6 +69,7 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
         totalVisitsLabel = new javax.swing.JLabel();
         domainNotabilityLabel = new javax.swing.JLabel();
         categoryLabel = new javax.swing.JLabel();
+        knownAccountTypesLabel = new javax.swing.JLabel();
 
         setBorder(javax.swing.BorderFactory.createEtchedBorder());
 
@@ -90,17 +91,19 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
                 .addContainerGap()
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                     .addComponent(domainNameLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                    .addComponent(pagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                     .addGroup(layout.createSequentialGroup()
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false)
-                            .addComponent(filesDownloadedLabel, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE)
-                            .addComponent(activityLabel, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
+                            .addComponent(totalVisitsLabel, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                            .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false)
+                                .addComponent(filesDownloadedLabel, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE)
+                                .addComponent(activityLabel, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)))
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-                            .addComponent(domainNotabilityLabel, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE)
-                            .addComponent(categoryLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
-                        .addGap(4, 4, 4))
-                    .addComponent(pagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                    .addComponent(totalVisitsLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                            .addComponent(domainNotabilityLabel, javax.swing.GroupLayout.DEFAULT_SIZE, 295, Short.MAX_VALUE)
+                            .addComponent(categoryLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                            .addComponent(knownAccountTypesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                        .addGap(4, 4, 4)))
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
                     .addComponent(numberOfImagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
@@ -117,11 +120,11 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                     .addGroup(layout.createSequentialGroup()
                         .addComponent(numberOfImagesLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 17, javax.swing.GroupLayout.PREFERRED_SIZE)
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 8, Short.MAX_VALUE)
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                         .addComponent(sampleImageLabel, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
                     .addGroup(layout.createSequentialGroup()
                         .addComponent(domainNameLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 35, javax.swing.GroupLayout.PREFERRED_SIZE)
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED, 15, Short.MAX_VALUE)
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                             .addComponent(activityLabel, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.PREFERRED_SIZE, 15, javax.swing.GroupLayout.PREFERRED_SIZE)
                             .addComponent(domainNotabilityLabel, javax.swing.GroupLayout.Alignment.TRAILING))
@@ -129,8 +132,10 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
                             .addComponent(filesDownloadedLabel, javax.swing.GroupLayout.DEFAULT_SIZE, 14, Short.MAX_VALUE)
                             .addComponent(categoryLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
-                        .addComponent(totalVisitsLabel, javax.swing.GroupLayout.DEFAULT_SIZE, 14, Short.MAX_VALUE)
+                        .addGap(9, 9, 9)
+                        .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
+                            .addComponent(totalVisitsLabel, javax.swing.GroupLayout.DEFAULT_SIZE, 14, Short.MAX_VALUE)
+                            .addComponent(knownAccountTypesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
                         .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                         .addComponent(pagesLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 15, javax.swing.GroupLayout.PREFERRED_SIZE)
                         .addGap(1, 1, 1)))
@@ -150,6 +155,7 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
     private javax.swing.JLabel domainNameLabel;
     private javax.swing.JLabel domainNotabilityLabel;
     private javax.swing.JLabel filesDownloadedLabel;
+    private javax.swing.JLabel knownAccountTypesLabel;
     private javax.swing.JLabel numberOfImagesLabel;
     private javax.swing.JLabel pagesLabel;
     private javax.swing.JLabel sampleImageLabel;
@@ -164,8 +170,7 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
         "DomainSummaryPanel.totalPages.text=Total page views: ",
         "DomainSummaryPanel.downloads.text=Files downloaded: ",
         "DomainSummaryPanel.notability.text=Previously tagged as notable: ",
-        "DomainSummaryPanel.unknown.text=User role: Unknown",
-        "DomainSummaryPanel.known.text=User role: Known account type(s)",
+        "DomainSummaryPanel.userRole.text=User role: ",
         "DomainSummaryPanel.category.text=Category: ",
         "DomainSummaryPanel.loadingImages.text=Loading thumbnail...",
         "DomainSummaryPanel.no.text=No",
@@ -188,6 +193,7 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
         totalVisitsLabel.setText(Bundle.DomainSummaryPanel_totalPages_text() + value.getResultDomain().getTotalPageViews());
         pagesLabel.setText(Bundle.DomainSummaryPanel_pages_text() + value.getResultDomain().getPageViewsInLast60Days());
         filesDownloadedLabel.setText(Bundle.DomainSummaryPanel_downloads_text() + value.getResultDomain().getFilesDownloaded());
+        knownAccountTypesLabel.setText(Bundle.DomainSummaryPanel_userRole_text() + value.getResultDomain().getAccountTypes());
         if (value.getThumbnail() == null) {
             numberOfImagesLabel.setText(Bundle.DomainSummaryPanel_loadingImages_text());
             sampleImageLabel.setIcon(null);

From 9950cef38f2fd7925fb250f9114a985891c9a56e Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Thu, 18 Feb 2021 15:47:49 -0500
Subject: [PATCH 2/7] 7178 minor clean up

---
 .../autopsy/discovery/search/DomainSearchCacheLoader.java   | 6 ++----
 .../sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java  | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
index 6ad2ca7011..00abc9ce73 100755
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2020 Basis Technology Corp.
+ * Copyright 2020-2021 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -43,7 +43,6 @@ import org.sleuthkit.autopsy.discovery.search.SearchFiltering.DataSourceFilter;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY;
 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE;
-import org.sleuthkit.datamodel.BlackboardAttribute;
 import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN;
 import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT;
 import org.sleuthkit.datamodel.CaseDbAccessManager;
@@ -197,7 +196,6 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
                 + // Add the data source where clause here if present.
                 ((dataSourceWhereClause != null) ? "WHERE " + dataSourceWhereClause + " " : "")
                 + "GROUP BY " + groupByClause;
-        System.out.println("Query: " + domainsQuery);
         final CaseDbAccessManager dbManager = caseDb.getCaseDbAccessManager();
         final DomainCallback domainCallback = new DomainCallback(caseDb);
         dbManager.select(domainsQuery, domainCallback);
@@ -242,7 +240,7 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
             if (filter instanceof ArtifactTypeFilter) {
                 // Replace with user defined types.
                 artifactTypeFilter = ((ArtifactTypeFilter) filter);
-            } else if (!(filter instanceof DataSourceFilter) && !filter.useAlternateFilter()) {
+            } else if (filter != null && !(filter instanceof DataSourceFilter) && !filter.useAlternateFilter()) {
                 if (filter instanceof ArtifactDateRangeFilter) {
                     hasDateTimeFilter = true;
                 }
diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
index 87c02c6419..d108ac31df 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
@@ -1,7 +1,7 @@
 /*
  * Autopsy
  *
- * Copyright 2020 Basis Technology Corp.
+ * Copyright 2020-2021 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");

From 7941312d92ece893b0bde6cbe8e41e117ceed869 Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Thu, 18 Feb 2021 15:50:20 -0500
Subject: [PATCH 3/7] 7178 remove unnecessary string

---
 .../autopsy/discovery/search/DomainSearchCacheLoader.java    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
index 00abc9ce73..5fd050e452 100755
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java
@@ -128,7 +128,6 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
         } else {
             sqlSpecificAccountAggregator = "GROUP_CONCAT(DISTINCT(value_text))"; //sqlite string aggregator (uses comma separation by default)
         }
-        final String accountsWhereClause = "(attribute_type_id = " + TSK_TEXT.getTypeID() + " AND value_text <> '' AND (artifact_type_id = " + TSK_WEB_ACCOUNT_TYPE.getTypeID() + "))"; 
         /*
          * As part of getting the known account types for a domain additional
          * attribute values are necessary from the blackboard_attributes table
@@ -139,7 +138,9 @@ class DomainSearchCacheLoader extends CacheLoader<SearchKey, Map<GroupKey, List<
                 = "SELECT " + sqlSpecificAccountAggregator + " as value_text," //naming field value_text the same as the field it is aggregating to re-use aggregator
                 + "artifact_id AS account_artifact_id "
                 + "FROM blackboard_attributes "
-                + "WHERE " + accountsWhereClause + " "
+                + "WHERE (attribute_type_id = " + TSK_TEXT.getTypeID() 
+                + "   AND value_text <> '' "
+                + "   AND (artifact_type_id = " + TSK_WEB_ACCOUNT_TYPE.getTypeID() + ")) "
                 + "GROUP BY artifact_id ";
 
         // Needed to populate the visitsInLast60 data.

From 838669e22cf119e747f11e577ddb0f87ddb5c5fc Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Thu, 18 Feb 2021 15:53:20 -0500
Subject: [PATCH 4/7] 7178 add comment for new getter method

---
 .../sleuthkit/autopsy/discovery/search/ResultDomain.java | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java b/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
index 19fec1b865..47fa441678 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/search/ResultDomain.java
@@ -148,9 +148,12 @@ public class ResultDomain extends Result {
                 && countOfKnownAccountTypes > 0;
     }
 
-    /** 
-     * Get the account types in 
-     * @return 
+    /**
+     * Get the account types which are associated with this domain.
+     *
+     * @return A comma seperated list of account types which are associated with
+     *         this domain, or "Unknown" if no account types were associated
+     *         with it.
      */
     @NbBundle.Messages({
         "ResultDomain_noAccountTypes=Unknown"

From 9f5698cf4d67bd251df05e5a98723687036d5b84 Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Fri, 19 Feb 2021 12:14:10 -0500
Subject: [PATCH 5/7] 7178 fix label to say Account Type instead of User Role

---
 .../org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
index d108ac31df..d602e3e130 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/DomainSummaryPanel.java
@@ -170,7 +170,7 @@ class DomainSummaryPanel extends javax.swing.JPanel implements ListCellRenderer<
         "DomainSummaryPanel.totalPages.text=Total page views: ",
         "DomainSummaryPanel.downloads.text=Files downloaded: ",
         "DomainSummaryPanel.notability.text=Previously tagged as notable: ",
-        "DomainSummaryPanel.userRole.text=User role: ",
+        "DomainSummaryPanel.userRole.text=Account type: ",
         "DomainSummaryPanel.category.text=Category: ",
         "DomainSummaryPanel.loadingImages.text=Loading thumbnail...",
         "DomainSummaryPanel.no.text=No",

From e9d382e88b6820b88c49a9dd60497b46890d24dc Mon Sep 17 00:00:00 2001
From: William Schaefer <wschaefer@basistech.net>
Date: Fri, 19 Feb 2021 13:02:22 -0500
Subject: [PATCH 6/7] 7178 update bundle properties merged file

---
 .../org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
index 2907bfa112..de8ecc7cef 100644
--- a/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
+++ b/Core/src/org/sleuthkit/autopsy/discovery/ui/Bundle.properties-MERGED
@@ -64,7 +64,7 @@ DomainSummaryPanel.no.text=No
 DomainSummaryPanel.notability.text=Previously tagged as notable: 
 DomainSummaryPanel.pages.text=Page views in past 60 days: 
 DomainSummaryPanel.totalPages.text=Total page views: 
-DomainSummaryPanel.userRole.text=User role: 
+DomainSummaryPanel.userRole.text=Account type: 
 DomainSummaryPanel.yes.text=Yes
 GroupsListPanel.noDomainResults.message.text=No domains were found for the selected filters.\n\nReminder:\n  -The Recent Activity module must be run on each data source you want to find results in.\n  -The Central Repository module must be run on each data source if you want to filter or sort by past occurrences.\n  -The iOS Analyzer (iLEAPP) module must be run on each data source which contains data from an iOS device.\n
 GroupsListPanel.noFileResults.message.text=No files were found for the selected filters.\n\nReminder:\n  -The File Type Identification module must be run on each data source you want to find results in.\n  -The Hash Lookup module must be run on each data source if you want to filter by past occurrence.\n  -The Picture Analyzer module must be run on each data source if you are filtering by User Created content.

From 31f8a3db49a380e500755fe8ce69a2b7398f304f Mon Sep 17 00:00:00 2001
From: Richard Cordovano <rcordovano@basistech.com>
Date: Mon, 1 Mar 2021 20:15:00 -0500
Subject: [PATCH 7/7] 7332 ingest pipeline refactor fix

---
 .../src/org/sleuthkit/autopsy/ingest/IngestTaskPipeline.java | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestTaskPipeline.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestTaskPipeline.java
index 5e918d4ddb..f7451dd9d8 100755
--- a/Core/src/org/sleuthkit/autopsy/ingest/IngestTaskPipeline.java
+++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestTaskPipeline.java
@@ -323,6 +323,11 @@ abstract class IngestTaskPipeline<T extends IngestTask> {
          *                               performing the task.
          */
         abstract void performTask(IngestJobPipeline ingestJobPipeline, T task) throws IngestModuleException;
+        
+        @Override
+        public void shutDown() {
+            module.shutDown();
+        }        
 
     }