diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUpgrader15To16.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUpgrader15To16.java index 6294283f8e..c07a0acec5 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUpgrader15To16.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUpgrader15To16.java @@ -41,7 +41,8 @@ public class CentralRepoDbUpgrader15To16 implements CentralRepoDbUpgrader { for (CorrelationAttributeInstance.Type type : CorrelationAttributeInstance.getDefaultCorrelationTypes()) { String instance_type_dbname = CentralRepoDbUtil.correlationTypeToInstanceTableName(type); - if (type.getId() == CorrelationAttributeInstance.INSTALLED_PROGS_TYPE_ID) { + if ((type.getId() == CorrelationAttributeInstance.INSTALLED_PROGS_TYPE_ID) || + (type.getId() == CorrelationAttributeInstance.OSACCOUNT_TYPE_ID)){ // these are new Correlation types - new tables need to be created statement.execute(String.format(RdbmsCentralRepoFactory.getCreateAccountInstancesTableTemplate(selectedPlatform), instance_type_dbname, instance_type_dbname)); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java index e82eca8494..5fe6ae1fa6 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java @@ -258,6 +258,7 @@ public class CorrelationAttributeInstance implements Serializable { public static final int IMSI_TYPE_ID = 8; public static final int ICCID_TYPE_ID = 9; public static final int INSTALLED_PROGS_TYPE_ID = 10; + public static final int OSACCOUNT_TYPE_ID = 11; // An offset to assign Ids for additional correlation types. public static final int ADDITIONAL_TYPES_BASE_ID = 1000; diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java index 806d18c63f..da4280663c 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java @@ -23,6 +23,7 @@ import java.beans.PropertyChangeEvent; import java.beans.PropertyChangeListener; import java.util.EnumSet; import java.util.List; +import java.util.Optional; import java.util.Set; import java.util.concurrent.ExecutorService; import java.util.concurrent.Executors; @@ -37,6 +38,7 @@ import org.sleuthkit.autopsy.casemodule.events.ContentTagAddedEvent; import org.sleuthkit.autopsy.casemodule.events.ContentTagDeletedEvent; import org.sleuthkit.autopsy.casemodule.events.DataSourceAddedEvent; import org.sleuthkit.autopsy.casemodule.events.DataSourceNameChangedEvent; +import org.sleuthkit.autopsy.casemodule.events.OsAccountsAddedEvent; import org.sleuthkit.autopsy.casemodule.services.TagsManager; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; @@ -56,6 +58,7 @@ import org.sleuthkit.datamodel.TskData; import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository; import org.sleuthkit.datamodel.Tag; import org.sleuthkit.autopsy.events.AutopsyEvent; +import org.sleuthkit.datamodel.OsAccount; /** * Listen for case events and update entries in the Central Repository database @@ -75,7 +78,7 @@ public final class CaseEventListener implements PropertyChangeListener { Case.Events.DATA_SOURCE_ADDED, Case.Events.TAG_DEFINITION_CHANGED, Case.Events.CURRENT_CASE, - Case.Events.DATA_SOURCE_NAME_CHANGED); + Case.Events.DATA_SOURCE_NAME_CHANGED, Case.Events.OS_ACCOUNTS_ADDED); public CaseEventListener() { jobProcessingExecutor = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat(CASE_EVENT_THREAD_NAME).build()); @@ -130,6 +133,9 @@ public final class CaseEventListener implements PropertyChangeListener { jobProcessingExecutor.submit(new DataSourceNameChangedTask(dbManager, evt)); } break; + case OS_ACCOUNTS_ADDED: { + jobProcessingExecutor.submit(new OsAccountAddedTask(dbManager, evt)); + } } } @@ -635,6 +641,58 @@ public final class CaseEventListener implements PropertyChangeListener { } // CURRENT_CASE } + private final class OsAccountAddedTask implements Runnable { + + private final CentralRepository dbManager; + private final PropertyChangeEvent event; + + private OsAccountAddedTask(CentralRepository db, PropertyChangeEvent evt) { + dbManager = db; + event = evt; + } + + @Override + public void run() { + if (!CentralRepository.isEnabled()) { + return; + } + + final OsAccountsAddedEvent osAccountsAddedEvent = (OsAccountsAddedEvent) event; + List addedOsAccountNew = osAccountsAddedEvent.getNewValue(); + for (OsAccount osAccount: addedOsAccountNew) { + Optional accountAddr = osAccount.getAddr(); + // Check address if it is null or one of the ones below we want to ignore it since they will always be one a windows system + // and they are not unique + if (!accountAddr.isPresent() || accountAddr.get().equals("S-1-5-18") || accountAddr.get().equals("S-1-5-19") || accountAddr.get().equals("S-1-5-20")) { + return; + } + try { + + CorrelationCase correlationCase = CentralRepository.getInstance().getCase(Case.getCurrentCaseThrows()); +// Type correlationType = CentralRepository.getInstance().getCorrelationTypeById(CorrelationAttributeInstance.OSACCOUNT_TYPE_ID); +// CorrelationAttributeInstance correlationAttributeInstance = new CorrelationAttributeInstance( +// CentralRepository.getInstance().getCorrelationTypeById(CorrelationAttributeInstance.OSACCOUNT_TYPE_ID), +// accountAddr.get(), +// correlationCase, +// CorrelationDataSource.fromTSKDataSource(correlationCase, bbSourceFile.getDataSource), +// "", +// "", +// "", +// "", +// TskData.FileKnown, +// osAccount.getId()); + +// dbManager.addArtifactInstance(correlationAttributeInstance); + } catch (CentralRepoException ex) { + LOGGER.log(Level.SEVERE, "Cannot get central repository for OsAccount: " + "OsAccount", ex); //NON-NLS + } catch (NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS + } + } + LOGGER.log(Level.INFO, "Error connecting to Central Repository database."); //NON-NLS + } + } + private final class DataSourceNameChangedTask implements Runnable { private final CentralRepository dbManager;