mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

6129: Prevent duplicate CR attribute instances that may be created from TSK_INTERESTING_ARTIFACT_HIT in Correlation engine

Browse Source
This commit is contained in:
Raman Arora 2020-03-27 16:02:42 -04:00
parent d30382d3bb
commit b9f8b25c51
2 changed files with 33 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java
View File

@ -59,6 +59,22 @@ public class CorrelationAttributeUtil {
return Bundle.CorrelationAttributeUtil_emailaddresses_text(); return Bundle.CorrelationAttributeUtil_emailaddresses_text();
} }
/**
* Makes zero to many correlation attribute instances from the attributes of
* an artifact.
*
* IMPORTANT: The correlation attribute instances are NOT added to the
* central repository by this method.
*
* @param artifact An artifact.
*
* @return A list, possibly empty, of correlation attribute instances for
* the artifact.
*/
public static List<CorrelationAttributeInstance> makeCorrAttrsFromArtifact(BlackboardArtifact artifact) {
return makeCorrAttrsFromArtifact(artifact, true );
}
/** /**
* Makes zero to many correlation attribute instances from the attributes of * Makes zero to many correlation attribute instances from the attributes of
* an artifact. * an artifact.
@ -74,13 +90,22 @@ public class CorrelationAttributeUtil {
* whether receiving a null return value is an error or not, plus null * whether receiving a null return value is an error or not, plus null
* checking is easy to forget, while catching exceptions is enforced. * checking is easy to forget, while catching exceptions is enforced.
* *
* @param artifact An artifact. * @param artifact An artifact.
* @param resolveSourceArtifact A flag to indicate whether to resolve the
* source artifact, if the given artifact is
* of type TSK_INTERESTING_ARTIFACT_HIT.
* *
* @return A list, possibly empty, of correlation attribute instances for * @return A list, possibly empty, of correlation attribute instances for
* the artifact. * the artifact.
*/ */
public static List<CorrelationAttributeInstance> makeCorrAttrsFromArtifact(BlackboardArtifact artifact) { public static List<CorrelationAttributeInstance> makeCorrAttrsFromArtifact(BlackboardArtifact artifact, boolean resolveSourceArtifact) {
List<CorrelationAttributeInstance> correlationAttrs = new ArrayList<>(); List<CorrelationAttributeInstance> correlationAttrs = new ArrayList<>();
// If the artifact is of type TSK_INTERESTING_ARTIFACT_HIT, and the caller
// has not indicated to resolve the source artifact, then return an empty list.
if ((artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) && (resolveSourceArtifact == false) ) {
return correlationAttrs;
}
try { try {
BlackboardArtifact sourceArtifact = getCorrAttrSourceArtifact(artifact); BlackboardArtifact sourceArtifact = getCorrAttrSourceArtifact(artifact);
if (sourceArtifact != null) { if (sourceArtifact != null) {

7
Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java
View File

@ -455,8 +455,11 @@ public class IngestEventsListener {
List<CorrelationAttributeInstance> eamArtifacts = new ArrayList<>(); List<CorrelationAttributeInstance> eamArtifacts = new ArrayList<>();
for (BlackboardArtifact bbArtifact : bbArtifacts) { for (BlackboardArtifact bbArtifact : bbArtifacts) {
// eamArtifact will be null OR a EamArtifact containing one EamArtifactInstance. // If the incoming artifact is of type TSK_INTERESTING_ARTIFACT_HIT,
List<CorrelationAttributeInstance> convertedArtifacts = CorrelationAttributeUtil.makeCorrAttrsFromArtifact(bbArtifact); // do not resolve to the source artifact, as correlation attributes
// for the source artifact would have laready been created,
// when the event for that source artifact was received.
List<CorrelationAttributeInstance> convertedArtifacts = CorrelationAttributeUtil.makeCorrAttrsFromArtifact(bbArtifact, false);
for (CorrelationAttributeInstance eamArtifact : convertedArtifacts) { for (CorrelationAttributeInstance eamArtifact : convertedArtifacts) {
try { try {
// Only do something with this artifact if it's unique within the job // Only do something with this artifact if it's unique within the job