Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
CorrelationAttribute.java
Go to the documentation of this file.
1 /*
2  * Central Repository
3  *
4  * Copyright 2015-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.centralrepository.datamodel;
20 
21 import java.io.Serializable;
22 import java.util.ArrayList;
23 import java.util.List;
24 import java.util.Objects;
25 import java.util.regex.Pattern;
26 import org.openide.util.NbBundle.Messages;
27 
33 public class CorrelationAttribute implements Serializable {
34 
35  private static final long serialVersionUID = 1L;
36 
37  private String ID;
38  private String correlationValue;
40  private final List<CorrelationAttributeInstance> artifactInstances;
41 
42  // Type ID's for Default Correlation Types
43  public static final int FILES_TYPE_ID = 0;
44  public static final int DOMAIN_TYPE_ID = 1;
45  public static final int EMAIL_TYPE_ID = 2;
46  public static final int PHONE_TYPE_ID = 3;
47  public static final int USBID_TYPE_ID = 4;
48 
54  @Messages({"CorrelationType.FILES.displayName=Files",
55  "CorrelationType.DOMAIN.displayName=Domains",
56  "CorrelationType.EMAIL.displayName=Email Addresses",
57  "CorrelationType.PHONE.displayName=Phone Numbers",
58  "CorrelationType.USBID.displayName=USB Devices"})
59  public static List<CorrelationAttribute.Type> getDefaultCorrelationTypes() throws EamDbException {
60  List<CorrelationAttribute.Type> DEFAULT_CORRELATION_TYPES = new ArrayList<>();
61  DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(FILES_TYPE_ID, Bundle.CorrelationType_FILES_displayName(), "file", true, true)); // NON-NLS
62  DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(DOMAIN_TYPE_ID, Bundle.CorrelationType_DOMAIN_displayName(), "domain", true, false)); // NON-NLS
63  DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(EMAIL_TYPE_ID, Bundle.CorrelationType_EMAIL_displayName(), "email_address", true, false)); // NON-NLS
64  DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(PHONE_TYPE_ID, Bundle.CorrelationType_PHONE_displayName(), "phone_number", true, false)); // NON-NLS
65  DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(USBID_TYPE_ID, Bundle.CorrelationType_USBID_displayName(), "usb_devices", true, false)); // NON-NLS
66  return DEFAULT_CORRELATION_TYPES;
67  }
68 
69  public CorrelationAttribute(Type correlationType, String correlationValue) {
70  this.ID = "";
71  this.correlationType = correlationType;
72  // Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
73  this.correlationValue = correlationValue.toLowerCase();
74  this.artifactInstances = new ArrayList<>();
75  }
76 
77  public Boolean equals(CorrelationAttribute otherArtifact) {
78  return ((this.getID().equals(otherArtifact.getID()))
79  && (this.getCorrelationType().equals(otherArtifact.getCorrelationType()))
80  && (this.getCorrelationValue().equals(otherArtifact.getCorrelationValue()))
81  && (this.getInstances().equals(otherArtifact.getInstances())));
82  }
83 
84  @Override
85  public String toString() {
86  // NOTE: This string is currently being used in IngestEventsListener to detect if we have already seen
87  // the value and type pair. Be careful if this method is changed.
88  String result = this.getID()
89  + this.getCorrelationType().toString()
90  + this.getCorrelationValue();
91  result = this.getInstances().stream().map((inst) -> inst.toString()).reduce(result, String::concat);
92  return result;
93  }
94 
98  public String getID() {
99  return ID;
100  }
101 
105  public void setID(String ID) {
106  this.ID = ID;
107  }
108 
112  public String getCorrelationValue() {
113  return correlationValue;
114  }
115 
119  public void setCorrelationValue(String correlationValue) {
120  // Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
121  this.correlationValue = correlationValue.toLowerCase();
122  }
123 
128  return correlationType;
129  }
130 
134  public void setCorrelationType(Type correlationType) {
135  this.correlationType = correlationType;
136  }
137 
142  public List<CorrelationAttributeInstance> getInstances() {
143  return new ArrayList<>(artifactInstances);
144  }
145 
149  public void setInstances(List<CorrelationAttributeInstance> artifactInstances) {
150  this.artifactInstances.clear();
151  if (null != artifactInstances) {
152  this.artifactInstances.addAll(artifactInstances);
153  }
154  }
155 
159  public void addInstance(CorrelationAttributeInstance artifactInstance) {
160  this.artifactInstances.add(artifactInstance);
161  }
162 
163  public static class Type implements Serializable {
164 
165  private int id;
166  private String displayName;
167  private String dbTableName;
168  private Boolean supported;
169  private Boolean enabled;
170  private final String DB_NAMES_REGEX = "[a-z][a-z0-9_]*";
171 
182  public Type(int id, String displayName, String dbTableName, Boolean supported, Boolean enabled) throws EamDbException {
183  this.id = id;
184  this.displayName = displayName;
185  this.dbTableName = dbTableName;
186  this.supported = supported;
187  this.enabled = enabled;
188  if (!Pattern.matches(DB_NAMES_REGEX, dbTableName)) {
189  throw new EamDbException("Invalid database table name. Name must start with a lowercase letter and can only contain lowercase letters, numbers, and '_'."); // NON-NLS
190  }
191  }
192 
205  public Type(String displayName, String dbTableName, Boolean supported, Boolean enabled) throws EamDbException {
207  }
208 
216  @Override
217  public boolean equals(Object that) {
218  if (this == that) {
219  return true;
220  } else if (!(that instanceof CorrelationAttribute.Type)) {
221  return false;
222  } else {
223  return ((CorrelationAttribute.Type) that).sameType(this);
224  }
225  }
226 
235  private boolean sameType(CorrelationAttribute.Type that) {
236  return this.id == that.getId()
237  && Objects.equals(this.supported, that.isSupported())
238  && Objects.equals(this.enabled, that.isEnabled());
239  }
240 
241  @Override
242  public int hashCode() {
243  int hash = 7;
244  hash = 67 * hash + Objects.hashCode(this.id);
245  hash = 67 * hash + Objects.hashCode(this.supported);
246  hash = 67 * hash + Objects.hashCode(this.enabled);
247  return hash;
248  }
249 
250  @Override
251  public String toString() {
252  StringBuilder str = new StringBuilder();
253  str.append("(id=").append(getId());
254  str.append(", displayName=").append(getDisplayName());
255  str.append(", dbTableName=").append(getDbTableName());
256  str.append(", supported=").append(isSupported().toString());
257  str.append(", enabled=").append(isEnabled().toString());
258  str.append(")");
259  return str.toString();
260  }
261 
265  public int getId() {
266  return id;
267  }
268 
272  public void setId(int id) {
273  this.id = id;
274  }
275 
281  public Boolean isSupported() {
282  return supported;
283  }
284 
290  public void setSupported(Boolean supported) {
291  this.supported = supported;
292  }
293 
299  public Boolean isEnabled() {
300  return enabled;
301  }
302 
308  public void setEnabled(Boolean enabled) {
309  this.enabled = enabled;
310  }
311 
315  public String getDisplayName() {
316  return displayName;
317  }
318 
322  public void setDisplayName(String displayName) {
323  this.displayName = displayName;
324  }
325 
341  public String getDbTableName() {
342  return dbTableName;
343  }
344 
363  public void setDbTableName(String dbTableName) throws EamDbException {
364  if (!Pattern.matches(DB_NAMES_REGEX, dbTableName)) {
365  throw new EamDbException("Invalid database table name. Name must start with a lowercase letter and can only contain lowercase letters, numbers, and '_'."); // NON-NLS
366  }
367  this.dbTableName = dbTableName;
368  }
369  }
370 }
Type(int id, String displayName, String dbTableName, Boolean supported, Boolean enabled)
void setInstances(List< CorrelationAttributeInstance > artifactInstances)
void addInstance(CorrelationAttributeInstance artifactInstance)
Type(String displayName, String dbTableName, Boolean supported, Boolean enabled)

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.