19 package org.sleuthkit.autopsy.centralrepository.ingestmodule;
23 import java.util.List;
24 import java.util.logging.Level;
25 import java.util.stream.Collectors;
26 import org.openide.util.NbBundle.Messages;
57 @Messages({
"IngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)",
58 "IngestModule.prevCaseComment.text=Previous Case: "})
61 static final boolean DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS =
true;
73 private final boolean flagTaggedNotableItems;
80 IngestModule(IngestSettings settings) {
81 flagTaggedNotableItems = settings.isFlagTaggedNotableItems();
85 public ProcessResult process(AbstractFile abstractFile) {
93 return ProcessResult.OK;
99 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
100 return ProcessResult.ERROR;
104 return ProcessResult.OK;
111 logger.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
112 return ProcessResult.ERROR;
116 if (!filesType.isEnabled()) {
117 return ProcessResult.OK;
121 String md5 = abstractFile.getMd5Hash();
122 if ((md5 == null) || (HashUtility.isNoDataMd5(md5))) {
123 return ProcessResult.OK;
130 if (abstractFile.getKnown() != TskData.FileKnown.KNOWN && flagTaggedNotableItems) {
133 if (!caseDisplayNamesList.isEmpty()) {
134 postCorrelatedBadFileToBlackboard(abstractFile, caseDisplayNamesList);
137 logger.log(Level.SEVERE,
"Error searching database for artifact.", ex);
138 return ProcessResult.ERROR;
148 abstractFile.getParentPath() + abstractFile.
getName(),
150 TskData.FileKnown.UNKNOWN
155 logger.log(Level.SEVERE,
"Error adding artifact to bulk artifacts.", ex);
156 return ProcessResult.ERROR;
159 return ProcessResult.OK;
163 public void shutDown() {
166 if ((
EamDb.
isEnabled() ==
false) || (eamCase == null) || (eamDataSource == null)) {
173 logger.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
179 logger.log(Level.SEVERE,
"Error doing bulk insert of artifacts.", ex);
183 logger.log(Level.INFO,
"{0} artifacts in db for case: {1} ds:{2}",
new Object[]{count, eamCase.getDisplayName(), eamDataSource.getName()});
185 logger.log(Level.SEVERE,
"Error counting artifacts.", ex);
194 "IngestModule.notfyBubble.title=Central Repository Not Initialized",
195 "IngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module."
198 public void startUp(
IngestJobContext context)
throws IngestModuleException {
238 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
239 throw new IngestModuleException(
"Exception while getting open case.", ex);
245 logger.log(Level.SEVERE,
"Cannot run correlation engine on a multi-user case with a SQLite central repository.");
246 throw new IngestModuleException(
"Cannot run on a multi-user case with a SQLite central repository.");
254 logger.log(Level.SEVERE,
"Error connecting to central repository database.", ex);
255 throw new IngestModuleException(
"Error connecting to central repository database.", ex);
261 logger.log(Level.SEVERE,
"Error getting correlation type FILES in ingest module start up.", ex);
262 throw new IngestModuleException(
"Error getting correlation type FILES in ingest module start up.", ex);
266 eamCase = centralRepoDb.
getCase(autopsyCase);
268 throw new IngestModuleException(
"Unable to get case from central repository database ", ex);
270 if (eamCase == null) {
273 eamCase = centralRepoDb.
newCase(autopsyCase);
275 logger.log(Level.SEVERE,
"Error creating new case in ingest module start up.", ex);
276 throw new IngestModuleException(
"Error creating new case in ingest module start up.", ex);
283 logger.log(Level.SEVERE,
"Error getting data source info.", ex);
284 throw new IngestModuleException(
"Error getting data source info.", ex);
297 logger.log(Level.SEVERE,
"Error adding data source to Central Repository.", ex);
298 throw new IngestModuleException(
"Error adding data source to Central Repository.", ex);
304 private void postCorrelatedBadFileToBlackboard(AbstractFile abstractFile, List<String> caseDisplayNames) {
308 BlackboardArtifact tifArtifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
309 BlackboardAttribute att =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME,
310 Bundle.IngestModule_prevTaggedSet_text());
311 BlackboardAttribute att2 =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME,
312 Bundle.IngestModule_prevCaseComment_text() + caseDisplayNames.stream().distinct().collect(Collectors.joining(
",",
"",
"")));
313 tifArtifact.addAttribute(att);
314 tifArtifact.addAttribute(att2);
320 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + tifArtifact.getArtifactID(), ex);
324 sendBadFileInboxMessage(tifArtifact, abstractFile.getName(), abstractFile.getMd5Hash());
328 }
catch (TskCoreException ex) {
329 logger.log(Level.SEVERE,
"Failed to create BlackboardArtifact.", ex);
330 }
catch (IllegalStateException ex) {
331 logger.log(Level.SEVERE,
"Failed to create BlackboardAttribute.", ex);
343 @Messages({
"IngestModule.postToBB.fileName=File Name",
344 "IngestModule.postToBB.md5Hash=MD5 Hash",
345 "IngestModule.postToBB.hashSetSource=Source of Hash",
346 "IngestModule.postToBB.eamHit=Central Repository",
347 "# {0} - Name of file that is Notable",
348 "IngestModule.postToBB.knownBadMsg=Notable: {0}"})
349 public void sendBadFileInboxMessage(BlackboardArtifact artifact, String name, String md5Hash) {
350 StringBuilder detailsSb =
new StringBuilder();
352 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
354 detailsSb.append(
"<tr>");
355 detailsSb.append(
"<th>")
356 .append(Bundle.IngestModule_postToBB_fileName())
358 detailsSb.append(
"<td>")
361 detailsSb.append(
"</tr>");
363 detailsSb.append(
"<tr>");
364 detailsSb.append(
"<th>")
365 .append(Bundle.IngestModule_postToBB_md5Hash())
367 detailsSb.append(
"<td>").append(md5Hash).append(
"</td>");
368 detailsSb.append(
"</tr>");
370 detailsSb.append(
"<tr>");
371 detailsSb.append(
"<th>")
372 .append(Bundle.IngestModule_postToBB_hashSetSource())
374 detailsSb.append(
"<td>").append(Bundle.IngestModule_postToBB_eamHit()).append(
"</td>");
375 detailsSb.append(
"</tr>");
377 detailsSb.append(
"</table>");
380 Bundle.IngestModule_postToBB_knownBadMsg(name),
381 detailsSb.toString(),
CorrelationDataSource getDataSource(CorrelationCase correlationCase, String dataSourceDeviceId)
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
synchronized long decrementAndGet(long jobId)
static synchronized int getCeModuleInstanceCount()
static IngestMessage createDataMessage(String source, String subject, String detailsHtml, String uniqueKey, BlackboardArtifact data)
static boolean runningWithGUI
static final int FILES_TYPE_ID
void prepareBulkArtifact(CorrelationAttribute eamArtifact)
CorrelationCase newCase(CorrelationCase eamCase)
static Case getOpenCase()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
static boolean isValidCentralRepoFile(AbstractFile af)
synchronized long incrementAndGet(long jobId)
void bulkInsertArtifacts()
List< String > getListCasesHavingArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
void addInstance(CorrelationAttributeInstance artifactInstance)
static synchronized boolean isFlagNotableItems()
static EamDb getInstance()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
Long getCountArtifactInstancesByCaseDataSource(String caseUUID, String dataSourceID)
static boolean isEnabled()
static synchronized void setFlagNotableItems(boolean value)
Blackboard getBlackboard()
CorrelationCase getCase(Case autopsyCase)
synchronized void indexArtifact(BlackboardArtifact artifact)
synchronized static Logger getLogger(String name)
static synchronized void incrementCorrelationEngineModuleCount()
static synchronized void decrementCorrelationEngineModuleCount()
static void warn(String title, String message)
void newDataSource(CorrelationDataSource eamDataSource)
static synchronized IngestServices getInstance()