codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-03 03:15:54 +00:00
Code Issues Releases Wiki Activity

Merge pull request #4816 from wschaeferB/5056-TooManyUsbsFlagged

Browse Source 
5056 too many usbs flagged
This commit is contained in:
Richard Cordovano
2019-05-24 10:05:54 -04:00
committed by GitHub
parent 0675e6d6a4 f756cc540e
commit 7ebe5eb684
4 changed files with 21 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java
View File

@@ -171,7 +171,8 @@ public class IngestEventsListener {
}
/**
* Configure the listener to flag previously seen devices or not.
* Configure the listener to flag devices previously seen in other cases or
* not.
*
* @param value True to flag seen devices; otherwise false.
*/
@@ -318,7 +319,7 @@ public class IngestEventsListener {
LOGGER.log(Level.SEVERE, "Failed to connect to Central Repository database.", ex);
return;
}
switch (IngestManager.IngestJobEvent.valueOf(evt.getPropertyName())) {
case DATA_SOURCE_ANALYSIS_COMPLETED: {
jobProcessingExecutor.submit(new AnalysisCompleteTask(dbManager, evt));
@@ -332,10 +333,10 @@ public class IngestEventsListener {
}
private final class AnalysisCompleteTask implements Runnable {
private final EamDb dbManager;
private final PropertyChangeEvent event;
private AnalysisCompleteTask(EamDb db, PropertyChangeEvent evt) {
dbManager = db;
event = evt;
@@ -361,15 +362,15 @@ public class IngestEventsListener {
long dataSourceObjectId = -1;
try {
dataSource = ((DataSourceAnalysisCompletedEvent) event).getDataSource();
/*
* We only care about Images for the purpose of
* updating hash values.
* We only care about Images for the purpose of updating hash
* values.
*/
if (!(dataSource instanceof Image)) {
return;
}
dataSourceName = dataSource.getName();
dataSourceObjectId = dataSource.getId();
@@ -397,7 +398,7 @@ public class IngestEventsListener {
if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false) {
correlationDataSource.setMd5(imageMd5Hash);
}
String imageSha1Hash = image.getSha1();
if (imageSha1Hash == null) {
imageSha1Hash = "";
@@ -406,7 +407,7 @@ public class IngestEventsListener {
if (StringUtils.equals(imageSha1Hash, crSha1Hash) == false) {
correlationDataSource.setSha1(imageSha1Hash);
}
String imageSha256Hash = image.getSha256();
if (imageSha256Hash == null) {
imageSha256Hash = "";
@@ -489,9 +490,13 @@ public class IngestEventsListener {
|| eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMSI_TYPE_ID
|| eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.MAC_TYPE_ID)) {
try {
Long countPreviousOccurences = dbManager.getCountArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue());
if (countPreviousOccurences > 0) {
postCorrelatedPreviousArtifactToBlackboard(bbArtifact);
//only alert to previous instances when they were in another case
List<CorrelationAttributeInstance> previousOccurences = dbManager.getArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue());
for (CorrelationAttributeInstance instance : previousOccurences) {
if (!instance.getCorrelationCase().getCaseUUID().equals(eamArtifact.getCorrelationCase().getCaseUUID())) {
postCorrelatedPreviousArtifactToBlackboard(bbArtifact);
break;
}
}
} catch (CorrelationAttributeNormalizationException ex) {
LOGGER.log(Level.INFO, String.format("Unable to flag notable item: %s.", eamArtifact.toString()), ex);

2
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties
View File

@@ -1,4 +1,4 @@
IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings
IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases
IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository

2
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED
View File

@@ -12,5 +12,5 @@ CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central
CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine
IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings
IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices
IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases
IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository

2
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java
View File

@@ -70,7 +70,7 @@ final class IngestSettings implements IngestModuleIngestJobSettings {
}
/**
* Are previously seen devices to be flagged?
* Are devices previously seen in other cases to be flagged?
*
* @return True if flagging; otherwise false.
*/