@cccsaurora/howler-ui 2.19.0-cases.1110 → 2.19.0-cases.1111
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/components/app/App.js +3 -3
- package/components/routes/cases/detail/{CaseAssets.d.ts → CaseObservables.d.ts} +2 -2
- package/components/routes/cases/detail/{CaseAssets.js → CaseObservables.js} +18 -18
- package/components/routes/cases/detail/{CaseAssets.test.js → CaseObservables.test.js} +34 -34
- package/components/routes/cases/detail/CaseSidebar.js +1 -1
- package/components/routes/cases/detail/CaseSidebar.test.js +3 -3
- package/components/routes/cases/detail/observables/Observable.d.ts +14 -0
- package/components/routes/cases/detail/{assets/Asset.js → observables/Observable.js} +3 -3
- package/components/routes/cases/detail/{assets/Asset.test.js → observables/Observable.test.js} +13 -13
- package/locales/en/translation.json +12 -12
- package/locales/fr/translation.json +12 -12
- package/package.json +2 -2
- package/components/routes/cases/detail/assets/Asset.d.ts +0 -14
- /package/components/routes/cases/detail/{CaseAssets.test.d.ts → CaseObservables.test.d.ts} +0 -0
- /package/components/routes/cases/detail/{assets/Asset.test.d.ts → observables/Observable.test.d.ts} +0 -0
package/components/app/App.js
CHANGED
|
@@ -28,8 +28,8 @@ import AnalyticDetails from '@cccsaurora/howler-ui/components/routes/analytics/A
|
|
|
28
28
|
import AnalyticSearch from '@cccsaurora/howler-ui/components/routes/analytics/AnalyticSearch';
|
|
29
29
|
import CaseViewer from '@cccsaurora/howler-ui/components/routes/cases/CaseViewer';
|
|
30
30
|
import Cases from '@cccsaurora/howler-ui/components/routes/cases/Cases';
|
|
31
|
-
import CaseAssets from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseAssets';
|
|
32
31
|
import CaseDashboard from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseDashboard';
|
|
32
|
+
import CaseObservables from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseObservables';
|
|
33
33
|
import CaseRules from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseRules';
|
|
34
34
|
import CaseTimeline from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseTimeline';
|
|
35
35
|
import ItemPage from '@cccsaurora/howler-ui/components/routes/cases/detail/ItemPage';
|
|
@@ -214,8 +214,8 @@ const createRouter = () => createBrowserRouter([
|
|
|
214
214
|
element: _jsx(CaseDashboard, {})
|
|
215
215
|
},
|
|
216
216
|
{
|
|
217
|
-
path: '
|
|
218
|
-
element: _jsx(
|
|
217
|
+
path: 'observables',
|
|
218
|
+
element: _jsx(CaseObservables, {})
|
|
219
219
|
},
|
|
220
220
|
{
|
|
221
221
|
path: 'timeline',
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
|
|
2
2
|
import type { Event } from '@cccsaurora/howler-ui/models/entities/generated/Event';
|
|
3
3
|
import type { Hit } from '@cccsaurora/howler-ui/models/entities/generated/Hit';
|
|
4
|
-
import { type
|
|
4
|
+
import { type ObservableEntry } from './observables/Observable';
|
|
5
5
|
/** Deduplicate and merge seenIn lists into a map keyed by `type:value` */
|
|
6
|
-
export declare const
|
|
6
|
+
export declare const buildObservableEntries: (records: Partial<Hit | Event>[]) => ObservableEntry[];
|
|
7
7
|
declare const _default: import("react").NamedExoticComponent<{
|
|
8
8
|
case?: Case;
|
|
9
9
|
caseId?: string;
|
|
@@ -6,16 +6,16 @@ import { memo, useEffect, useMemo, useState } from 'react';
|
|
|
6
6
|
import { useTranslation } from 'react-i18next';
|
|
7
7
|
import { useOutletContext } from 'react-router-dom';
|
|
8
8
|
import useCase from '../hooks/useCase';
|
|
9
|
-
import
|
|
10
|
-
/** All Related fields that carry
|
|
11
|
-
const
|
|
9
|
+
import Observable, {} from './observables/Observable';
|
|
10
|
+
/** All Related fields that carry observable values */
|
|
11
|
+
const OBSERVABLE_FIELDS = ['hash', 'hosts', 'ip', 'user', 'ids', 'id', 'uri', 'signature'];
|
|
12
12
|
/** Extract (type, value, seenInId) triples from a record's related field */
|
|
13
|
-
const
|
|
13
|
+
const extractObservables = (related, recordId) => {
|
|
14
14
|
if (!related) {
|
|
15
15
|
return [];
|
|
16
16
|
}
|
|
17
17
|
const results = [];
|
|
18
|
-
for (const field of
|
|
18
|
+
for (const field of OBSERVABLE_FIELDS) {
|
|
19
19
|
const raw = related[field];
|
|
20
20
|
if (!raw) {
|
|
21
21
|
continue;
|
|
@@ -30,7 +30,7 @@ const extractAssets = (related, recordId) => {
|
|
|
30
30
|
return results;
|
|
31
31
|
};
|
|
32
32
|
/** Deduplicate and merge seenIn lists into a map keyed by `type:value` */
|
|
33
|
-
export const
|
|
33
|
+
export const buildObservableEntries = (records) => {
|
|
34
34
|
const map = new Map();
|
|
35
35
|
for (const record of records) {
|
|
36
36
|
const related = record.related ?? record.related;
|
|
@@ -38,7 +38,7 @@ export const buildAssetEntries = (records) => {
|
|
|
38
38
|
if (!recordId) {
|
|
39
39
|
continue;
|
|
40
40
|
}
|
|
41
|
-
for (const { type, value, id } of
|
|
41
|
+
for (const { type, value, id } of extractObservables(related, recordId)) {
|
|
42
42
|
const key = `${type}:${value}`;
|
|
43
43
|
if (!map.has(key)) {
|
|
44
44
|
map.set(key, { type, value, seenIn: [] });
|
|
@@ -51,8 +51,8 @@ export const buildAssetEntries = (records) => {
|
|
|
51
51
|
}
|
|
52
52
|
return Array.from(map.values());
|
|
53
53
|
};
|
|
54
|
-
const RELATED_FIELDS =
|
|
55
|
-
const
|
|
54
|
+
const RELATED_FIELDS = OBSERVABLE_FIELDS.map(f => `related.${f}`).join(',');
|
|
55
|
+
const CaseObservables = ({ case: providedCase, caseId }) => {
|
|
56
56
|
const { t } = useTranslation();
|
|
57
57
|
const { dispatchApi } = useMyApi();
|
|
58
58
|
const routeCase = useOutletContext();
|
|
@@ -73,17 +73,17 @@ const CaseAssets = ({ case: providedCase, caseId }) => {
|
|
|
73
73
|
fl: `howler.id,${RELATED_FIELDS}`
|
|
74
74
|
})).then(response => setRecords(response.items));
|
|
75
75
|
}, [dispatchApi, ids]);
|
|
76
|
-
const
|
|
77
|
-
const
|
|
78
|
-
const
|
|
79
|
-
if (
|
|
76
|
+
const allObservables = useMemo(() => (records ? buildObservableEntries(records) : []), [records]);
|
|
77
|
+
const observableTypes = useMemo(() => (allObservables ? [...new Set(allObservables.map(a => a.type))].sort() : []), [allObservables]);
|
|
78
|
+
const filteredObservables = useMemo(() => {
|
|
79
|
+
if (allObservables.length < 1) {
|
|
80
80
|
return [];
|
|
81
81
|
}
|
|
82
82
|
if (activeFilters.size === 0) {
|
|
83
|
-
return
|
|
83
|
+
return allObservables;
|
|
84
84
|
}
|
|
85
|
-
return
|
|
86
|
-
}, [
|
|
85
|
+
return allObservables.filter(a => activeFilters.has(a.type));
|
|
86
|
+
}, [allObservables, activeFilters]);
|
|
87
87
|
const toggleFilter = (type) => {
|
|
88
88
|
setActiveFilters(prev => {
|
|
89
89
|
const next = new Set(prev);
|
|
@@ -99,6 +99,6 @@ const CaseAssets = ({ case: providedCase, caseId }) => {
|
|
|
99
99
|
if (!_case) {
|
|
100
100
|
return null;
|
|
101
101
|
}
|
|
102
|
-
return (_jsxs(Grid, { container: true, spacing: 2, px: 2, children: [_jsx(Grid, { item: true, xs: 12, children: _jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, flexWrap: "wrap", children: [_jsx(Typography, { variant: "subtitle2", color: "text.secondary", children: t('page.cases.
|
|
102
|
+
return (_jsxs(Grid, { container: true, spacing: 2, px: 2, children: [_jsx(Grid, { item: true, xs: 12, children: _jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, flexWrap: "wrap", children: [_jsx(Typography, { variant: "subtitle2", color: "text.secondary", children: t('page.cases.observables.filter_by_type') }), records === null ? (_jsx(Skeleton, { width: 240, height: 32 })) : (observableTypes.map(type => (_jsx(Chip, { label: t(`page.cases.observables.type.${type}`), size: "small", onClick: () => toggleFilter(type), color: activeFilters.has(type) ? 'primary' : 'default', variant: activeFilters.has(type) ? 'filled' : 'outlined' }, type))))] }) }), records === null ? (Array.from({ length: 6 }, (_, i) => (_jsx(Grid, { item: true, xs: 12, sm: 6, md: 4, xl: 3, children: _jsx(Skeleton, { height: 100 }) }, `skeleton-${i}`)))) : filteredObservables.length === 0 ? (_jsx(Grid, { item: true, xs: 12, children: _jsx(Typography, { color: "text.secondary", children: t('page.cases.observables.empty') }) })) : (filteredObservables.map(observable => (_jsx(Grid, { item: true, xs: 12, md: 6, xl: 4, children: _jsx(Observable, { asset: observable, case: _case }) }, `${observable.type}:${observable.value}`))))] }));
|
|
103
103
|
};
|
|
104
|
-
export default memo(
|
|
104
|
+
export default memo(CaseObservables);
|
|
@@ -6,28 +6,28 @@ import { createElement } from 'react';
|
|
|
6
6
|
import { MemoryRouter } from 'react-router-dom';
|
|
7
7
|
import { createMockEvent, createMockHit } from '@cccsaurora/howler-ui/tests/utils';
|
|
8
8
|
import { describe, expect, it, vi } from 'vitest';
|
|
9
|
-
import {
|
|
9
|
+
import { buildObservableEntries } from './CaseObservables';
|
|
10
10
|
// ---------------------------------------------------------------------------
|
|
11
11
|
// Pure logic tests — no React needed
|
|
12
12
|
// ---------------------------------------------------------------------------
|
|
13
|
-
describe('
|
|
13
|
+
describe('buildObservableEntries', () => {
|
|
14
14
|
it('returns an empty array for records with no related field', () => {
|
|
15
|
-
expect(
|
|
15
|
+
expect(buildObservableEntries([createMockHit({ howler: { id: 'h1' } })])).toEqual([]);
|
|
16
16
|
});
|
|
17
17
|
it('extracts a single IP from a hit', () => {
|
|
18
|
-
const result =
|
|
18
|
+
const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } })]);
|
|
19
19
|
expect(result).toHaveLength(1);
|
|
20
20
|
expect(result[0]).toEqual({ type: 'ip', value: '1.2.3.4', seenIn: ['h1'] });
|
|
21
21
|
});
|
|
22
22
|
it('extracts multiple fields from a single record', () => {
|
|
23
|
-
const result =
|
|
23
|
+
const result = buildObservableEntries([
|
|
24
24
|
createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } })
|
|
25
25
|
]);
|
|
26
26
|
const types = result.map(a => a.type).sort();
|
|
27
27
|
expect(types).toEqual(['ip', 'user']);
|
|
28
28
|
});
|
|
29
29
|
it('deduplicates the same asset value across multiple records', () => {
|
|
30
|
-
const result =
|
|
30
|
+
const result = buildObservableEntries([
|
|
31
31
|
createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
|
|
32
32
|
createMockEvent({ howler: { id: 'obs1' }, related: { ip: ['1.2.3.4'] } })
|
|
33
33
|
]);
|
|
@@ -35,14 +35,14 @@ describe('buildAssetEntries', () => {
|
|
|
35
35
|
expect(result[0].seenIn).toEqual(['h1', 'obs1']);
|
|
36
36
|
});
|
|
37
37
|
it('keeps distinct asset values as separate entries', () => {
|
|
38
|
-
const result =
|
|
38
|
+
const result = buildObservableEntries([
|
|
39
39
|
createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
|
|
40
40
|
createMockHit({ howler: { id: 'h2' }, related: { ip: ['5.6.7.8'] } })
|
|
41
41
|
]);
|
|
42
42
|
expect(result).toHaveLength(2);
|
|
43
43
|
});
|
|
44
44
|
it('does not duplicate seenIn ids when the same record appears twice for the same asset', () => {
|
|
45
|
-
const result =
|
|
45
|
+
const result = buildObservableEntries([
|
|
46
46
|
createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
|
|
47
47
|
createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } })
|
|
48
48
|
]);
|
|
@@ -50,10 +50,10 @@ describe('buildAssetEntries', () => {
|
|
|
50
50
|
});
|
|
51
51
|
it('skips records with no howler.id', () => {
|
|
52
52
|
const noId = { related: { ip: ['1.2.3.4'] } };
|
|
53
|
-
expect(
|
|
53
|
+
expect(buildObservableEntries([noId])).toEqual([]);
|
|
54
54
|
});
|
|
55
55
|
it('handles the scalar `id` field on Related', () => {
|
|
56
|
-
const result =
|
|
56
|
+
const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related: { id: 'some-id' } })]);
|
|
57
57
|
expect(result).toHaveLength(1);
|
|
58
58
|
expect(result[0]).toEqual({ type: 'id', value: 'some-id', seenIn: ['h1'] });
|
|
59
59
|
});
|
|
@@ -66,7 +66,7 @@ describe('buildAssetEntries', () => {
|
|
|
66
66
|
uri: ['https://example.com'],
|
|
67
67
|
signature: ['rule-X']
|
|
68
68
|
};
|
|
69
|
-
const result =
|
|
69
|
+
const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related })]);
|
|
70
70
|
const types = result.map(a => a.type).sort();
|
|
71
71
|
expect(types).toEqual(['hash', 'hosts', 'ids', 'signature', 'uri', 'user']);
|
|
72
72
|
});
|
|
@@ -91,65 +91,65 @@ const mockCase = {
|
|
|
91
91
|
{ type: 'event', value: 'obs-1' }
|
|
92
92
|
]
|
|
93
93
|
};
|
|
94
|
-
const Wrapper = ({ children }) => createElement(MemoryRouter, { initialEntries: ['/cases/case-001/
|
|
94
|
+
const Wrapper = ({ children }) => createElement(MemoryRouter, { initialEntries: ['/cases/case-001/observables'] }, children);
|
|
95
95
|
// lazy import the component after mocks are set up
|
|
96
|
-
const
|
|
97
|
-
describe('
|
|
96
|
+
const CaseObservables = (await import('./CaseObservables')).default;
|
|
97
|
+
describe('CaseObservables component', () => {
|
|
98
98
|
beforeEach(() => {
|
|
99
99
|
mockDispatchApi.mockClear();
|
|
100
100
|
});
|
|
101
101
|
it('renders skeletons while records are loading', () => {
|
|
102
102
|
mockDispatchApi.mockReturnValue(new Promise(() => { })); // never resolves
|
|
103
|
-
render(_jsx(
|
|
103
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
104
104
|
// 6 skeleton cards
|
|
105
105
|
const skeletons = document.querySelectorAll('.MuiSkeleton-root');
|
|
106
106
|
expect(skeletons.length).toBeGreaterThan(0);
|
|
107
107
|
});
|
|
108
|
-
it('shows "No
|
|
108
|
+
it('shows "No observables found" when records have no related data', async () => {
|
|
109
109
|
mockDispatchApi.mockResolvedValue({
|
|
110
110
|
items: [{ howler: { id: 'hit-1' } }, { howler: { id: 'obs-1' } }]
|
|
111
111
|
});
|
|
112
|
-
render(_jsx(
|
|
113
|
-
await screen.findByText('page.cases.
|
|
112
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
113
|
+
await screen.findByText('page.cases.observables.empty');
|
|
114
114
|
});
|
|
115
|
-
it('renders
|
|
115
|
+
it('renders observable cards for extracted observables', async () => {
|
|
116
116
|
mockDispatchApi.mockResolvedValue({
|
|
117
117
|
items: [{ howler: { id: 'hit-1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } }]
|
|
118
118
|
});
|
|
119
|
-
render(_jsx(
|
|
119
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
120
120
|
await screen.findByText('1.2.3.4');
|
|
121
121
|
expect(screen.getByText('alice')).toBeTruthy();
|
|
122
122
|
});
|
|
123
|
-
it('renders a filter chip for each
|
|
123
|
+
it('renders a filter chip for each observable type present', async () => {
|
|
124
124
|
mockDispatchApi.mockResolvedValue({
|
|
125
125
|
items: [{ howler: { id: 'hit-1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } }]
|
|
126
126
|
});
|
|
127
|
-
render(_jsx(
|
|
128
|
-
await screen.findAllByText('page.cases.
|
|
129
|
-
expect(screen.getAllByText('page.cases.
|
|
130
|
-
expect(screen.getAllByText('page.cases.
|
|
127
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
128
|
+
await screen.findAllByText('page.cases.observables.type.ip');
|
|
129
|
+
expect(screen.getAllByText('page.cases.observables.type.ip')).toHaveLength(2);
|
|
130
|
+
expect(screen.getAllByText('page.cases.observables.type.user')).toHaveLength(2);
|
|
131
131
|
});
|
|
132
|
-
it('filters
|
|
132
|
+
it('filters observables when a type chip is clicked', async () => {
|
|
133
133
|
mockDispatchApi.mockResolvedValue({
|
|
134
134
|
items: [{ howler: { id: 'hit-1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } }]
|
|
135
135
|
});
|
|
136
|
-
render(_jsx(
|
|
137
|
-
// Wait for both
|
|
136
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
137
|
+
// Wait for both observables to appear
|
|
138
138
|
await screen.findByText('1.2.3.4');
|
|
139
139
|
expect(screen.getByText('alice')).toBeTruthy();
|
|
140
140
|
// Click the 'ip' filter chip
|
|
141
|
-
await userEvent.click(screen.getByRole('button', { name: 'page.cases.
|
|
141
|
+
await userEvent.click(screen.getByRole('button', { name: 'page.cases.observables.type.ip' }));
|
|
142
142
|
// Alice (user) should be filtered out
|
|
143
143
|
expect(screen.queryByText('alice')).toBeNull();
|
|
144
144
|
expect(screen.getByText('1.2.3.4')).toBeTruthy();
|
|
145
145
|
});
|
|
146
|
-
it('restores all
|
|
146
|
+
it('restores all observables when an active filter chip is clicked again', async () => {
|
|
147
147
|
mockDispatchApi.mockResolvedValue({
|
|
148
148
|
items: [{ howler: { id: 'hit-1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } }]
|
|
149
149
|
});
|
|
150
|
-
render(_jsx(
|
|
150
|
+
render(_jsx(CaseObservables, { case: mockCase }), { wrapper: Wrapper });
|
|
151
151
|
await screen.findByText('1.2.3.4');
|
|
152
|
-
const ipChip = screen.getByRole('button', { name: 'page.cases.
|
|
152
|
+
const ipChip = screen.getByRole('button', { name: 'page.cases.observables.type.ip' });
|
|
153
153
|
await userEvent.click(ipChip);
|
|
154
154
|
await userEvent.click(ipChip);
|
|
155
155
|
expect(screen.getByText('1.2.3.4')).toBeTruthy();
|
|
@@ -157,8 +157,8 @@ describe('CaseAssets component', () => {
|
|
|
157
157
|
});
|
|
158
158
|
it('renders nothing when the case has no hit/event items', async () => {
|
|
159
159
|
const emptyCase = { case_id: 'case-002', items: [] };
|
|
160
|
-
render(_jsx(
|
|
161
|
-
await screen.findByText('page.cases.
|
|
160
|
+
render(_jsx(CaseObservables, { case: emptyCase }), { wrapper: Wrapper });
|
|
161
|
+
await screen.findByText('page.cases.observables.empty');
|
|
162
162
|
expect(mockDispatchApi).not.toHaveBeenCalled();
|
|
163
163
|
});
|
|
164
164
|
});
|
|
@@ -99,7 +99,7 @@ const CaseSidebar = ({ case: _case, update }) => {
|
|
|
99
99
|
maxHeight: 'calc(100vh - 64px)',
|
|
100
100
|
display: 'flex',
|
|
101
101
|
flexDirection: 'column'
|
|
102
|
-
}, children: [_jsxs(Card, { sx: { borderRadius: 0, px: 2, py: 1 }, children: [_case?.title ? _jsx(Typography, { variant: "body1", children: _case.title }) : _jsx(Skeleton, { height: 24 }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", divider: _jsx(Circle, { color: "disabled", sx: { fontSize: '8px' } }), children: [_jsxs(Typography, { variant: "caption", color: "textSecondary", children: [t('started'), ": ", _case?.created ? dayjs(_case.created).toString() : _jsx(Skeleton, { height: 14 })] }), _case?.escalation ? (_jsx(Chip, { color: ESCALATION_COLOR_MAP[_case.escalation], label: t(_case.escalation) })) : (_jsx(Skeleton, { height: 24 }))] })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith(_case?.case_id)), component: Link, to: `/cases/${_case?.case_id}`, children: [_jsx(Dashboard, { fontSize: "small" }), _jsx(Typography, { variant: "body2", sx: { pl: 1, textWrap: 'nowrap' }, children: t('page.cases.dashboard') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith('
|
|
102
|
+
}, children: [_jsxs(Card, { sx: { borderRadius: 0, px: 2, py: 1 }, children: [_case?.title ? _jsx(Typography, { variant: "body1", children: _case.title }) : _jsx(Skeleton, { height: 24 }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", divider: _jsx(Circle, { color: "disabled", sx: { fontSize: '8px' } }), children: [_jsxs(Typography, { variant: "caption", color: "textSecondary", children: [t('started'), ": ", _case?.created ? dayjs(_case.created).toString() : _jsx(Skeleton, { height: 14 })] }), _case?.escalation ? (_jsx(Chip, { color: ESCALATION_COLOR_MAP[_case.escalation], label: t(_case.escalation) })) : (_jsx(Skeleton, { height: 24 }))] })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith(_case?.case_id)), component: Link, to: `/cases/${_case?.case_id}`, children: [_jsx(Dashboard, { fontSize: "small" }), _jsx(Typography, { variant: "body2", sx: { pl: 1, textWrap: 'nowrap' }, children: t('page.cases.dashboard') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith('observables')), component: Link, to: `/cases/${_case?.case_id}/observables`, children: [_jsx(Dataset, { fontSize: "small" }), _jsx(Typography, { variant: "body2", sx: { userSelect: 'none', pl: 1, textWrap: 'nowrap' }, children: t('page.cases.observables') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith('timeline')), component: Link, to: `/cases/${_case?.case_id}/timeline`, children: [_jsx(CalendarMonth, { fontSize: "small" }), _jsx(Typography, { variant: "body2", sx: { userSelect: 'none', pl: 1, textWrap: 'nowrap' }, children: t('page.cases.timeline') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname.endsWith('rules')), component: Link, to: `/cases/${_case?.case_id}/rules`, children: [_jsx(Rule, {}), _jsx(Typography, { variant: "body2", sx: { userSelect: 'none', pl: 1, textWrap: 'nowrap' }, children: t('page.cases.rules') })] }), _jsx(Divider, {}), _case && (_jsx(Box, { flex: 1, overflow: "auto", width: "100%", sx: {
|
|
103
103
|
position: 'relative',
|
|
104
104
|
borderRight: `thin solid ${theme.palette.divider}`
|
|
105
105
|
}, children: _jsxs(Box, { position: "absolute", sx: { left: 0, right: 0 }, children: [_jsx(LinearProgress, { sx: { mb: 0.5, opacity: +loading } }), _jsxs(DndContext, { sensors: sensors, collisionDetection: pointerWithin, onDragStart: handleDragStart, onDragEnd: handleDragEnd, children: [_jsx(CaseFolder, { case: _case, onItemUpdated: update }), _jsx(RootDropZone, { caseId: _case.case_id }), _jsx(DragOverlay, { dropAnimation: null, children: activeDragData && (_jsx(FolderEntry, { caseId: null, path: "", indent: 0, label: activeDragData.label, itemType: activeDragData.type })) })] })] }) }))] }));
|
|
@@ -146,10 +146,10 @@ describe('CaseSidebar', () => {
|
|
|
146
146
|
const link = screen.getByText('page.cases.dashboard').closest('a');
|
|
147
147
|
expect(link).toHaveAttribute('href', '/cases/case-1');
|
|
148
148
|
});
|
|
149
|
-
it('renders an
|
|
149
|
+
it('renders an Observables nav link pointing to the case observables route', () => {
|
|
150
150
|
renderSidebar();
|
|
151
|
-
const link = screen.getByText('page.cases.
|
|
152
|
-
expect(link).toHaveAttribute('href', '/cases/case-1/
|
|
151
|
+
const link = screen.getByText('page.cases.observables').closest('a');
|
|
152
|
+
expect(link).toHaveAttribute('href', '/cases/case-1/observables');
|
|
153
153
|
});
|
|
154
154
|
it('renders a Timeline nav link pointing to the case timeline route', () => {
|
|
155
155
|
renderSidebar();
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
|
|
2
|
+
import type { FC } from 'react';
|
|
3
|
+
export type ObservableType = 'hash' | 'hosts' | 'ip' | 'user' | 'ids' | 'id' | 'uri' | 'signature';
|
|
4
|
+
export interface ObservableEntry {
|
|
5
|
+
type: ObservableType;
|
|
6
|
+
value: string;
|
|
7
|
+
/** IDs of the hits/events this observable was seen in */
|
|
8
|
+
seenIn: string[];
|
|
9
|
+
}
|
|
10
|
+
declare const Observable: FC<{
|
|
11
|
+
asset: ObservableEntry;
|
|
12
|
+
case: Case;
|
|
13
|
+
}>;
|
|
14
|
+
export default Observable;
|
|
@@ -2,11 +2,11 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
|
|
|
2
2
|
import { Card, CardContent, Chip, Stack, Typography } from '@mui/material';
|
|
3
3
|
import { useTranslation } from 'react-i18next';
|
|
4
4
|
import { Link } from 'react-router-dom';
|
|
5
|
-
const
|
|
5
|
+
const Observable = ({ asset, case: _case }) => {
|
|
6
6
|
const { t } = useTranslation();
|
|
7
|
-
return (_jsx(Card, { sx: { height: '100%' }, children: _jsx(CardContent, { children: _jsxs(Stack, { spacing: 1, children: [_jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, children: [_jsx(Chip, { size: "small", label: t(`page.cases.
|
|
7
|
+
return (_jsx(Card, { sx: { height: '100%' }, children: _jsx(CardContent, { children: _jsxs(Stack, { spacing: 1, children: [_jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, children: [_jsx(Chip, { size: "small", label: t(`page.cases.observables.type.${asset.type}`), color: "primary", variant: "outlined" }), _jsx(Typography, { variant: "body2", sx: { wordBreak: 'break-all', fontFamily: 'monospace' }, children: asset.value })] }), asset.seenIn.length > 0 && (_jsxs(Stack, { spacing: 0.5, children: [_jsx(Typography, { variant: "caption", color: "text.secondary", children: t('page.cases.observables.seen_in') }), _jsx(Stack, { direction: "row", flexWrap: "wrap", gap: 0.5, children: asset.seenIn.map(id => {
|
|
8
8
|
const entry = _case.items.find(item => item.value === id);
|
|
9
9
|
return (_jsx(Chip, { clickable: true, size: "small", label: entry.path, variant: "outlined", component: Link, to: `/cases/${_case.case_id}/${entry.path}` }, id));
|
|
10
10
|
}) })] }))] }) }) }));
|
|
11
11
|
};
|
|
12
|
-
export default
|
|
12
|
+
export default Observable;
|
package/components/routes/cases/detail/{assets/Asset.test.js → observables/Observable.test.js}
RENAMED
|
@@ -4,46 +4,46 @@ import { render, screen } from '@testing-library/react';
|
|
|
4
4
|
import { MemoryRouter } from 'react-router-dom';
|
|
5
5
|
import { createMockCase } from '@cccsaurora/howler-ui/tests/utils';
|
|
6
6
|
import { describe, expect, it } from 'vitest';
|
|
7
|
-
import
|
|
8
|
-
const
|
|
7
|
+
import Observable, {} from './Observable';
|
|
8
|
+
const makeObservable = (overrides = {}) => ({
|
|
9
9
|
type: 'ip',
|
|
10
10
|
value: '192.168.1.1',
|
|
11
11
|
seenIn: [],
|
|
12
12
|
...overrides
|
|
13
13
|
});
|
|
14
|
-
describe('
|
|
14
|
+
describe('Observable', () => {
|
|
15
15
|
describe('type chip', () => {
|
|
16
16
|
it('renders the correct label for each type', () => {
|
|
17
17
|
const cases = ['hash', 'hosts', 'ip', 'user', 'ids', 'id', 'uri', 'signature'];
|
|
18
18
|
for (const type of cases) {
|
|
19
|
-
const { unmount } = render(_jsx(MemoryRouter, { children: _jsx(
|
|
20
|
-
expect(screen.getByText(`page.cases.
|
|
19
|
+
const { unmount } = render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ type, value: 'x' }), case: createMockCase() }) }));
|
|
20
|
+
expect(screen.getByText(`page.cases.observables.type.${type}`)).toBeTruthy();
|
|
21
21
|
unmount();
|
|
22
22
|
}
|
|
23
23
|
});
|
|
24
24
|
});
|
|
25
25
|
describe('value display', () => {
|
|
26
26
|
it('renders the asset value', () => {
|
|
27
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
27
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ value: '10.0.0.1' }), case: createMockCase() }) }));
|
|
28
28
|
expect(screen.getByText('10.0.0.1')).toBeTruthy();
|
|
29
29
|
});
|
|
30
30
|
it('renders long hash values without truncation', () => {
|
|
31
31
|
const hash = 'a'.repeat(64);
|
|
32
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
32
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ type: 'hash', value: hash }), case: createMockCase() }) }));
|
|
33
33
|
expect(screen.getByText(hash)).toBeTruthy();
|
|
34
34
|
});
|
|
35
35
|
});
|
|
36
36
|
describe('seen-in chips', () => {
|
|
37
37
|
it('renders nothing when seenIn is empty', () => {
|
|
38
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
39
|
-
expect(screen.queryByText('page.cases.
|
|
38
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ seenIn: [] }), case: createMockCase() }) }));
|
|
39
|
+
expect(screen.queryByText('page.cases.observables.seen_in')).toBeNull();
|
|
40
40
|
});
|
|
41
41
|
it('renders "Seen in" label when seenIn has entries', () => {
|
|
42
42
|
const _case = createMockCase({
|
|
43
43
|
items: [{ path: 'alerts/test-analytic (hit-001)', type: 'hit', value: 'hit-001' }]
|
|
44
44
|
});
|
|
45
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
46
|
-
expect(screen.getByText('page.cases.
|
|
45
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ seenIn: ['hit-001'] }), case: _case }) }));
|
|
46
|
+
expect(screen.getByText('page.cases.observables.seen_in')).toBeTruthy();
|
|
47
47
|
});
|
|
48
48
|
it('renders a chip labelled with entry.path for each seenIn id', () => {
|
|
49
49
|
const _case = createMockCase({
|
|
@@ -53,7 +53,7 @@ describe('Asset', () => {
|
|
|
53
53
|
{ path: 'alerts/other-analytic (hit-003)', type: 'hit', value: 'hit-003' }
|
|
54
54
|
]
|
|
55
55
|
});
|
|
56
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
56
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ seenIn: ['hit-001', 'obs-002', 'hit-003'] }), case: _case }) }));
|
|
57
57
|
expect(screen.getByText('alerts/my-analytic (hit-001)')).toBeTruthy();
|
|
58
58
|
expect(screen.getByText('events/obs-002')).toBeTruthy();
|
|
59
59
|
expect(screen.getByText('alerts/other-analytic (hit-003)')).toBeTruthy();
|
|
@@ -63,7 +63,7 @@ describe('Asset', () => {
|
|
|
63
63
|
case_id: 'case-abc',
|
|
64
64
|
items: [{ path: 'alerts/my-analytic (hit-001)', type: 'hit', value: 'hit-001' }]
|
|
65
65
|
});
|
|
66
|
-
render(_jsx(MemoryRouter, { children: _jsx(
|
|
66
|
+
render(_jsx(MemoryRouter, { children: _jsx(Observable, { asset: makeObservable({ seenIn: ['hit-001'] }), case: _case }) }));
|
|
67
67
|
const link = screen.getByText('alerts/my-analytic (hit-001)').closest('a');
|
|
68
68
|
expect(link).not.toBeNull();
|
|
69
69
|
expect(link?.getAttribute('href')).toBe('/cases/case-abc/alerts/my-analytic (hit-001)');
|
|
@@ -390,18 +390,18 @@
|
|
|
390
390
|
"page.403.title": "403: Access Forbidden",
|
|
391
391
|
"page.404.description": "The page you are looking for cannot be found...",
|
|
392
392
|
"page.404.title": "404: Not found",
|
|
393
|
-
"page.cases.
|
|
394
|
-
"page.cases.
|
|
395
|
-
"page.cases.
|
|
396
|
-
"page.cases.
|
|
397
|
-
"page.cases.
|
|
398
|
-
"page.cases.
|
|
399
|
-
"page.cases.
|
|
400
|
-
"page.cases.
|
|
401
|
-
"page.cases.
|
|
402
|
-
"page.cases.
|
|
403
|
-
"page.cases.
|
|
404
|
-
"page.cases.
|
|
393
|
+
"page.cases.observables": "Observables",
|
|
394
|
+
"page.cases.observables.empty": "No observables found.",
|
|
395
|
+
"page.cases.observables.filter_by_type": "Filter by type:",
|
|
396
|
+
"page.cases.observables.seen_in": "Seen in",
|
|
397
|
+
"page.cases.observables.type.hash": "Hash",
|
|
398
|
+
"page.cases.observables.type.hosts": "Host",
|
|
399
|
+
"page.cases.observables.type.id": "ID",
|
|
400
|
+
"page.cases.observables.type.ids": "ID",
|
|
401
|
+
"page.cases.observables.type.ip": "IP",
|
|
402
|
+
"page.cases.observables.type.signature": "Signature",
|
|
403
|
+
"page.cases.observables.type.uri": "URI",
|
|
404
|
+
"page.cases.observables.type.user": "User",
|
|
405
405
|
"page.cases.created": "Created",
|
|
406
406
|
"page.cases.dashboard": "Dashboard",
|
|
407
407
|
"page.cases.dashboard.alerts": "Alerts",
|
|
@@ -390,18 +390,18 @@
|
|
|
390
390
|
"page.403.title": "403: Accès interdit",
|
|
391
391
|
"page.404.description": "La page que vous recherchez est introuvable ...",
|
|
392
392
|
"page.404.title": "404: Introuvable",
|
|
393
|
-
"page.cases.
|
|
394
|
-
"page.cases.
|
|
395
|
-
"page.cases.
|
|
396
|
-
"page.cases.
|
|
397
|
-
"page.cases.
|
|
398
|
-
"page.cases.
|
|
399
|
-
"page.cases.
|
|
400
|
-
"page.cases.
|
|
401
|
-
"page.cases.
|
|
402
|
-
"page.cases.
|
|
403
|
-
"page.cases.
|
|
404
|
-
"page.cases.
|
|
393
|
+
"page.cases.observables": "Observables",
|
|
394
|
+
"page.cases.observables.empty": "Aucun observable trouvé.",
|
|
395
|
+
"page.cases.observables.filter_by_type": "Filtrer par type :",
|
|
396
|
+
"page.cases.observables.seen_in": "Vu dans",
|
|
397
|
+
"page.cases.observables.type.hash": "Hachage",
|
|
398
|
+
"page.cases.observables.type.hosts": "Hôte",
|
|
399
|
+
"page.cases.observables.type.id": "Identifiant",
|
|
400
|
+
"page.cases.observables.type.ids": "Identifiant",
|
|
401
|
+
"page.cases.observables.type.ip": "IP",
|
|
402
|
+
"page.cases.observables.type.signature": "Signature",
|
|
403
|
+
"page.cases.observables.type.uri": "URI",
|
|
404
|
+
"page.cases.observables.type.user": "Utilisateur",
|
|
405
405
|
"page.cases.created": "Créé",
|
|
406
406
|
"page.cases.dashboard": "Tableau de bord",
|
|
407
407
|
"page.cases.dashboard.alerts": "Alertes",
|
package/package.json
CHANGED
|
@@ -96,7 +96,7 @@
|
|
|
96
96
|
"internal-slot": "1.0.7"
|
|
97
97
|
},
|
|
98
98
|
"type": "module",
|
|
99
|
-
"version": "2.19.0-cases.
|
|
99
|
+
"version": "2.19.0-cases.1111",
|
|
100
100
|
"exports": {
|
|
101
101
|
"./i18n": "./i18n.js",
|
|
102
102
|
"./index.css": "./index.css",
|
|
@@ -212,7 +212,7 @@
|
|
|
212
212
|
"./components/routes/cases/detail/*": "./components/routes/cases/detail/*.js",
|
|
213
213
|
"./components/routes/cases/detail/aggregates/*": "./components/routes/cases/detail/aggregates/*.js",
|
|
214
214
|
"./components/routes/cases/detail/sidebar/*": "./components/routes/cases/detail/sidebar/*.js",
|
|
215
|
-
"./components/routes/cases/detail/
|
|
215
|
+
"./components/routes/cases/detail/observables/*": "./components/routes/cases/detail/observables/*.js",
|
|
216
216
|
"./components/app/providers/*": "./components/app/providers/*.js",
|
|
217
217
|
"./components/app/drawers/*": "./components/app/drawers/*.js",
|
|
218
218
|
"./components/app/hooks/*": "./components/app/hooks/*.js",
|
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
|
|
2
|
-
import type { FC } from 'react';
|
|
3
|
-
export type AssetType = 'hash' | 'hosts' | 'ip' | 'user' | 'ids' | 'id' | 'uri' | 'signature';
|
|
4
|
-
export interface AssetEntry {
|
|
5
|
-
type: AssetType;
|
|
6
|
-
value: string;
|
|
7
|
-
/** IDs of the hits/events this asset was seen in */
|
|
8
|
-
seenIn: string[];
|
|
9
|
-
}
|
|
10
|
-
declare const Asset: FC<{
|
|
11
|
-
asset: AssetEntry;
|
|
12
|
-
case: Case;
|
|
13
|
-
}>;
|
|
14
|
-
export default Asset;
|
|
File without changes
|
/package/components/routes/cases/detail/{assets/Asset.test.d.ts → observables/Observable.test.d.ts}
RENAMED
|
File without changes
|