@cccsaurora/howler-ui 2.19.0-cases.1122 → 2.19.0-cases.1131

package/components/routes/cases/detail/utils.test.js

@@ -0,0 +1,144 @@
+import { createMockCase, createMockEvent, createMockHit } from '@cccsaurora/howler-ui/tests/utils';
+import { describe, expect, it } from 'vitest';
+import { buildObservableEntries, classifyRole } from './utils';
+// ---------------------------------------------------------------------------
+// Pure logic tests — no React needed
+// ---------------------------------------------------------------------------
+describe('buildObservableEntries', () => {
+    it('returns an empty array for records with no related field', () => {
+        expect(buildObservableEntries([createMockHit({ howler: { id: 'h1' } })])).toEqual([]);
+    });
+    it('extracts a single IP from a hit', () => {
+        const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } })]);
+        expect(result).toHaveLength(1);
+        expect(result[0]).toEqual({ type: 'ip', value: '1.2.3.4', seenIn: ['h1'] });
+    });
+    it('extracts multiple fields from a single record', () => {
+        const result = buildObservableEntries([
+            createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'], user: ['alice'] } })
+        ]);
+        const types = result.map(a => a.type).sort();
+        expect(types).toEqual(['ip', 'user']);
+    });
+    it('deduplicates the same observable value across multiple records', () => {
+        const result = buildObservableEntries([
+            createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
+            createMockEvent({ howler: { id: 'obs1' }, related: { ip: ['1.2.3.4'] } })
+        ]);
+        expect(result).toHaveLength(1);
+        expect(result[0].seenIn).toEqual(['h1', 'obs1']);
+    });
+    it('keeps distinct observable values as separate entries', () => {
+        const result = buildObservableEntries([
+            createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
+            createMockHit({ howler: { id: 'h2' }, related: { ip: ['5.6.7.8'] } })
+        ]);
+        expect(result).toHaveLength(2);
+    });
+    it('does not duplicate seenIn ids when the same record appears twice for the same observable', () => {
+        const result = buildObservableEntries([
+            createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } }),
+            createMockHit({ howler: { id: 'h1' }, related: { ip: ['1.2.3.4'] } })
+        ]);
+        expect(result[0].seenIn).toEqual(['h1']);
+    });
+    it('skips records with no howler.id', () => {
+        const noId = { related: { ip: ['1.2.3.4'] } };
+        expect(buildObservableEntries([noId])).toEqual([]);
+    });
+    it('handles the scalar `id` field on Related', () => {
+        const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related: { id: 'some-id' } })]);
+        expect(result).toHaveLength(1);
+        expect(result[0]).toEqual({ type: 'id', value: 'some-id', seenIn: ['h1'] });
+    });
+    it('handles array fields like hash, hosts, user, ids, uri, signature', () => {
+        const related = {
+            hash: ['abc123'],
+            hosts: ['host.example.com'],
+            user: ['bob'],
+            ids: ['guid-1'],
+            uri: ['https://example.com'],
+            signature: ['rule-X']
+        };
+        const result = buildObservableEntries([createMockHit({ howler: { id: 'h1' }, related })]);
+        const types = result.map(a => a.type).sort();
+        expect(types).toEqual(['hash', 'hosts', 'ids', 'signature', 'uri', 'user']);
+    });
+});
+// ---------------------------------------------------------------------------
+// classifyRole tests
+// ---------------------------------------------------------------------------
+describe('classifyRole', () => {
+    const emptyCase = createMockCase();
+    it('returns "threat" when value is in case.threats', () => {
+        const _case = createMockCase({ threats: ['malicious.exe'] });
+        const records = [createMockHit({ howler: { id: 'h1' } })];
+        expect(classifyRole('malicious.exe', _case, records)).toBe('threat');
+    });
+    it('returns "target" when value is in case.targets', () => {
+        const _case = createMockCase({ targets: ['server-01'] });
+        const records = [createMockHit({ howler: { id: 'h1' } })];
+        expect(classifyRole('server-01', _case, records)).toBe('target');
+    });
+    it('returns "indicator" when value is in case.indicators', () => {
+        const _case = createMockCase({ indicators: ['1.2.3.4'] });
+        const records = [createMockHit({ howler: { id: 'h1' } })];
+        expect(classifyRole('1.2.3.4', _case, records)).toBe('indicator');
+    });
+    it('returns "threat" when value matches howler.outline.threat', () => {
+        const records = [createMockHit({ howler: { id: 'h1', outline: { threat: 'malicious.exe' } } })];
+        expect(classifyRole('malicious.exe', emptyCase, records)).toBe('threat');
+    });
+    it('returns "threat" with case-insensitive matching', () => {
+        const records = [createMockHit({ howler: { id: 'h1', outline: { threat: 'Malicious.EXE' } } })];
+        expect(classifyRole('malicious.exe', emptyCase, records)).toBe('threat');
+    });
+    it('does not match threat by substring — only exact match', () => {
+        const records = [createMockHit({ howler: { id: 'h1', outline: { threat: 'evil.com dropped payload' } } })];
+        // No substring match, defaults to indicator
+        expect(classifyRole('evil.com', emptyCase, records)).toBe('indicator');
+    });
+    it('classifies as indicator when value is in outline.indicators but not in threat/target', () => {
+        const records = [
+            createMockHit({
+                howler: { id: 'h1', outline: { threat: 'actor-x', target: 'server-01', indicators: ['1.2.3.4'] } }
+            })
+        ];
+        expect(classifyRole('1.2.3.4', emptyCase, records)).toBe('indicator');
+    });
+    it('returns "target" when value matches howler.outline.target', () => {
+        const records = [createMockHit({ howler: { id: 'h1', outline: { target: 'server-01' } } })];
+        expect(classifyRole('server-01', emptyCase, records)).toBe('target');
+    });
+    it('returns "indicator" when value matches threat.indicator.ip', () => {
+        const records = [
+            createMockHit({
+                howler: { id: 'h1' },
+                threat: { indicator: { ip: '10.0.0.1' } }
+            })
+        ];
+        expect(classifyRole('10.0.0.1', emptyCase, records)).toBe('indicator');
+    });
+    it('returns "indicator" when value matches threat.indicator.description', () => {
+        const records = [
+            createMockHit({
+                howler: { id: 'h1' },
+                threat: { indicator: { description: 'suspicious-hash-abc123' } }
+            })
+        ];
+        expect(classifyRole('suspicious-hash-abc123', emptyCase, records)).toBe('indicator');
+    });
+    it('defaults to "indicator" when value has no specific classification', () => {
+        const records = [createMockHit({ howler: { id: 'h1' }, related: { ip: ['5.6.7.8'] } })];
+        expect(classifyRole('5.6.7.8', emptyCase, records)).toBe('indicator');
+    });
+    it('case-level threats take priority over per-record outline.target', () => {
+        const _case = createMockCase({ threats: ['dual-use.exe'] });
+        const records = [createMockHit({ howler: { id: 'h1', outline: { target: 'dual-use.exe' } } })];
+        expect(classifyRole('dual-use.exe', _case, records)).toBe('threat');
+    });
+    it('trims whitespace before comparing', () => {
+        const records = [createMockHit({ howler: { id: 'h1', outline: { threat: '  evil.com  ' } } })];
+        expect(classifyRole('evil.com', emptyCase, records)).toBe('threat');
+    });
+});

package/locales/en/translation.json

@@ -391,18 +391,6 @@
     "page.403.title": "403: Access Forbidden",
     "page.404.description": "The page you are looking for cannot be found...",
     "page.404.title": "404: Not found",
-    "page.cases.observables": "Observables",
-    "page.cases.observables.empty": "No observables found.",
-    "page.cases.observables.filter_by_type": "Filter by type:",
-    "page.cases.observables.seen_in": "Seen in",
-    "page.cases.observables.type.hash": "Hash",
-    "page.cases.observables.type.hosts": "Host",
-    "page.cases.observables.type.id": "ID",
-    "page.cases.observables.type.ids": "ID",
-    "page.cases.observables.type.ip": "IP",
-    "page.cases.observables.type.signature": "Signature",
-    "page.cases.observables.type.uri": "URI",
-    "page.cases.observables.type.user": "User",
     "page.cases.created": "Created",
     "page.cases.dashboard": "Dashboard",
     "page.cases.dashboard.alerts": "Alerts",
@@ -418,13 +406,40 @@
     "page.cases.dashboard.tasks.hide_child": "Hide child case tasks",
     "page.cases.dashboard.tasks.show_child": "Show child case tasks",
     "page.cases.dashboard.threat": "Threats",
+    "page.cases.detail.escalation": "Escalation",
     "page.cases.detail.participants": "Participants",
     "page.cases.detail.properties": "Properties",
     "page.cases.detail.status": "Status",
-    "page.cases.detail.escalation": "Escalation",
     "page.cases.detail.viewers": "Active Viewers",
     "page.cases.escalation": "Escalation",
     "page.cases.folder.drop.root": "Place here to move to root",
+    "page.cases.observables": "Observables",
+    "page.cases.observables.columns.escalation": "Escalation",
+    "page.cases.observables.columns.role": "Role",
+    "page.cases.observables.columns.seen_in": "Seen In",
+    "page.cases.observables.columns.sources": "Sources",
+    "page.cases.observables.columns.type": "Type",
+    "page.cases.observables.columns.value": "Value",
+    "page.cases.observables.empty": "No observables found.",
+    "page.cases.observables.filter_by_escalation": "Escalation",
+    "page.cases.observables.filter_by_origin": "Origin",
+    "page.cases.observables.filter_by_role": "Role",
+    "page.cases.observables.filter_by_type": "Filter by type:",
+    "page.cases.observables.origin.event": "Event",
+    "page.cases.observables.origin.hit": "Hit",
+    "page.cases.observables.role.indicator": "Indicator",
+    "page.cases.observables.role.target": "Target",
+    "page.cases.observables.role.threat": "Threat",
+    "page.cases.observables.search": "Search observables...",
+    "page.cases.observables.seen_in": "Seen in",
+    "page.cases.observables.type.hash": "Hash",
+    "page.cases.observables.type.hosts": "Host",
+    "page.cases.observables.type.id": "ID",
+    "page.cases.observables.type.ids": "ID",
+    "page.cases.observables.type.ip": "IP",
+    "page.cases.observables.type.signature": "Signature",
+    "page.cases.observables.type.uri": "URI",
+    "page.cases.observables.type.user": "User",
     "page.cases.rules": "Rules",
     "page.cases.rules.author": "Author",
     "page.cases.rules.create": "Create Rule",
@@ -432,9 +447,14 @@
     "page.cases.rules.destination": "Alert Destination Path",
     "page.cases.rules.destination.help": "Handlebars template for the case item path (e.g. alerts/{{howler.analytic}})",
     "page.cases.rules.empty": "No correlation rules configured.",
+    "page.cases.rules.expire_after_resolved": "Start expiry after case is resolved",
+    "page.cases.rules.indexes": "Indexes",
     "page.cases.rules.no_expiry": "No expiry",
     "page.cases.rules.query": "Match Query",
     "page.cases.rules.timeframe": "Rule Expiry",
+    "page.cases.rules.timeframe.after_resolved": "{{days}} day(s) after resolved",
+    "page.cases.rules.timeframe.days": "{{days}} day(s)",
+    "page.cases.rules.timeframe.help": "Number of days before the rule expires",
     "page.cases.search": "Search",
     "page.cases.sidebar.folder.remove": "Remove folder",
     "page.cases.sidebar.item.open": "Open item",

package/locales/fr/translation.json

@@ -391,18 +391,6 @@
     "page.403.title": "403: Accès interdit",
     "page.404.description": "La page que vous recherchez est introuvable ...",
     "page.404.title": "404: Introuvable",
-    "page.cases.observables": "Observables",
-    "page.cases.observables.empty": "Aucun observable trouvé.",
-    "page.cases.observables.filter_by_type": "Filtrer par type :",
-    "page.cases.observables.seen_in": "Vu dans",
-    "page.cases.observables.type.hash": "Hachage",
-    "page.cases.observables.type.hosts": "Hôte",
-    "page.cases.observables.type.id": "Identifiant",
-    "page.cases.observables.type.ids": "Identifiant",
-    "page.cases.observables.type.ip": "IP",
-    "page.cases.observables.type.signature": "Signature",
-    "page.cases.observables.type.uri": "URI",
-    "page.cases.observables.type.user": "Utilisateur",
     "page.cases.created": "Créé",
     "page.cases.dashboard": "Tableau de bord",
     "page.cases.dashboard.alerts": "Alertes",
@@ -418,13 +406,40 @@
     "page.cases.dashboard.tasks.hide_child": "Masquer les tâches des cas enfants",
     "page.cases.dashboard.tasks.show_child": "Afficher les tâches des cas enfants",
     "page.cases.dashboard.threat": "Menaces",
+    "page.cases.detail.escalation": "Escalade",
     "page.cases.detail.participants": "Participants",
     "page.cases.detail.properties": "Propriétés",
     "page.cases.detail.status": "Statut",
-    "page.cases.detail.escalation": "Escalade",
     "page.cases.detail.viewers": "Spectateurs actifs",
     "page.cases.escalation": "Escalade",
     "page.cases.folder.drop.root": "Déposer ici pour déplacer à la racine",
+    "page.cases.observables": "Observables",
+    "page.cases.observables.columns.escalation": "Escalade",
+    "page.cases.observables.columns.role": "Rôle",
+    "page.cases.observables.columns.seen_in": "Vu dans",
+    "page.cases.observables.columns.sources": "Sources",
+    "page.cases.observables.columns.type": "Type",
+    "page.cases.observables.columns.value": "Valeur",
+    "page.cases.observables.empty": "Aucun observable trouvé.",
+    "page.cases.observables.filter_by_escalation": "Escalade",
+    "page.cases.observables.filter_by_origin": "Origine",
+    "page.cases.observables.filter_by_role": "Rôle",
+    "page.cases.observables.filter_by_type": "Filtrer par type :",
+    "page.cases.observables.origin.event": "Événement",
+    "page.cases.observables.origin.hit": "Alerte",
+    "page.cases.observables.role.indicator": "Indicateur",
+    "page.cases.observables.role.target": "Cible",
+    "page.cases.observables.role.threat": "Menace",
+    "page.cases.observables.search": "Rechercher des observables...",
+    "page.cases.observables.seen_in": "Vu dans",
+    "page.cases.observables.type.hash": "Hachage",
+    "page.cases.observables.type.hosts": "Hôte",
+    "page.cases.observables.type.id": "Identifiant",
+    "page.cases.observables.type.ids": "Identifiant",
+    "page.cases.observables.type.ip": "IP",
+    "page.cases.observables.type.signature": "Signature",
+    "page.cases.observables.type.uri": "URI",
+    "page.cases.observables.type.user": "Utilisateur",
     "page.cases.rules": "Règles",
     "page.cases.rules.author": "Auteur",
     "page.cases.rules.create": "Créer une règle",
@@ -432,9 +447,14 @@
     "page.cases.rules.destination": "Chemin de destination des alertes",
     "page.cases.rules.destination.help": "Modèle Handlebars pour le chemin de l'élément de cas (ex. alerts/{{howler.analytic}})",
     "page.cases.rules.empty": "Aucune règle de corrélation configurée.",
+    "page.cases.rules.expire_after_resolved": "Démarrer l'expiration après la résolution du cas",
+    "page.cases.rules.indexes": "Index",
     "page.cases.rules.no_expiry": "Sans expiration",
     "page.cases.rules.query": "Requête de correspondance",
     "page.cases.rules.timeframe": "Expiration de la règle",
+    "page.cases.rules.timeframe.after_resolved": "{{days}} jour(s) après résolution",
+    "page.cases.rules.timeframe.days": "{{days}} jour(s)",
+    "page.cases.rules.timeframe.help": "Nombre de jours avant l'expiration de la règle",
     "page.cases.search": "Rechercher",
     "page.cases.sidebar.folder.remove": "Supprimer le dossier",
     "page.cases.sidebar.item.open": "Ouvrir l'élément",

package/models/entities/generated/Rule.d.ts

@@ -7,6 +7,8 @@ export interface Rule {
   query?: string;
   author?: string;
   enabled?: boolean;
-  timeframe?: string;
+  created_at?: string;
+  timeframe?: number;
+  expire_after_resolved?: boolean;
   indexes?: ('hit' | 'event')[];
 }

package/package.json

@@ -96,7 +96,7 @@
     "internal-slot": "1.0.7"
   },
   "type": "module",
-  "version": "2.19.0-cases.1122",
+  "version": "2.19.0-cases.1131",
   "exports": {
     "./i18n": "./i18n.js",
     "./index.css": "./index.css",