assemblyline-core 4.4.0.27__tar.gz → 4.4.0.29__tar.gz

{assemblyline-core-4.4.0.27 → assemblyline-core-4.4.0.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline-core
-Version: 4.4.0.27
+Version: 4.4.0.29
 Summary: Assemblyline 4 - Core components
 Home-page: https://github.com/CybercentreCanada/assemblyline-core/
 Author: CCCS Assemblyline development team

assemblyline-core-4.4.0.29/assemblyline_core/VERSION

@@ -0,0 +1 @@
+4.4.0.29

{assemblyline-core-4.4.0.27 → assemblyline-core-4.4.0.29}/assemblyline_core/workflow/run_workflow.py

@@ -9,6 +9,7 @@ from assemblyline.common.isotime import now_as_iso
 from assemblyline.common.str_utils import safe_str
 
 from assemblyline.datastore.exceptions import SearchException
+from assemblyline.odm.models.alert import Event
 from assemblyline.odm.models.workflow import Workflow
 
 
@@ -126,6 +127,7 @@ class WorkflowManager(ServerBase):
 
                     fq = ["reporting_ts:[{start_ts} TO {end_ts}]".format(start_ts=self.start_ts, end_ts=end_ts)]
 
+                    event_data = Event({'entity_type': 'workflow', 'entity_id': workflow.workflow_id, 'entity_name': workflow.name})
                     operations = []
                     fq_items = []
                     if labels:
@@ -133,14 +135,19 @@ class WorkflowManager(ServerBase):
                                            for lbl in labels])
                         for label in labels:
                             fq_items.append("label:\"{label}\"".format(label=label))
+                        event_data.labels = labels
                     if priority:
                         operations.append((self.datastore.alert.UPDATE_SET, 'priority', priority))
                         fq_items.append("priority:*")
+                        event_data.priority = priority
                     if status:
                         operations.append((self.datastore.alert.UPDATE_SET, 'status', status))
                         fq_items.append("(status:MALICIOUS OR status:NON-MALICIOUS OR status:ASSESS)")
+                        event_data.status = status
 
                     fq.append("NOT ({exclusion})".format(exclusion=" AND ".join(fq_items)))
+                    # Add event to alert's audit history
+                    operations.append((self.datastore.alert.UPDATE_APPEND, 'events', event_data))
 
                     try:
                         count = self.datastore.alert.update_by_query(workflow.query, operations, filters=fq)
@@ -150,11 +157,15 @@ class WorkflowManager(ServerBase):
                         if count:
                             self.log.info("{count} Alert(s) were affected by this filter.".format(count=count))
                             if workflow.workflow_id != "DEFAULT":
+                                seen = now_as_iso()
                                 operations = [
-                                    (self.datastore.alert.UPDATE_INC, 'hit_count', count),
-                                    (self.datastore.alert.UPDATE_SET, 'last_seen', now_as_iso()),
+                                    (self.datastore.workflow.UPDATE_INC, 'hit_count', count),
+                                    (self.datastore.workflow.UPDATE_SET, 'last_seen', seen),
                                 ]
-                                self.datastore.workflow.update(workflow.id, operations)
+                                if not workflow.first_seen:
+                                    # Set first seen for workflow if not set
+                                    operations.append((self.datastore.workflow.UPDATE_SET, 'first_seen', seen))
+                                self.datastore.workflow.update(workflow.workflow_id, operations)
 
                     except SearchException:
                         self.log.warning(f"Invalid query '{safe_str(workflow.query or '')}' in workflow "

{assemblyline-core-4.4.0.27 → assemblyline-core-4.4.0.29}/assemblyline_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline-core
-Version: 4.4.0.27
+Version: 4.4.0.29
 Summary: Assemblyline 4 - Core components
 Home-page: https://github.com/CybercentreCanada/assemblyline-core/
 Author: CCCS Assemblyline development team

assemblyline-core-4.4.0.27/assemblyline_core/VERSION

@@ -1 +0,0 @@
-4.4.0.27