howler-sentinel-plugin 0.2.0.dev504__tar.gz → 0.2.0.dev519__tar.gz

{howler_sentinel_plugin-0.2.0.dev504 → howler_sentinel_plugin-0.2.0.dev519}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev504
+Version: 0.2.0.dev519
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 License-File: LICENSE

{howler_sentinel_plugin-0.2.0.dev504 → howler_sentinel_plugin-0.2.0.dev519}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "howler-sentinel-plugin"
-version = "0.2.0.dev504"
+version = "0.2.0.dev519"
 description = "A howler plugin for integration with Microsoft's Sentinel API"
 authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
 license = { text = "MIT" }

{howler_sentinel_plugin-0.2.0.dev504 → howler_sentinel_plugin-0.2.0.dev519}/sentinel/routes/ingest.py

@@ -253,17 +253,15 @@ def _create_new_incident(
             )
 
             case_service.append_case_item(
-                case.case_id,
+                case,
                 item_type="hit",
                 item_value=bundle_odm.howler.id,
                 item_name=analytic,
             )
 
-            # Re-fetch the case to get the latest saved state, then create the
-            # "hits" folder so children can be nested inside it.
-            case = datastore().case.get(case.case_id) or case
+            # Create the "hits" folder before adding children beneath it.
             hits_folder = case_service.get_parent_from_path(case, "hits", create_if_missing=True)
-            datastore().case.save(case.case_id, case)
+            case.save()
 
             for child_id in child_hit_ids:
                 child_hit = hit_service.get_hit(child_id, as_odm=True)
@@ -271,7 +269,7 @@ def _create_new_incident(
                     child_name = f"{child_hit.howler.analytic} ({child_id})"
                     try:
                         case_service.append_case_item(
-                            case.case_id,
+                            case,
                             item_type="hit",
                             item_value=child_id,
                             item_parent=hits_folder.id if hits_folder else None,
@@ -280,6 +278,7 @@ def _create_new_incident(
                     except Exception:
                         logger.exception("Failed to add child hit %s to case", child_id)
 
+            case.save()
             datastore().case.commit()
 
         datastore().hit.commit()