19 package org.sleuthkit.autopsy.modules.stix;
21 import java.util.Arrays;
22 import java.util.Collection;
23 import java.util.logging.Level;
24 import org.apache.commons.lang3.StringUtils;
25 import org.openide.util.NbBundle.Messages;
33 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT;
35 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY;
36 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
37 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE;
44 class StixArtifactData {
46 private static final String MODULE_NAME =
"Stix";
48 private AbstractFile file;
49 private final String observableId;
50 private final String objType;
51 private static final Logger logger = Logger.getLogger(StixArtifactData.class.getName());
53 StixArtifactData(AbstractFile a_file, String a_observableId, String a_objType) {
55 observableId = a_observableId;
59 StixArtifactData(
long a_objId, String a_observableId, String a_objType) {
61 Case case1 = Case.getCurrentCaseThrows();
62 SleuthkitCase sleuthkitCase = case1.getSleuthkitCase();
63 file = sleuthkitCase.getAbstractFileById(a_objId);
64 }
catch (TskCoreException | NoCurrentCaseException ex) {
67 observableId = a_observableId;
71 @Messages({
"StixArtifactData.indexError.message=Failed to index STIX interesting file hit artifact for keyword search.",
72 "StixArtifactData.noOpenCase.errMsg=No open case available."})
73 void createArtifact(String a_title)
throws TskCoreException {
74 Blackboard blackboard;
76 blackboard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
77 }
catch (NoCurrentCaseException ex) {
78 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
79 MessageNotifyUtil.Notify.error(Bundle.StixArtifactData_noOpenCase_errMsg(), ex.getLocalizedMessage());
83 String setName =
"STIX Indicator - " + StringUtils.defaultIfBlank(a_title,
"(no title)");
85 Collection<BlackboardAttribute> attributes = Arrays.asList(
86 new BlackboardAttribute(TSK_SET_NAME, MODULE_NAME, setName),
87 new BlackboardAttribute(TSK_TITLE, MODULE_NAME, observableId),
88 new BlackboardAttribute(TSK_CATEGORY, MODULE_NAME, objType));
91 if (!blackboard.artifactExists(file, TSK_INTERESTING_FILE_HIT, attributes)) {
92 BlackboardArtifact bba = file.newArtifact(TSK_INTERESTING_FILE_HIT);
93 bba.addAttributes(attributes);
100 blackboard.postArtifact(bba, MODULE_NAME);
101 }
catch (Blackboard.BlackboardException ex) {
102 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bba.getArtifactID(), ex);
103 MessageNotifyUtil.Notify.error(Bundle.StixArtifactData_indexError_message(), bba.getDisplayName());