19 package org.sleuthkit.autopsy.centralrepository.eventlisteners;
21 import com.google.common.util.concurrent.ThreadFactoryBuilder;
22 import java.beans.PropertyChangeEvent;
23 import java.beans.PropertyChangeListener;
24 import java.util.List;
25 import java.util.concurrent.ExecutorService;
26 import java.util.concurrent.Executors;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import org.apache.commons.lang.StringUtils;
30 import org.openide.util.NbBundle.Messages;
62 @Messages({
"caseeventlistener.evidencetag=Evidence"})
63 final class CaseEventListener implements PropertyChangeListener {
66 private final ExecutorService jobProcessingExecutor;
67 private static final String CASE_EVENT_THREAD_NAME =
"Case-Event-Listener-%d";
70 jobProcessingExecutor = Executors.newSingleThreadExecutor(
new ThreadFactoryBuilder().setNameFormat(CASE_EVENT_THREAD_NAME).build());
78 public void propertyChange(PropertyChangeEvent evt) {
83 LOGGER.log(Level.SEVERE,
"Failed to get instance of db manager.", ex);
86 switch (
Case.
Events.valueOf(evt.getPropertyName())) {
87 case CONTENT_TAG_ADDED:
88 case CONTENT_TAG_DELETED: {
89 jobProcessingExecutor.submit(
new ContentTagTask(dbManager, evt));
93 case BLACKBOARD_ARTIFACT_TAG_DELETED:
94 case BLACKBOARD_ARTIFACT_TAG_ADDED: {
95 jobProcessingExecutor.submit(
new BlackboardTagTask(dbManager, evt));
99 case DATA_SOURCE_ADDED: {
100 jobProcessingExecutor.submit(
new DataSourceAddedTask(dbManager, evt));
103 case TAG_DEFINITION_CHANGED: {
104 jobProcessingExecutor.submit(
new TagDefinitionChangeTask(evt));
108 jobProcessingExecutor.submit(
new CurrentCaseTask(dbManager, evt));
111 case DATA_SOURCE_NAME_CHANGED: {
112 jobProcessingExecutor.submit(
new DataSourceNameChangedTask(dbManager, evt));
121 private final PropertyChangeEvent
event;
135 TskData.FileKnown knownStatus;
141 final ContentTag tagAdded = tagAddedEvent.getAddedTag();
144 if (tagAdded.getContent() instanceof AbstractFile) {
145 af = (AbstractFile) tagAdded.getContent();
146 knownStatus = TskData.FileKnown.BAD;
147 comment = tagAdded.getComment();
149 LOGGER.log(Level.WARNING,
"Error updating non-file object");
176 .map(tag -> tag.getName().getDisplayName())
178 .collect(Collectors.toList())
182 if (content instanceof AbstractFile) {
183 af = (AbstractFile) content;
184 knownStatus = TskData.FileKnown.UNKNOWN;
187 LOGGER.log(Level.WARNING,
"Error updating non-file object");
195 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
202 if (eamArtifact != null) {
207 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
216 private final PropertyChangeEvent
event;
230 BlackboardArtifact bbArtifact;
231 TskData.FileKnown knownStatus;
237 final BlackboardArtifactTag tagAdded = tagAddedEvent.getAddedTag();
240 content = tagAdded.getContent();
241 bbArtifact = tagAdded.getArtifact();
242 knownStatus = TskData.FileKnown.BAD;
243 comment = tagAdded.getComment();
253 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
277 .map(tag -> tag.getName().getDisplayName())
279 .collect(Collectors.toList())
283 knownStatus = TskData.FileKnown.UNKNOWN;
290 }
catch (TskCoreException ex) {
291 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
296 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
302 eamArtifact.setComment(comment);
306 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
315 private final PropertyChangeEvent
event;
327 String modifiedTagName = (String) event.getOldValue();
338 for (BlackboardArtifactTag bbTag : artifactTags) {
340 boolean hasTagWithConflictingKnownStatus =
false;
344 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
345 Content content = bbTag.getContent();
348 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
352 BlackboardArtifact bbArtifact = bbTag.getArtifact();
356 for (BlackboardArtifactTag t : tags) {
358 if (t.getName().equals(tagName)) {
362 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
364 hasTagWithConflictingKnownStatus =
true;
370 if (!hasTagWithConflictingKnownStatus) {
383 for (ContentTag contentTag : fileTags) {
385 boolean hasTagWithConflictingKnownStatus =
false;
389 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
390 Content content = contentTag.getContent();
394 for (ContentTag t : tags) {
396 if (t.getName().equals(tagName)) {
400 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
402 hasTagWithConflictingKnownStatus =
true;
408 if (!hasTagWithConflictingKnownStatus) {
410 if (eamArtifact != null) {
415 }
catch (TskCoreException ex) {
416 LOGGER.log(Level.SEVERE,
"Cannot update known status in central repository for tag: " + modifiedTagName, ex);
418 LOGGER.log(Level.SEVERE,
"Cannot get central repository for tag: " + modifiedTagName, ex);
420 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
428 private final PropertyChangeEvent
event;
444 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
449 Content newDataSource = dataSourceAddedEvent.
getDataSource();
453 if (null == dbManager.
getDataSource(correlationCase, newDataSource.getId())) {
457 LOGGER.log(Level.SEVERE,
"Error adding new data source to the central repository", ex);
465 private final PropertyChangeEvent
event;
478 if ((null == event.getOldValue()) && (event.getNewValue() instanceof
Case)) {
479 Case curCase = (
Case) event.getNewValue();
489 if (dbManager.
getCase(curCase) == null) {
493 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
502 private final PropertyChangeEvent
event;
513 Content dataSource = dataSourceNameChangedEvent.
getDataSource();
514 String newName = (String) event.getNewValue();
516 if (! StringUtils.isEmpty(newName)) {
527 LOGGER.log(Level.SEVERE,
"Error updating data source with ID " + dataSource.getId() +
" to " + newName, ex);
529 LOGGER.log(Level.SEVERE,
"No open case", ex);
final PropertyChangeEvent event
static List< CorrelationAttributeInstance > makeInstancesFromBlackboardArtifact(BlackboardArtifact artifact, boolean checkEnabled)
final PropertyChangeEvent event
DataSourceAddedTask(EamDb db, PropertyChangeEvent evt)
CorrelationCase newCase(CorrelationCase eamCase)
DeletedBlackboardArtifactTagInfo getDeletedTagInfo()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
DataSourceNameChangedTask(EamDb db, PropertyChangeEvent evt)
TskData.FileKnown getKnownStatus()
TagDefinitionChangeTask(PropertyChangeEvent evt)
static void shutDownTaskExecutor(ExecutorService executor)
ContentTagTask(EamDb db, PropertyChangeEvent evt)
TagsManager getTagsManager()
static EamDb getInstance()
CorrelationDataSource getDataSource(CorrelationCase correlationCase, Long caseDbDataSourceId)
void setAttributeInstanceKnownStatus(CorrelationAttributeInstance eamArtifact, TskData.FileKnown knownStatus)
CurrentCaseTask(EamDb db, PropertyChangeEvent evt)
static boolean isEnabled()
SleuthkitCase getSleuthkitCase()
static CorrelationAttributeInstance makeInstanceFromContent(Content content)
BLACKBOARD_ARTIFACT_TAG_ADDED
CorrelationCase getCase(Case autopsyCase)
BlackboardTagTask(EamDb db, PropertyChangeEvent evt)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
final PropertyChangeEvent event
final PropertyChangeEvent event
DeletedContentTagInfo getDeletedTagInfo()
final PropertyChangeEvent event
void updateDataSourceName(CorrelationDataSource eamDataSource, String newName)
final PropertyChangeEvent event