19 package org.sleuthkit.autopsy.centralrepository.eventlisteners;
21 import com.google.common.util.concurrent.ThreadFactoryBuilder;
22 import java.beans.PropertyChangeEvent;
23 import java.beans.PropertyChangeListener;
24 import java.util.Arrays;
25 import java.util.Collection;
26 import java.util.EnumSet;
27 import java.util.List;
28 import java.util.Optional;
30 import java.util.concurrent.ExecutorService;
31 import java.util.concurrent.Executors;
32 import java.util.logging.Level;
33 import org.apache.commons.lang.StringUtils;
34 import org.openide.util.NbBundle;
35 import org.openide.util.NbBundle.Messages;
68 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT;
69 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
79 @Messages({
"caseeventlistener.evidencetag=Evidence"})
84 private static final String CASE_EVENT_THREAD_NAME =
"Case-Event-Listener-%d";
86 private static final Set<
Case.
Events> CASE_EVENTS_OF_INTEREST = EnumSet.of(
97 jobProcessingExecutor = Executors.newSingleThreadExecutor(
new ThreadFactoryBuilder().setNameFormat(CASE_EVENT_THREAD_NAME).build());
106 if (!(evt instanceof
AutopsyEvent) || (((AutopsyEvent) evt).getSourceType() != AutopsyEvent.SourceType.LOCAL)) {
114 LOGGER.log(Level.SEVERE,
"Failed to get instance of db manager.", ex);
120 switch (
Case.
Events.valueOf(evt.getPropertyName())) {
121 case CONTENT_TAG_ADDED:
122 case CONTENT_TAG_DELETED: {
127 case BLACKBOARD_ARTIFACT_TAG_DELETED:
128 case BLACKBOARD_ARTIFACT_TAG_ADDED: {
133 case DATA_SOURCE_ADDED: {
137 case TAG_DEFINITION_CHANGED: {
145 case DATA_SOURCE_NAME_CHANGED: {
149 case OS_ACCT_INSTANCES_ADDED: {
150 if (((AutopsyEvent) evt).getSourceType() == AutopsyEvent.SourceType.LOCAL) {
180 return (t != null && isNotableTagName(t.getName()));
215 private final PropertyChangeEvent
event;
230 handleTagAdded((ContentTagAddedEvent) event);
232 handleTagDeleted((ContentTagDeletedEvent) event);
234 LOGGER.log(Level.SEVERE,
235 String.format(
"Received an event %s of type %s and was expecting either CONTENT_TAG_ADDED or CONTENT_TAG_DELETED.",
236 event, curEventType));
243 LOGGER.log(Level.SEVERE,
"ContentTagDeletedEvent did not have valid content to provide a content id.");
250 if (content == null) {
251 LOGGER.log(Level.WARNING,
257 handleTagChange(content);
265 if (evt.getAddedTag() == null || evt.getAddedTag().getContent() == null) {
266 LOGGER.log(Level.SEVERE,
"ContentTagAddedEvent did not have valid content to provide a content id.");
271 handleTagChange(evt.getAddedTag().getContent());
282 AbstractFile af = null;
286 Long contentID = (content != null) ? content.getId() : null;
287 LOGGER.log(Level.WARNING,
"Error updating non-file object: " + contentID, ex);
300 setContentKnownStatus(af, TskData.FileKnown.BAD);
303 setContentKnownStatus(af, TskData.FileKnown.UNKNOWN);
306 LOGGER.log(Level.SEVERE,
"Failed to obtain tags manager for case.", ex);
322 if (eamArtifact != null) {
327 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
336 private final PropertyChangeEvent
event;
351 handleTagAdded((BlackBoardArtifactTagAddedEvent) event);
353 handleTagDeleted((BlackBoardArtifactTagDeletedEvent) event);
355 LOGGER.log(Level.WARNING,
356 String.format(
"Received an event %s of type %s and was expecting either CONTENT_TAG_ADDED or CONTENT_TAG_DELETED.",
357 event, curEventType));
364 LOGGER.log(Level.SEVERE,
"BlackBoardArtifactTagDeletedEvent did not have valid content to provide a content id.");
373 if (content == null) {
374 LOGGER.log(Level.WARNING,
381 if (bbArtifact == null) {
382 LOGGER.log(Level.WARNING,
388 handleTagChange(content, bbArtifact);
390 LOGGER.log(Level.WARNING,
"Error updating non-file object.", ex);
396 if (evt.getAddedTag() == null || evt.getAddedTag().getContent() == null || evt.getAddedTag().getArtifact() == null) {
397 LOGGER.log(Level.SEVERE,
"BlackBoardArtifactTagAddedEvent did not have valid content to provide a content id.");
402 handleTagChange(evt.getAddedTag().getContent(), evt.getAddedTag().getArtifact());
418 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
423 if (isKnownFile(content)) {
429 if (hasNotableTag(tags)) {
430 setArtifactKnownStatus(bbArtifact, TskData.FileKnown.BAD);
432 setArtifactKnownStatus(bbArtifact, TskData.FileKnown.UNKNOWN);
434 }
catch (TskCoreException ex) {
435 LOGGER.log(Level.SEVERE,
"Failed to obtain tags manager for case.", ex);
448 return ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN));
464 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
473 private final PropertyChangeEvent
event;
485 String modifiedTagName = (String) event.getOldValue();
496 for (BlackboardArtifactTag bbTag : artifactTags) {
498 boolean hasTagWithConflictingKnownStatus =
false;
502 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
503 Content content = bbTag.getContent();
506 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
510 BlackboardArtifact bbArtifact = bbTag.getArtifact();
514 for (BlackboardArtifactTag t : tags) {
516 if (t.getName().equals(tagName)) {
520 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
522 hasTagWithConflictingKnownStatus =
true;
528 if (!hasTagWithConflictingKnownStatus) {
541 for (ContentTag contentTag : fileTags) {
543 boolean hasTagWithConflictingKnownStatus =
false;
547 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
548 Content content = contentTag.getContent();
552 for (ContentTag t : tags) {
554 if (t.getName().equals(tagName)) {
558 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
560 hasTagWithConflictingKnownStatus =
true;
566 if (!hasTagWithConflictingKnownStatus) {
567 Content taggedContent = contentTag.getContent();
568 if (taggedContent instanceof AbstractFile) {
570 if (eamArtifact != null) {
576 }
catch (TskCoreException ex) {
577 LOGGER.log(Level.SEVERE,
"Cannot update known status in central repository for tag: " + modifiedTagName, ex);
579 LOGGER.log(Level.SEVERE,
"Cannot get central repository for tag: " + modifiedTagName, ex);
581 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
589 private final PropertyChangeEvent
event;
605 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
610 Content newDataSource = dataSourceAddedEvent.
getDataSource();
614 if (null == dbManager.
getDataSource(correlationCase, newDataSource.getId())) {
618 LOGGER.log(Level.SEVERE,
"Error adding new data source to the central repository", ex);
626 private final PropertyChangeEvent
event;
639 if ((null == event.getOldValue()) && (event.getNewValue() instanceof
Case)) {
640 Case curCase = (
Case) event.getNewValue();
650 if (dbManager.
getCase(curCase) == null) {
654 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
660 @NbBundle.Messages({
"CaseEventsListener.module.name=Central Repository",
661 "CaseEventsListener.prevCaseComment.text=Users seen in previous cases",
662 "CaseEventsListener.prevExists.text=Previously Seen Users (Central Repository)"})
669 private final PropertyChangeEvent
event;
670 private final String MODULE_NAME = Bundle.CaseEventsListener_module_name();
687 for (OsAccountInstance osAccountInstance : addedOsAccountNew) {
689 OsAccount osAccount = osAccountInstance.getOsAccount();
690 Optional<String> accountAddr = osAccount.getAddr();
693 if (!accountAddr.isPresent() || accountAddr.get().equals(
"S-1-5-18") || accountAddr.get().equals(
"S-1-5-19") || accountAddr.get().equals(
"S-1-5-20")) {
706 TskData.FileKnown.KNOWN,
719 SleuthkitCase tskCase = osAccount.getSleuthkitCase();
720 Blackboard blackboard = tskCase.getBlackboard();
722 Collection<BlackboardAttribute> attributesForNewArtifact = Arrays.asList(
723 new BlackboardAttribute(
724 TSK_SET_NAME, MODULE_NAME,
725 Bundle.CaseEventsListener_prevExists_text()),
726 new BlackboardAttribute(
727 TSK_COMMENT, MODULE_NAME,
728 Bundle.CaseEventsListener_prevCaseComment_text()));
729 BlackboardArtifact newAnalysisResult = osAccount.newAnalysisResult(
730 BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT, Score.SCORE_LIKELY_NOTABLE,
731 null, Bundle.CaseEventsListener_prevExists_text(), null, attributesForNewArtifact, osAccountInstance.getDataSource().getId()).getAnalysisResult();
734 blackboard.postArtifact(newAnalysisResult, MODULE_NAME);
736 }
catch (Blackboard.BlackboardException ex) {
737 LOGGER.log(Level.SEVERE,
"Unable to index blackboard artifact " + newAnalysisResult.getArtifactID(), ex);
744 LOGGER.log(Level.SEVERE, String.format(
"Cannot get central repository for OsAccount: %s.", accountAddr.get()), ex);
746 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
748 LOGGER.log(Level.SEVERE,
"Exception with Correlation Attribute Normalization.", ex);
751 }
catch (TskCoreException ex) {
752 LOGGER.log(Level.SEVERE,
"Cannot get central repository for OsAccount: " +
"OsAccount", ex);
761 private final PropertyChangeEvent
event;
772 Content dataSource = dataSourceNameChangedEvent.
getDataSource();
773 String newName = (String) event.getNewValue();
775 if (!StringUtils.isEmpty(newName)) {
786 LOGGER.log(Level.SEVERE,
"Error updating data source with ID " + dataSource.getId() +
" to " + newName, ex);
788 LOGGER.log(Level.SEVERE,
"No open case", ex);
final PropertyChangeEvent event
final CentralRepository dbManager
ContentTagTask(CentralRepository db, PropertyChangeEvent evt)
static synchronized IngestManager getInstance()
static boolean isNotableTag(Tag t)
DataSourceAddedTask(CentralRepository db, PropertyChangeEvent evt)
static synchronized boolean isFlagSeenDevices()
OsAccountInstancesAddedTask(CentralRepository db, PropertyChangeEvent evt)
final PropertyChangeEvent event
void handleTagAdded(BlackBoardArtifactTagAddedEvent evt)
final CentralRepository dbManager
final PropertyChangeEvent event
List< CorrelationAttributeInstance > getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value)
DeletedBlackboardArtifactTagInfo getDeletedTagInfo()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
static CorrelationAttributeInstance makeCorrAttrFromFile(AbstractFile file)
boolean isIngestRunning()
CorrelationCase getCase(Case autopsyCase)
void setAttributeInstanceKnownStatus(CorrelationAttributeInstance eamArtifact, TskData.FileKnown knownStatus)
String getCorrelationValue()
void handleTagDeleted(BlackBoardArtifactTagDeletedEvent evt)
final ExecutorService jobProcessingExecutor
CurrentCaseTask(CentralRepository db, PropertyChangeEvent evt)
void addArtifactInstance(CorrelationAttributeInstance eamArtifact)
static List< CorrelationAttributeInstance > makeCorrAttrsForCorrelation(BlackboardArtifact artifact)
TskData.FileKnown getKnownStatus()
void uninstallListeners()
TagDefinitionChangeTask(PropertyChangeEvent evt)
static void shutDownTaskExecutor(ExecutorService executor)
final CentralRepository dbManager
boolean isKnownFile(Content content)
TagsManager getTagsManager()
void handleTagChange(Content content, BlackboardArtifact bbArtifact)
final CentralRepository dbManager
CorrelationCase newCase(CorrelationCase eamCase)
final CentralRepository dbManager
SleuthkitCase getSleuthkitCase()
void handleTagChange(Content content)
DataSourceNameChangedTask(CentralRepository db, PropertyChangeEvent evt)
void updateDataSourceName(CorrelationDataSource eamDataSource, String newName)
static boolean isNotableTagName(TagName t)
BLACKBOARD_ARTIFACT_TAG_ADDED
BlackboardTagTask(CentralRepository db, PropertyChangeEvent evt)
void handleTagDeleted(ContentTagDeletedEvent evt)
void setArtifactKnownStatus(BlackboardArtifact bbArtifact, TskData.FileKnown knownStatus)
void propertyChange(PropertyChangeEvent evt)
CorrelationDataSource getDataSource(CorrelationCase correlationCase, Long caseDbDataSourceId)
synchronized static Logger getLogger(String name)
void setContentKnownStatus(AbstractFile af, TskData.FileKnown knownStatus)
static final int OSACCOUNT_TYPE_ID
CorrelationAttributeInstance.Type getCorrelationTypeById(int typeId)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
CorrelationCase getCorrelationCase()
static synchronized boolean shouldCreateCrProperties()
List< OsAccountInstance > getOsAccountInstances()
final PropertyChangeEvent event
final PropertyChangeEvent event
DeletedContentTagInfo getDeletedTagInfo()
void handleTagAdded(ContentTagAddedEvent evt)
final PropertyChangeEvent event
final CentralRepository dbManager
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
static boolean hasNotableTag(List<?extends Tag > tags)
static CentralRepository getInstance()
final PropertyChangeEvent event
BLACKBOARD_ARTIFACT_TAG_DELETED
static boolean isEnabled()