CorrelationAttribute.java

Go to the documentation of this file.

/*
 * Central Repository
 *
 * Copyright 2015-2017 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.centralrepository.datamodel;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.List;
import java.util.Objects;
import java.util.regex.Pattern;
import org.openide.util.NbBundle.Messages;

public class CorrelationAttribute implements Serializable {

    private static final long serialVersionUID = 1L;

    private String ID;
    private String correlationValue;
    private Type correlationType;
    private final List<CorrelationAttributeInstance> artifactInstances;

    // Type ID's for Default Correlation Types
    public static final int FILES_TYPE_ID = 0;
    public static final int DOMAIN_TYPE_ID = 1;
    public static final int EMAIL_TYPE_ID = 2;
    public static final int PHONE_TYPE_ID = 3;
    public static final int USBID_TYPE_ID = 4;

    @Messages({"CorrelationType.FILES.displayName=Files",
        "CorrelationType.DOMAIN.displayName=Domains",
        "CorrelationType.EMAIL.displayName=Email Addresses",
        "CorrelationType.PHONE.displayName=Phone Numbers",
        "CorrelationType.USBID.displayName=USB Devices"})
    public static List<CorrelationAttribute.Type> getDefaultCorrelationTypes() throws EamDbException {
        List<CorrelationAttribute.Type> DEFAULT_CORRELATION_TYPES = new ArrayList<>();
        DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(FILES_TYPE_ID, Bundle.CorrelationType_FILES_displayName(), "file", true, true)); // NON-NLS
        DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(DOMAIN_TYPE_ID, Bundle.CorrelationType_DOMAIN_displayName(), "domain", true, true)); // NON-NLS
        DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(EMAIL_TYPE_ID, Bundle.CorrelationType_EMAIL_displayName(), "email_address", true, true)); // NON-NLS
        DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(PHONE_TYPE_ID, Bundle.CorrelationType_PHONE_displayName(), "phone_number", true, true)); // NON-NLS
        DEFAULT_CORRELATION_TYPES.add(new CorrelationAttribute.Type(USBID_TYPE_ID, Bundle.CorrelationType_USBID_displayName(), "usb_devices", true, true)); // NON-NLS
        return DEFAULT_CORRELATION_TYPES;
    }

    public CorrelationAttribute(Type correlationType, String correlationValue) throws EamDbException {
        if(correlationValue == null) { 
            throw new EamDbException ("Correlation value is null");
        }
        this.ID = "";
        this.correlationType = correlationType;
        // Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
        this.correlationValue = correlationValue.toLowerCase();
        this.artifactInstances = new ArrayList<>();
    }

    public Boolean equals(CorrelationAttribute otherArtifact) {
        return ((this.getID().equals(otherArtifact.getID()))
                && (this.getCorrelationType().equals(otherArtifact.getCorrelationType()))
                && (this.getCorrelationValue().equals(otherArtifact.getCorrelationValue()))
                && (this.getInstances().equals(otherArtifact.getInstances())));
    }

    @Override
    public String toString() {
        // NOTE: This string is currently being used in IngestEventsListener to detect if we have already seen
        // the value and type pair.  Be careful if this method is changed.  
        String result = this.getID()
                + this.getCorrelationType().toString()
                + this.getCorrelationValue();
        result = this.getInstances().stream().map((inst) -> inst.toString()).reduce(result, String::concat);
        return result;
    }

    public String getID() {
        return ID;
    }

    public void setID(String ID) {
        this.ID = ID;
    }

    public String getCorrelationValue() {
        return correlationValue;
    }

    public void setCorrelationValue(String correlationValue) {
        // Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
        this.correlationValue = correlationValue.toLowerCase();
    }

    public Type getCorrelationType() {
        return correlationType;
    }

    public void setCorrelationType(Type correlationType) {
        this.correlationType = correlationType;
    }

    public List<CorrelationAttributeInstance> getInstances() {
        return new ArrayList<>(artifactInstances);
    }

    public void setInstances(List<CorrelationAttributeInstance> artifactInstances) {
        this.artifactInstances.clear();
        if (null != artifactInstances) {
            this.artifactInstances.addAll(artifactInstances);
        }
    }

    public void addInstance(CorrelationAttributeInstance artifactInstance) {
        this.artifactInstances.add(artifactInstance);
    }

    public static class Type implements Serializable {

        private int id;
        private String displayName;
        private String dbTableName;
        private Boolean supported;
        private Boolean enabled;
        private final String DB_NAMES_REGEX = "[a-z][a-z0-9_]*";

        public Type(int id, String displayName, String dbTableName, Boolean supported, Boolean enabled) throws EamDbException {
            if(dbTableName == null) {
                throw new EamDbException("dbTableName is null");
            }
            this.id = id;
            this.displayName = displayName;
            this.dbTableName = dbTableName;
            this.supported = supported;
            this.enabled = enabled;
            if (!Pattern.matches(DB_NAMES_REGEX, dbTableName)) {
                throw new EamDbException("Invalid database table name. Name must start with a lowercase letter and can only contain lowercase letters, numbers, and '_'."); // NON-NLS
            }
        }

        public Type(String displayName, String dbTableName, Boolean supported, Boolean enabled) throws EamDbException {
            this(-1, displayName, dbTableName, supported, enabled);
        }

        @Override
        public boolean equals(Object that) {
            if (this == that) {
                return true;
            } else if (!(that instanceof CorrelationAttribute.Type)) {
                return false;
            } else {
                return ((CorrelationAttribute.Type) that).sameType(this);
            }
        }

        private boolean sameType(CorrelationAttribute.Type that) {
            return this.id == that.getId()
                    && Objects.equals(this.supported, that.isSupported())
                    && Objects.equals(this.enabled, that.isEnabled());
        }

        @Override
        public int hashCode() {
            int hash = 7;
            hash = 67 * hash + Objects.hashCode(this.id);
            hash = 67 * hash + Objects.hashCode(this.supported);
            hash = 67 * hash + Objects.hashCode(this.enabled);
            return hash;
        }

        @Override
        public String toString() {
            StringBuilder str = new StringBuilder();
            str.append("(id=").append(getId());
            str.append(", displayName=").append(getDisplayName());
            str.append(", dbTableName=").append(getDbTableName());
            str.append(", supported=").append(isSupported().toString());
            str.append(", enabled=").append(isEnabled().toString());
            str.append(")");
            return str.toString();
        }

        public int getId() {
            return id;
        }

        public void setId(int id) {
            this.id = id;
        }

        public Boolean isSupported() {
            return supported;
        }

        public void setSupported(Boolean supported) {
            this.supported = supported;
        }

        public Boolean isEnabled() {
            return enabled;
        }

        public void setEnabled(Boolean enabled) {
            this.enabled = enabled;
        }

        public String getDisplayName() {
            return displayName;
        }

        public void setDisplayName(String displayName) {
            this.displayName = displayName;
        }

        public String getDbTableName() {
            return dbTableName;
        }

        public void setDbTableName(String dbTableName) throws EamDbException {
            if (!Pattern.matches(DB_NAMES_REGEX, dbTableName)) {
                throw new EamDbException("Invalid database table name. Name must start with a lowercase letter and can only contain lowercase letters, numbers, and '_'."); // NON-NLS
            }
            this.dbTableName = dbTableName;
        }
    }
}