19 package org.sleuthkit.autopsy.centralrepository.eventlisteners;
21 import com.google.common.util.concurrent.ThreadFactoryBuilder;
22 import java.beans.PropertyChangeEvent;
23 import java.beans.PropertyChangeListener;
24 import java.util.List;
25 import java.util.concurrent.ExecutorService;
26 import java.util.concurrent.Executors;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import org.openide.util.NbBundle.Messages;
60 @Messages({
"caseeventlistener.evidencetag=Evidence"})
61 final class CaseEventListener implements PropertyChangeListener {
64 private final ExecutorService jobProcessingExecutor;
65 private static final String CASE_EVENT_THREAD_NAME =
"Case-Event-Listener-%d";
68 jobProcessingExecutor = Executors.newSingleThreadExecutor(
new ThreadFactoryBuilder().setNameFormat(CASE_EVENT_THREAD_NAME).build());
76 public void propertyChange(PropertyChangeEvent evt) {
81 LOGGER.log(Level.SEVERE,
"Failed to get instance of db manager.", ex);
84 switch (
Case.
Events.valueOf(evt.getPropertyName())) {
85 case CONTENT_TAG_ADDED:
86 case CONTENT_TAG_DELETED: {
87 jobProcessingExecutor.submit(
new ContentTagTask(dbManager, evt));
91 case BLACKBOARD_ARTIFACT_TAG_DELETED:
92 case BLACKBOARD_ARTIFACT_TAG_ADDED: {
93 jobProcessingExecutor.submit(
new BlackboardTagTask(dbManager, evt));
97 case DATA_SOURCE_ADDED: {
98 jobProcessingExecutor.submit(
new DataSourceAddedTask(dbManager, evt));
101 case TAG_DEFINITION_CHANGED: {
102 jobProcessingExecutor.submit(
new TagDefinitionChangeTask(evt));
106 jobProcessingExecutor.submit(
new CurrentCaseTask(dbManager, evt));
115 private final PropertyChangeEvent
event;
129 TskData.FileKnown knownStatus;
135 final ContentTag tagAdded = tagAddedEvent.getAddedTag();
138 if (tagAdded.getContent() instanceof AbstractFile) {
139 af = (AbstractFile) tagAdded.getContent();
140 knownStatus = TskData.FileKnown.BAD;
141 comment = tagAdded.getComment();
143 LOGGER.log(Level.WARNING,
"Error updating non-file object");
170 .map(tag -> tag.getName().getDisplayName())
172 .collect(Collectors.toList())
176 if (content instanceof AbstractFile) {
177 af = (AbstractFile) content;
178 knownStatus = TskData.FileKnown.UNKNOWN;
181 LOGGER.log(Level.WARNING,
"Error updating non-file object");
189 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
196 if (eamArtifact != null) {
201 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
210 private final PropertyChangeEvent
event;
224 BlackboardArtifact bbArtifact;
225 TskData.FileKnown knownStatus;
231 final BlackboardArtifactTag tagAdded = tagAddedEvent.getAddedTag();
234 content = tagAdded.getContent();
235 bbArtifact = tagAdded.getArtifact();
236 knownStatus = TskData.FileKnown.BAD;
237 comment = tagAdded.getComment();
247 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
271 .map(tag -> tag.getName().getDisplayName())
273 .collect(Collectors.toList())
277 knownStatus = TskData.FileKnown.UNKNOWN;
284 }
catch (TskCoreException ex) {
285 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
290 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
296 eamArtifact.setComment(comment);
300 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
309 private final PropertyChangeEvent
event;
321 String modifiedTagName = (String) event.getOldValue();
332 for (BlackboardArtifactTag bbTag : artifactTags) {
334 boolean hasTagWithConflictingKnownStatus =
false;
338 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
339 Content content = bbTag.getContent();
342 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
346 BlackboardArtifact bbArtifact = bbTag.getArtifact();
350 for (BlackboardArtifactTag t : tags) {
352 if (t.getName().equals(tagName)) {
356 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
358 hasTagWithConflictingKnownStatus =
true;
364 if (!hasTagWithConflictingKnownStatus) {
377 for (ContentTag contentTag : fileTags) {
379 boolean hasTagWithConflictingKnownStatus =
false;
383 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
384 Content content = contentTag.getContent();
388 for (ContentTag t : tags) {
390 if (t.getName().equals(tagName)) {
394 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
396 hasTagWithConflictingKnownStatus =
true;
402 if (!hasTagWithConflictingKnownStatus) {
404 if (eamArtifact != null) {
409 }
catch (TskCoreException ex) {
410 LOGGER.log(Level.SEVERE,
"Cannot update known status in central repository for tag: " + modifiedTagName, ex);
412 LOGGER.log(Level.SEVERE,
"Cannot get central repository for tag: " + modifiedTagName, ex);
414 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
422 private final PropertyChangeEvent
event;
438 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
443 Content newDataSource = dataSourceAddedEvent.
getDataSource();
447 if (null == correlationCase) {
448 correlationCase = dbManager.
newCase(openCase);
450 if (null == dbManager.
getDataSource(correlationCase, newDataSource.getId())) {
454 LOGGER.log(Level.SEVERE,
"Error adding new data source to the central repository", ex);
462 private final PropertyChangeEvent
event;
475 if ((null == event.getOldValue()) && (event.getNewValue() instanceof
Case)) {
476 Case curCase = (
Case) event.getNewValue();
486 if (dbManager.
getCase(curCase) == null) {
490 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
static List< CorrelationAttributeInstance > makeInstancesFromBlackboardArtifact(BlackboardArtifact artifact, boolean checkEnabled)
final PropertyChangeEvent event
DataSourceAddedTask(EamDb db, PropertyChangeEvent evt)
CorrelationCase newCase(CorrelationCase eamCase)
DeletedBlackboardArtifactTagInfo getDeletedTagInfo()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
TskData.FileKnown getKnownStatus()
TagDefinitionChangeTask(PropertyChangeEvent evt)
static void shutDownTaskExecutor(ExecutorService executor)
ContentTagTask(EamDb db, PropertyChangeEvent evt)
TagsManager getTagsManager()
static EamDb getInstance()
CorrelationDataSource getDataSource(CorrelationCase correlationCase, Long caseDbDataSourceId)
void setAttributeInstanceKnownStatus(CorrelationAttributeInstance eamArtifact, TskData.FileKnown knownStatus)
CurrentCaseTask(EamDb db, PropertyChangeEvent evt)
static boolean isEnabled()
SleuthkitCase getSleuthkitCase()
static CorrelationAttributeInstance makeInstanceFromContent(Content content)
BLACKBOARD_ARTIFACT_TAG_ADDED
CorrelationCase getCase(Case autopsyCase)
BlackboardTagTask(EamDb db, PropertyChangeEvent evt)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
final PropertyChangeEvent event
final PropertyChangeEvent event
DeletedContentTagInfo getDeletedTagInfo()
final PropertyChangeEvent event
final PropertyChangeEvent event