Remove abuse.ch Randsomware Tracker content pack (#19519)

changelog/unreleased/pr-19519.toml

@@ -0,0 +1,6 @@
+type = "r"
+message = "Removed default Content Pack for defunct abuse.ch ransomware tracker."
+
+issues = ["Graylog2/graylog-plugin-integrations#945"]
+pulls = ["19519"]
+

graylog2-server/src/main/java/org/graylog/plugins/threatintel/ThreatIntelPluginModule.java

@@ -40,6 +40,7 @@
 import org.graylog.plugins.threatintel.functions.tor.TorExitNodeLookupFunction;
 import org.graylog.plugins.threatintel.migrations.V20170821100300_MigrateOTXAPIToken;
 import org.graylog.plugins.threatintel.migrations.V20180906112716_RecreateThreatintelLookupTables;
+import org.graylog.plugins.threatintel.migrations.V20240531101100_RemoveAbusechContentPack;
 import org.graylog.plugins.threatintel.whois.ip.WhoisDataAdapter;
 import org.graylog.plugins.threatintel.whois.ip.WhoisLookupIpFunction;
 import org.graylog2.plugin.PluginConfigBean;
@@ -92,6 +93,7 @@ protected void configure() {
 
         addMigration(V20180906112716_RecreateThreatintelLookupTables.class);
         addMigration(V20170821100300_MigrateOTXAPIToken.class);
+        addMigration(V20240531101100_RemoveAbusechContentPack.class);
 
         addDomainFunction("abusech_ransomware", AbuseChRansomDomainLookupFunction.class);
         addIPFunction("abusech_ransomware", AbuseChRansomIpLookupFunction.class);

graylog2-server/src/main/java/org/graylog/plugins/threatintel/migrations/V20180906112716_RecreateThreatintelLookupTables.java

@@ -21,6 +21,7 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.auto.value.AutoValue;
+import jakarta.inject.Inject;
 import org.graylog.autovalue.WithBeanGetter;
 import org.graylog2.contentpacks.ContentPackPersistenceService;
 import org.graylog2.contentpacks.exceptions.ContentPackException;
@@ -30,8 +31,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import jakarta.inject.Inject;
-
 import java.io.IOException;
 import java.net.URL;
 import java.time.ZonedDateTime;
@@ -70,7 +69,6 @@ public void upgrade() {
             final String[] contentPacks = {
                     "V20180906112716_RecreateThreatintelLookupTables-content_pack-OTX.json",
                     "V20180906112716_RecreateThreatintelLookupTables-content_pack-tor.json",
-                    "V20180906112716_RecreateThreatintelLookupTables-content_pack-abuse.json",
                     "V20180906112716_RecreateThreatintelLookupTables-content_pack-spamhaus.json",
                     "V20180906112716_RecreateThreatintelLookupTables-content_pack-whois.json",
             };

graylog2-server/src/main/java/org/graylog/plugins/threatintel/migrations/V20240531101100_RemoveAbusechContentPack.java

@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2020 Graylog, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the Server Side Public License, version 1,
+ * as published by MongoDB, Inc.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * Server Side Public License for more details.
+ *
+ * You should have received a copy of the Server Side Public License
+ * along with this program. If not, see
+ * <http://www.mongodb.com/licensing/server-side-public-license>.
+ */
+package org.graylog.plugins.threatintel.migrations;
+
+import jakarta.inject.Inject;
+import org.graylog2.contentpacks.ContentPackInstallationPersistenceService;
+import org.graylog2.contentpacks.ContentPackPersistenceService;
+import org.graylog2.contentpacks.ContentPackService;
+import org.graylog2.contentpacks.model.ContentPack;
+import org.graylog2.contentpacks.model.ModelId;
+import org.graylog2.migrations.Migration;
+import org.graylog2.plugin.cluster.ClusterConfigService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.ZonedDateTime;
+import java.util.Set;
+
+public class V20240531101100_RemoveAbusechContentPack extends Migration {
+    private static final Logger LOG = LoggerFactory.getLogger(V20240531101100_RemoveAbusechContentPack.class);
+    private static final ModelId CONTENT_PACK_ID = ModelId.of("cbacd801-7824-c554-3fb1-475491b03826");
+
+    private final ContentPackService contentPackService;
+    private final ContentPackPersistenceService contentPackPersistenceService;
+    private final ContentPackInstallationPersistenceService contentPackInstallationPersistenceService;
+    private final ClusterConfigService clusterConfigService;
+
+    @Inject
+    public V20240531101100_RemoveAbusechContentPack(final ContentPackService contentPackService,
+                                                    final ContentPackPersistenceService contentPackPersistenceService,
+                                                    final ContentPackInstallationPersistenceService contentPackInstallationPersistenceService,
+                                                    final ClusterConfigService clusterConfigService) {
+        this.contentPackService = contentPackService;
+        this.contentPackPersistenceService = contentPackPersistenceService;
+        this.contentPackInstallationPersistenceService = contentPackInstallationPersistenceService;
+        this.clusterConfigService = clusterConfigService;
+    }
+
+    @Override
+    public ZonedDateTime createdAt() {
+        return ZonedDateTime.parse("2024-05-31T10:11:00Z");
+    }
+
+    @Override
+    public void upgrade() {
+        if (clusterConfigService.get(V20240531101100_RemoveAbusechContentPack.MigrationCompleted.class) != null) {
+            LOG.debug("Migration already completed!");
+            return;
+        }
+        Set<ContentPack> existingPacks = contentPackPersistenceService.findAllById(CONTENT_PACK_ID);
+        if (!existingPacks.isEmpty()) {
+            LOG.debug("Removing deprecated Abuse.ch content pack");
+            existingPacks.forEach(pack -> {
+                contentPackInstallationPersistenceService.findByContentPackIdAndRevision(CONTENT_PACK_ID, pack.revision())
+                        .forEach(i -> contentPackService.uninstallContentPack(pack, i));
+                contentPackPersistenceService.deleteById(pack.id());
+            });
+        }
+        clusterConfigService.write(new MigrationCompleted());
+    }
+
+    record MigrationCompleted() {}
+}