Skip to content

[ADD] Add the ability to batch upload IOC by providing a CSV file - #26

Merged
whikernel merged 3 commits into
dfir-iris:developfrom
wagga40:master
Jan 2, 2022
Merged

[ADD] Add the ability to batch upload IOC by providing a CSV file#26
whikernel merged 3 commits into
dfir-iris:developfrom
wagga40:master

Conversation

@wagga40

@wagga40 wagga40 commented Jan 2, 2022

Copy link
Copy Markdown
Contributor

This PR :

  • allows to upload a lot of IOC at once by providing a CSV import
  • add an upload dialog that shows expected format, provide an example and a sample CSV (check screenshots in Discord)

Please note that :

  • during the process no file is uploaded to the backend, the CSV in sent to the backend as a string
  • TLP are checked and converted into their respective database id
  • provided data is compared to the db schema
  • types are not verified (cf. below)
  • recent modifications in branch "i25_ioc_management" will have impact on this code

@whikernel whikernel self-assigned this Jan 2, 2022
@whikernel whikernel added the enhancement New feature or request label Jan 2, 2022
@whikernel

Copy link
Copy Markdown
Contributor

Nice !
There's a small issue when we upload a CSV with duplicates entries. It generates a BG alert and stops importing.
It's coming from the returns in the loop. We'll just change that to log.error I guess and continue to the next item.
We'll fix it with the merge with i25.
Otherwise super useful feature, thanks a lot !

ioc = add_ioc_schema.load(row)

if ioc.ioc_type not in choices_ioc_types:
return response_error("Not a valid IOC type")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To change to log.error to prevent break of the loop

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Set a list with the failed IOCs and return to UI for awarness

link_existed = add_ioc_link(ioc.ioc_id, caseid)

if link_existed:
return response_error("IOC already exists and linked to this case")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@whikernel
whikernel merged commit d06bea6 into dfir-iris:develop Jan 2, 2022
whikernel added a commit that referenced this pull request Jan 2, 2022
Elise17 pushed a commit that referenced this pull request Oct 1, 2025
Documentation of first /api/v2 REST endpoints, file structure
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants