From 077cf1b70df32ba7b77f6a851d084304aae8ecb4 Mon Sep 17 00:00:00 2001 From: Surya Sashank Nistala Date: Tue, 2 Jul 2024 01:55:06 -0700 Subject: [PATCH] throw error when no iocs are stored due to incompatible ioc types from S3 downloaded iocs file Signed-off-by: Surya Sashank Nistala --- .../securityanalytics/services/STIX2IOCConsumer.java | 8 +++++++- .../service/SATIFSourceConfigManagementService.java | 1 - 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCConsumer.java b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCConsumer.java index 8d53d7ed8..44d3e169e 100644 --- a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCConsumer.java +++ b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCConsumer.java @@ -7,6 +7,8 @@ import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; +import org.opensearch.OpenSearchStatusException; +import org.opensearch.core.rest.RestStatus; import org.opensearch.securityanalytics.commons.model.IOC; import org.opensearch.securityanalytics.commons.model.STIX2; import org.opensearch.securityanalytics.commons.model.UpdateAction; @@ -43,6 +45,10 @@ public void accept(final STIX2 ioc) { // TODO hurneyt refactor once the enum values are updated // If the IOC received is not a type listed for the config, do not add it to the queue if (!feedStore.getSaTifSourceConfig().getIocTypes().contains(stix2IOC.getType().name())) { + log.error("{} is not a supported Ioc type for tif source config {}. Skipping IOC {}: of type {} value {}", + stix2IOC.getType().name(), feedStore.getSaTifSourceConfig().getId(), + stix2IOC.getId(), stix2IOC.getType(), stix2IOC.getValue() + ); return; } @@ -56,7 +62,7 @@ public void accept(final STIX2 ioc) { public void flushIOCs() { if (queue.isEmpty()) { - return; + throw new OpenSearchStatusException("No compatible Iocs were downloaded for config " + feedStore.getSaTifSourceConfig().getName(), RestStatus.BAD_REQUEST); } final List iocsToFlush = new ArrayList<>(queue.size()); diff --git a/src/main/java/org/opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java b/src/main/java/org/opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java index a5bf23386..750c297ef 100644 --- a/src/main/java/org/opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java +++ b/src/main/java/org/opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java @@ -170,7 +170,6 @@ public void createIocAndTIFSourceConfig( listener.onFailure(ex); } )); - listener.onFailure(e); }) ); }, e -> {