From 5d5dfbf4aeb32f951917485845d77b90628a8642 Mon Sep 17 00:00:00 2001 From: Manuel Abascal Date: Mon, 5 Feb 2024 17:48:47 +0200 Subject: [PATCH 1/6] Fixed Incident-response-trigger-select-cause-modal-scroll (#402) --- .../ir-create-rule.component.html | 17 +++++++++-------- .../ir-create-rule/ir-create-rule.component.ts | 6 ++++-- .../ir-summary/ir-summary.component.html | 13 +++++++------ 3 files changed, 20 insertions(+), 16 deletions(-) diff --git a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html index 8a0e774c3..7799ec61f 100644 --- a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html +++ b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html @@ -42,9 +42,9 @@ Summary -
- +
@@ -126,7 +126,7 @@ [loading]="loadingData(condition.get('field').value)" [multiple]="false" [searchable]="true" - class="flex-grow-1" + class="flex-grow-1 w-30" formControlName="value" id="values"> @@ -149,7 +149,7 @@
-
+
-->
-
-
+ [label]="'Agent handling strategy for the automation'"> +
+ Info! + Select the agent handling strategy for the automation. By default, commands won't run on specified agents, even if the trigger conditions match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria. +
@@ -294,7 +296,6 @@
-
+
@@ -179,17 +179,17 @@
-->
+
+ Info! + Select the agent handling strategy for the automation. By default (not active), commands will run on specified platform agents if the trigger conditions and dataSource field value of the alert match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria. If this option is active, commands will run only on specified platform agents if the trigger conditions and dataSource field value of the alert match, if not, the automation won't be executed. +
-
- Info! - Select the agent handling strategy for the automation. By default, commands won't run on specified agents, even if the trigger conditions match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria. -
+ [label]="'Run on specific agent'">
-
+
-
-
- +
+
+ 0); + this.formRule.get('agentType').setValue(this.rule.excludedAgents.length === 0); this.formRule.get('defaultAgent').setValue(this.rule.defaultAgent); } } else if (this.alert) { @@ -148,6 +148,9 @@ export class IrCreateRuleComponent implements OnInit { } nextStep() { + if (this.step === 3) { + this.formRule.get('command').setValue(this.command); + } this.stepCompleted.push(this.step); this.step += 1; } @@ -194,7 +197,6 @@ export class IrCreateRuleComponent implements OnInit { } editRule() { - console.log('edit'); const action = 'edited'; const actionError = 'editing'; this.clearAgentTypeSelection(); @@ -216,7 +218,7 @@ export class IrCreateRuleComponent implements OnInit { } clearAgentTypeSelection() { - if (!this.formRule.get('agentType').value) { + if (this.formRule.get('agentType').value) { this.formRule.get('excludedAgents').setValue([]); } else { this.formRule.get('defaultAgent').setValue(''); @@ -247,13 +249,12 @@ export class IrCreateRuleComponent implements OnInit { } isDisable(step: number) { - console.log((!this.formRule.get('agentType').value && this.formRule.get('defaultAgent').value === '')); switch (step) { case 1: return !this.formRule.get('name').valid || !this.formRule.get('description').valid || this.exist; case 2: return !this.formRule.get('agentPlatform').valid || this.ruleConditions.length === 0 - || (!this.formRule.get('agentType').value && !this.formRule.get('defaultAgent').value); + || (this.formRule.get('agentType').value && !this.formRule.get('defaultAgent').value); case 3: return !this.command || this.command === ''; } diff --git a/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html index d7915de71..fd495e823 100644 --- a/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html +++ b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html @@ -19,7 +19,7 @@ - + Importantly, the automation excludes designated agents, such as @@ -28,7 +28,7 @@ - + In case none of the agents satisfy the specified conditions, the automation will smoothly revert and execute on the default agent, @@ -44,7 +44,7 @@ Crucially, when these conditions are met, the automation will proceed to execute the following action: - +
diff --git a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java index 8f8d6945e..a8883a99f 100644 --- a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java +++ b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java @@ -19,6 +19,7 @@ public class WinEventLog{ public ArrayList keywords; public String level; public String log_name; + public String message; public String opcode; public int process_id; @@ -27,7 +28,7 @@ public class WinEventLog{ public String source_name; public ArrayList tags; public String task; - public int thread_id; + public String thread_id; public int version; } From 69c3efb32a9681c535e96d4a9fb5fc6cbb2ade98 Mon Sep 17 00:00:00 2001 From: Manuel Abascal Date: Mon, 5 Feb 2024 20:34:10 +0200 Subject: [PATCH 3/6] Fixed Incident-response-trigger-select-cause-modal-scroll (#402) --- .../com/utmstack/userauditor/model/winevent/WinEventLog.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java index a8883a99f..8f8d6945e 100644 --- a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java +++ b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java @@ -19,7 +19,6 @@ public class WinEventLog{ public ArrayList keywords; public String level; public String log_name; - public String message; public String opcode; public int process_id; @@ -28,7 +27,7 @@ public class WinEventLog{ public String source_name; public ArrayList tags; public String task; - public String thread_id; + public int thread_id; public int version; } From ddda2fa5e793ba5a27481028f711c47180188104 Mon Sep 17 00:00:00 2001 From: Manuel Abascal Date: Mon, 5 Feb 2024 21:01:42 +0200 Subject: [PATCH 4/6] Fixed Incident-response-trigger-select-cause-modal-scroll (#402) --- .../ir-create-rule/ir-create-rule.component.html | 2 +- .../ir-create-rule/ir-create-rule.component.ts | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html index 1de1e11a1..cde64423f 100644 --- a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html +++ b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html @@ -183,7 +183,7 @@ Info! Select the agent handling strategy for the automation. By default (not active), commands will run on specified platform agents if the trigger conditions and dataSource field value of the alert match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria. If this option is active, commands will run only on specified platform agents if the trigger conditions and dataSource field value of the alert match, if not, the automation won't be executed.
- Date: Mon, 5 Feb 2024 23:30:29 +0200 Subject: [PATCH 5/6] Fixed Auditor crash try to parse (#405) --- .../utmstack/userauditor/model/winevent/WinEventLog.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java index 8f8d6945e..53d2859f9 100644 --- a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java +++ b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java @@ -19,16 +19,17 @@ public class WinEventLog{ public ArrayList keywords; public String level; public String log_name; + public String message; public String opcode; - public int process_id; + public String process_id; public String provider_guid; - public int record_number; + public String record_number; public String source_name; public ArrayList tags; public String task; - public int thread_id; - public int version; + public String thread_id; + public String version; } From 471ca243c9860d2f9288fcaf64db8ad91e57877d Mon Sep 17 00:00:00 2001 From: Manuel Abascal Date: Mon, 5 Feb 2024 23:44:58 +0200 Subject: [PATCH 6/6] Fixed Auditor crash try to parse (#405) --- .../com/utmstack/userauditor/model/winevent/WinEventLog.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java index 53d2859f9..c4773247f 100644 --- a/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java +++ b/user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java @@ -20,7 +20,7 @@ public class WinEventLog{ public String level; public String log_name; - public String message; + public String mesage; public String opcode; public String process_id; public String provider_guid;