From 3f798b1873d568b29e9c985706f48c58eabdc13c Mon Sep 17 00:00:00 2001 From: apriestman <apriestman@basistech.com> Date: Fri, 30 Jul 2021 11:44:37 -0400 Subject: [PATCH] New artifact for matching personas --- .../datamodel/BlackboardArtifact.java | 18 ++++++++++++++++-- .../org/sleuthkit/datamodel/Bundle.properties | 1 + .../datamodel/Bundle.properties-MERGED | 1 + 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java index 8b738c1f5..35afad341 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java +++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java @@ -1301,6 +1301,12 @@ public static final class Type implements Serializable { * Indicates that the file or artifact was previously tagged as "Notable" in another Autopsy case. */ public static final Type TSK_PREVIOUSLY_NOTABLE = new BlackboardArtifact.Type(71, "TSK_PREVIOUSLY_NOTABLE", bundle.getString("BlackboardArtifact.tskPreviouslyNotable.text"), Category.ANALYSIS_RESULT); + + /** + * *TEMPORARY* Indicates that the artifact is associated with a persona. + */ + public static final Type TSK_MATCHING_PERSONA = new BlackboardArtifact.Type(72, "TSK_MATCHING_PERSONA", bundle.getString("BlackboardArtifact.tskMatchingPersona.text"), Category.ANALYSIS_RESULT); + // NOTE: When adding a new standard BlackboardArtifact.Type, add the instance and then add to the STANDARD_TYPES map. /** @@ -1370,7 +1376,8 @@ public static final class Type implements Serializable { TSK_WEB_CATEGORIZATION, TSK_PREVIOUSLY_SEEN, TSK_PREVIOUSLY_UNSEEN, - TSK_PREVIOUSLY_NOTABLE + TSK_PREVIOUSLY_NOTABLE, + TSK_MATCHING_PERSONA ).collect(Collectors.toMap(type -> type.getTypeID(), type -> type))); private final String typeName; @@ -1881,7 +1888,14 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem { * Indicates that the file or artifact was previously tagged as "Notable" in another Autopsy case. */ TSK_PREVIOUSLY_NOTABLE(71, "TSK_PREVIOUSLY_NOTABLE", - bundle.getString("BlackboardArtifact.tskPreviouslyNotable.text"), Category.ANALYSIS_RESULT); + bundle.getString("BlackboardArtifact.tskPreviouslyNotable.text"), Category.ANALYSIS_RESULT), + + /** + * *TEMPORARY* Indicates that the artifact is associated with a persona. + */ + TSK_MATCHING_PERSONA(72, "TSK_MATCHING_PERSONA", + bundle.getString("BlackboardArtifact.tskMatchingPersona.text"), Category.ANALYSIS_RESULT); + /* * To developers: For each new artifact, ensure that: - The enum value diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties index 3527e9a48..a55bcfc11 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties +++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties @@ -67,6 +67,7 @@ BlackboardArtifact.tskWebCategorization.text=Web Categories BlackboardArtifact.tskPreviouslySeen.text=Previously Seen BlackboardArtifact.tskPreviouslyUnseen.text=Previously Unseen BlackboardArtifact.tskPreviouslyNotable.text=Previously Notable +BlackboardArtifact.tskMatchingPersona.text=Matching Persona BlackboardArtifact.tskYaraHit.text=YARA Hit BlackboardArtifact.tskGPSArea.text=GPS Area BlackboardAttribute.tskAccountType.text=Account Type diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED index 3527e9a48..a55bcfc11 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED +++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED @@ -67,6 +67,7 @@ BlackboardArtifact.tskWebCategorization.text=Web Categories BlackboardArtifact.tskPreviouslySeen.text=Previously Seen BlackboardArtifact.tskPreviouslyUnseen.text=Previously Unseen BlackboardArtifact.tskPreviouslyNotable.text=Previously Notable +BlackboardArtifact.tskMatchingPersona.text=Matching Persona BlackboardArtifact.tskYaraHit.text=YARA Hit BlackboardArtifact.tskGPSArea.text=GPS Area BlackboardAttribute.tskAccountType.text=Account Type -- GitLab